@indigoai-us/hq-cli 5.309.1 → 5.311.0

package/dist/lib/mesh/live/daemon/credentials.d.ts

@@ -3,14 +3,7 @@
  * Never logs or persists credential material.
  */
 import type { IotCredentials } from "./presign.js";
-export declare const REALTIME_CREDENTIALS_PATH = "/v1/realtime/credentials";
 export declare const MQTT_KEEPALIVE_SECONDS = 15;
-/** Renew at 80% of credential lifetime. */
-export declare const CREDENTIAL_RENEWAL_FRACTION = 0.8;
-export declare const MIN_RENEWAL_DELAY_MS = 5000;
-/** Long retry when the server refuses credentials (disabled / unsupported). */
-export declare const DEFAULT_REFUSED_RETRY_MS: number;
-export declare const REFUSED_RETRY_ENV = "HQ_MESH_DAEMON_REFUSED_RETRY_MS";
 /**
  * Node's setTimeout treats delays above this as ~1ms (signed 32-bit overflow).
  * Always schedule long waits via {@link scheduleBoundedTimeout}.
@@ -18,10 +11,6 @@ export declare const REFUSED_RETRY_ENV = "HQ_MESH_DAEMON_REFUSED_RETRY_MS";
 export declare const MAX_TIMER_DELAY_MS = 2147483647;
 /** Cap any single retry so a bogus Retry-After cannot park the daemon. */
 export declare const MAX_RETRY_DELAY_MS: number;
-/** Contract-3 vend accepts at most this many preferred company uids. */
-export declare const PREFERRED_COMPANY_LIMIT = 5;
-/** Session files older than this do not count as companies in use. */
-export declare const PREFERRED_SESSION_WINDOW_MS: number;
 /** Preferred-set changes re-vend at most this often. */
 export declare const PREFERRED_REVEND_MIN_MS = 60000;
 export type CredentialVendFailureKind = "refused" | "transient";
@@ -44,14 +33,13 @@ export declare class CredentialVendError extends Error {
     });
 }
 export declare function parseRetryAfterMs(value: string | null | undefined, nowMs?: number): number | undefined;
-export declare function extractVendErrorCode(body: unknown): string | undefined;
 /** True for server "not now" responses that should use the long retry. */
 export declare function isCredentialVendRefused(status: number, code: string | undefined): boolean;
 export declare function classifyCredentialVendFailure(status: number, body: unknown, retryAfterHeader?: string | null, nowMs?: number): CredentialVendError;
 export declare function defaultRefusedRetryMs(env?: NodeJS.ProcessEnv): number;
 /** ±20% jitter around the refused-retry base interval. */
 export declare function refusedRetryDelayMs(baseMs: number, random: () => number): number;
-export interface PresenceCompany {
+interface PresenceCompany {
     companyUid: string;
     presenceTopic: string;
 }
@@ -124,10 +112,6 @@ export declare function shouldRevendPreferredCompanies(input: {
     nowMs: number;
     minIntervalMs?: number;
 }): boolean;
-export declare function contract3VendBody(preferredCompanyUids: readonly string[] | undefined): {
-    contractVersion: 3;
-    preferredCompanyUids?: string[];
-};
 /** Plain doctor line for one company the vend left out. */
 export declare function formatDroppedPresenceCompany(company: DroppedPresenceCompany): string;
 export type CredentialVendPostResult = {
@@ -200,4 +184,5 @@ export declare function createPersonalRealtimeFetcher(opts: {
     baseUrl?: string;
     post?: (path: string, body: unknown) => Promise<CredentialVendPostResult>;
 }): PersonalCredentialsFetcher;
+export {};
 //# sourceMappingURL=credentials.d.ts.map

package/dist/lib/mesh/live/daemon/credentials.js

@@ -9,14 +9,14 @@ import { vaultApiFetch } from "../../../../utils/vault-api.js";
 import { readAgentIdentityCompanyUid } from "../../../work-context/company.js";
 import { readDeviceConfig } from "../../../work-context/config.js";
 import { workContextSessionsDir } from "../../../work-context/paths.js";
-export const REALTIME_CREDENTIALS_PATH = "/v1/realtime/credentials";
+const REALTIME_CREDENTIALS_PATH = "/v1/realtime/credentials";
 export const MQTT_KEEPALIVE_SECONDS = 15;
 /** Renew at 80% of credential lifetime. */
-export const CREDENTIAL_RENEWAL_FRACTION = 0.8;
-export const MIN_RENEWAL_DELAY_MS = 5_000;
+const CREDENTIAL_RENEWAL_FRACTION = 0.8;
+const MIN_RENEWAL_DELAY_MS = 5_000;
 /** Long retry when the server refuses credentials (disabled / unsupported). */
-export const DEFAULT_REFUSED_RETRY_MS = 10 * 60_000;
-export const REFUSED_RETRY_ENV = "HQ_MESH_DAEMON_REFUSED_RETRY_MS";
+const DEFAULT_REFUSED_RETRY_MS = 10 * 60_000;
+const REFUSED_RETRY_ENV = "HQ_MESH_DAEMON_REFUSED_RETRY_MS";
 /**
  * Node's setTimeout treats delays above this as ~1ms (signed 32-bit overflow).
  * Always schedule long waits via {@link scheduleBoundedTimeout}.
@@ -25,9 +25,9 @@ export const MAX_TIMER_DELAY_MS = 2_147_483_647;
 /** Cap any single retry so a bogus Retry-After cannot park the daemon. */
 export const MAX_RETRY_DELAY_MS = 24 * 60 * 60 * 1000;
 /** Contract-3 vend accepts at most this many preferred company uids. */
-export const PREFERRED_COMPANY_LIMIT = 5;
+const PREFERRED_COMPANY_LIMIT = 5;
 /** Session files older than this do not count as companies in use. */
-export const PREFERRED_SESSION_WINDOW_MS = 24 * 60 * 60 * 1000;
+const PREFERRED_SESSION_WINDOW_MS = 24 * 60 * 60 * 1000;
 /** Preferred-set changes re-vend at most this often. */
 export const PREFERRED_REVEND_MIN_MS = 60_000;
 /**
@@ -66,7 +66,7 @@ export function parseRetryAfterMs(value, nowMs = Date.now()) {
     }
     return undefined;
 }
-export function extractVendErrorCode(body) {
+function extractVendErrorCode(body) {
     if (!body || typeof body !== "object" || Array.isArray(body))
         return undefined;
     const code = body.code;
@@ -370,7 +370,7 @@ export function shouldRevendPreferredCompanies(input) {
     const min = input.minIntervalMs ?? PREFERRED_REVEND_MIN_MS;
     return input.nowMs - input.lastVendMs >= min;
 }
-export function contract3VendBody(preferredCompanyUids) {
+function contract3VendBody(preferredCompanyUids) {
     const body = {
         contractVersion: 3,
     };

package/dist/lib/mesh/live/daemon/index.d.ts

@@ -1,14 +1,14 @@
 export { DAEMON_DIRNAME, DAEMON_LOG_MAX_BYTES, DAEMON_LOG_NAME, DAEMON_PID_NAME, DAEMON_STATE_NAME, LAUNCHD_LABEL, SYSTEMD_UNIT_NAME, WINDOWS_TASK_NAME, daemonDir, daemonLogPath, daemonPidPath, daemonStatePath, sessionBoardPath, } from "./paths.js";
 export { acquirePidLock, defaultPidLockDeps, parsePidLock, pidLockStatus, readPidLock, releasePidLock, resolveDaemonDir, } from "./pid-lock.js";
 export type { PidLockDeps, PidLockRecord, PidLockResult } from "./pid-lock.js";
-export { CREDENTIAL_RENEWAL_FRACTION, DEFAULT_REFUSED_RETRY_MS, MAX_RETRY_DELAY_MS, MAX_TIMER_DELAY_MS, MQTT_KEEPALIVE_SECONDS, REALTIME_CREDENTIALS_PATH, REFUSED_RETRY_ENV, CredentialRenewalManager, CredentialVendError, classifyCredentialVendFailure, clampRetryDelayMs, createContract3Fetcher, defaultRefusedRetryMs, extractVendErrorCode, isCredentialVendRefused, normalizeContract3Bundle, parseRetryAfterMs, realTimerHost, refusedRetryDelayMs, renewalDelayMs, scheduleBoundedTimeout, } from "./credentials.js";
-export type { BoundedTimeoutHandle, Contract3Bundle, CredentialRenewalErrorInfo, CredentialVendFailureKind, CredentialVendPostResult, CredentialsFetcher, PresenceCompany, TimerHost, } from "./credentials.js";
+export { MAX_RETRY_DELAY_MS, MAX_TIMER_DELAY_MS, MQTT_KEEPALIVE_SECONDS, CredentialRenewalManager, CredentialVendError, classifyCredentialVendFailure, clampRetryDelayMs, createContract3Fetcher, defaultRefusedRetryMs, isCredentialVendRefused, normalizeContract3Bundle, parseRetryAfterMs, realTimerHost, refusedRetryDelayMs, renewalDelayMs, scheduleBoundedTimeout, } from "./credentials.js";
+export type { BoundedTimeoutHandle, Contract3Bundle, CredentialRenewalErrorInfo, CredentialVendFailureKind, CredentialVendPostResult, CredentialsFetcher, TimerHost, } from "./credentials.js";
 export { amzDateOf, hex, presignIotWssUrl, rfc3986Encode } from "./presign.js";
 export type { IotCredentials } from "./presign.js";
 export { CLOSE_LOG_ALWAYS_COUNT, CLOSE_LOG_INTERVAL_MS, CONNECT_STABLE_GRACE_MS, PresenceClient, backoffDelayMs, buildPresencePayload, defaultMqttConnect, isOwnPresenceTopic, } from "./presence.js";
 export type { MeshMqttClientLike, MqttConnectFn, MqttConnectionState, PresenceClientOptions, PresencePayload, PresenceRefusal, } from "./presence.js";
 export { defaultDaemonState, patchDaemonState, readDaemonState, writeDaemonState, } from "./state.js";
-export type { DaemonStateFile, PresenceRefusalState } from "./state.js";
+export type { DaemonStateFile } from "./state.js";
 export { appendDaemonLog, daemonLogLine, ensureDaemonLog, resolveDaemonAssetDir, rotateDaemonLogIfNeeded, } from "./log.js";
 export { BOARD_REFRESH_INTERVAL_MS, createVaultBoardReader, formatBoardMarkdown, refreshBoundSessionBoards, writeBoardMarkdown, } from "./board-refresh.js";
 export type { BoardReader, BoardRefreshDeps, BoardStorySnapshot } from "./board-refresh.js";
@@ -22,6 +22,6 @@ export type { DaemonDoctorDeps, DaemonDoctorReport } from "./doctor.js";
 export { scopeBundleToAgentIdentity, } from "./credentials.js";
 export { FLUSH_INTERVAL_MS, DAEMON_VERSION_DRIFT_EXIT_CODE, SPOOL_DEBOUNCE_MS, runMeshDaemon, } from "./run.js";
 export type { DaemonHandle, DaemonRunDeps } from "./run.js";
-export { TRANSCRIPT_ADAPTER_VERSION, TRANSCRIPT_EVENT_SOURCE, TRANSCRIPT_FRESH_MS, TRANSCRIPT_HOOK_COVER_MS, TRANSCRIPT_MARKER, TRANSCRIPT_SESSION_END_MS, TRANSCRIPT_HOOK_QUIET_ADOPT_MS, TRANSCRIPT_TURN_QUIET_MS, TRANSCRIPT_WATCH_BACKOFF_DURATION_MS, TRANSCRIPT_WATCH_BACKOFF_ENTRIES, TRANSCRIPT_WATCH_ENTRY_CAP, TRANSCRIPT_WATCH_INTERVAL_MAX_MS, TRANSCRIPT_WATCH_INTERVAL_MS, TRANSCRIPT_WATCH_REVALIDATE_MS, TranscriptWatcher, createTranscriptDiscoverCache, decodeClaudeProjectDirName, defaultTranscriptFs, discoverTranscripts, discoverTranscriptsWithMeta, isTranscriptHookCovered, nextTranscriptWatchIntervalMs, noteHookSessionsFromSpoolFile, resolveTranscriptRegistration, sessionIdFromClaudeTranscriptPath, sessionIdFromCodexTranscriptPath, sortDiscoveries, } from "./transcript-watch.js";
-export type { DiscoveredTranscript, DiscoverScanMeta, DiscoverTranscriptsResult, TranscriptDiscoverCache, TranscriptFs, TranscriptKind, TranscriptWatchDeps, TranscriptWatchTickResult, } from "./transcript-watch.js";
+export { TRANSCRIPT_EVENT_SOURCE, TRANSCRIPT_HOOK_COVER_MS, TRANSCRIPT_MARKER, TRANSCRIPT_SESSION_END_MS, TRANSCRIPT_HOOK_QUIET_ADOPT_MS, TRANSCRIPT_TURN_QUIET_MS, TRANSCRIPT_WATCH_BACKOFF_DURATION_MS, TRANSCRIPT_WATCH_BACKOFF_ENTRIES, TRANSCRIPT_WATCH_INTERVAL_MAX_MS, TRANSCRIPT_WATCH_INTERVAL_MS, TRANSCRIPT_WATCH_REVALIDATE_MS, TranscriptWatcher, createTranscriptDiscoverCache, decodeClaudeProjectDirName, defaultTranscriptFs, discoverTranscripts, discoverTranscriptsWithMeta, isTranscriptHookCovered, nextTranscriptWatchIntervalMs, noteHookSessionsFromSpoolFile, resolveTranscriptRegistration, sessionIdFromClaudeTranscriptPath, sessionIdFromCodexTranscriptPath, sortDiscoveries, } from "./transcript-watch.js";
+export type { DiscoveredTranscript, DiscoverTranscriptsResult, TranscriptDiscoverCache, TranscriptFs, TranscriptWatchDeps, TranscriptWatchTickResult, } from "./transcript-watch.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/lib/mesh/live/daemon/index.js

@@ -1,6 +1,6 @@
 export { DAEMON_DIRNAME, DAEMON_LOG_MAX_BYTES, DAEMON_LOG_NAME, DAEMON_PID_NAME, DAEMON_STATE_NAME, LAUNCHD_LABEL, SYSTEMD_UNIT_NAME, WINDOWS_TASK_NAME, daemonDir, daemonLogPath, daemonPidPath, daemonStatePath, sessionBoardPath, } from "./paths.js";
 export { acquirePidLock, defaultPidLockDeps, parsePidLock, pidLockStatus, readPidLock, releasePidLock, resolveDaemonDir, } from "./pid-lock.js";
-export { CREDENTIAL_RENEWAL_FRACTION, DEFAULT_REFUSED_RETRY_MS, MAX_RETRY_DELAY_MS, MAX_TIMER_DELAY_MS, MQTT_KEEPALIVE_SECONDS, REALTIME_CREDENTIALS_PATH, REFUSED_RETRY_ENV, CredentialRenewalManager, CredentialVendError, classifyCredentialVendFailure, clampRetryDelayMs, createContract3Fetcher, defaultRefusedRetryMs, extractVendErrorCode, isCredentialVendRefused, normalizeContract3Bundle, parseRetryAfterMs, realTimerHost, refusedRetryDelayMs, renewalDelayMs, scheduleBoundedTimeout, } from "./credentials.js";
+export { MAX_RETRY_DELAY_MS, MAX_TIMER_DELAY_MS, MQTT_KEEPALIVE_SECONDS, CredentialRenewalManager, CredentialVendError, classifyCredentialVendFailure, clampRetryDelayMs, createContract3Fetcher, defaultRefusedRetryMs, isCredentialVendRefused, normalizeContract3Bundle, parseRetryAfterMs, realTimerHost, refusedRetryDelayMs, renewalDelayMs, scheduleBoundedTimeout, } from "./credentials.js";
 export { amzDateOf, hex, presignIotWssUrl, rfc3986Encode } from "./presign.js";
 export { CLOSE_LOG_ALWAYS_COUNT, CLOSE_LOG_INTERVAL_MS, CONNECT_STABLE_GRACE_MS, PresenceClient, backoffDelayMs, buildPresencePayload, defaultMqttConnect, isOwnPresenceTopic, } from "./presence.js";
 export { defaultDaemonState, patchDaemonState, readDaemonState, writeDaemonState, } from "./state.js";
@@ -11,5 +11,5 @@ export { daemonConfigPath, findAncestorHqRoot, isInstallableHqRoot, readDaemonCo
 export { UNHEALTHY_SPOOL_AGE_MS, collectDaemonDoctor, formatCliIdentityLines, formatCliMismatchLine, formatDaemonDoctor, listHqBinariesOnPath, } from "./doctor.js";
 export { scopeBundleToAgentIdentity, } from "./credentials.js";
 export { FLUSH_INTERVAL_MS, DAEMON_VERSION_DRIFT_EXIT_CODE, SPOOL_DEBOUNCE_MS, runMeshDaemon, } from "./run.js";
-export { TRANSCRIPT_ADAPTER_VERSION, TRANSCRIPT_EVENT_SOURCE, TRANSCRIPT_FRESH_MS, TRANSCRIPT_HOOK_COVER_MS, TRANSCRIPT_MARKER, TRANSCRIPT_SESSION_END_MS, TRANSCRIPT_HOOK_QUIET_ADOPT_MS, TRANSCRIPT_TURN_QUIET_MS, TRANSCRIPT_WATCH_BACKOFF_DURATION_MS, TRANSCRIPT_WATCH_BACKOFF_ENTRIES, TRANSCRIPT_WATCH_ENTRY_CAP, TRANSCRIPT_WATCH_INTERVAL_MAX_MS, TRANSCRIPT_WATCH_INTERVAL_MS, TRANSCRIPT_WATCH_REVALIDATE_MS, TranscriptWatcher, createTranscriptDiscoverCache, decodeClaudeProjectDirName, defaultTranscriptFs, discoverTranscripts, discoverTranscriptsWithMeta, isTranscriptHookCovered, nextTranscriptWatchIntervalMs, noteHookSessionsFromSpoolFile, resolveTranscriptRegistration, sessionIdFromClaudeTranscriptPath, sessionIdFromCodexTranscriptPath, sortDiscoveries, } from "./transcript-watch.js";
+export { TRANSCRIPT_EVENT_SOURCE, TRANSCRIPT_HOOK_COVER_MS, TRANSCRIPT_MARKER, TRANSCRIPT_SESSION_END_MS, TRANSCRIPT_HOOK_QUIET_ADOPT_MS, TRANSCRIPT_TURN_QUIET_MS, TRANSCRIPT_WATCH_BACKOFF_DURATION_MS, TRANSCRIPT_WATCH_BACKOFF_ENTRIES, TRANSCRIPT_WATCH_INTERVAL_MAX_MS, TRANSCRIPT_WATCH_INTERVAL_MS, TRANSCRIPT_WATCH_REVALIDATE_MS, TranscriptWatcher, createTranscriptDiscoverCache, decodeClaudeProjectDirName, defaultTranscriptFs, discoverTranscripts, discoverTranscriptsWithMeta, isTranscriptHookCovered, nextTranscriptWatchIntervalMs, noteHookSessionsFromSpoolFile, resolveTranscriptRegistration, sessionIdFromClaudeTranscriptPath, sessionIdFromCodexTranscriptPath, sortDiscoveries, } from "./transcript-watch.js";
 //# sourceMappingURL=index.js.map

package/dist/lib/mesh/live/daemon/state.d.ts

@@ -5,7 +5,7 @@ import * as fs from "node:fs";
 import type { MqttConnectionState } from "./presence.js";
 import type { FlushSummary } from "../flush.js";
 import type { DroppedPresenceCompany } from "./credentials.js";
-export interface PresenceRefusalState {
+interface PresenceRefusalState {
     code: string;
     status: number;
     nextRetryAt: string;

package/dist/lib/mesh/live/daemon/transcript-watch.d.ts

@@ -51,8 +51,6 @@ export declare const TRANSCRIPT_WATCH_INTERVAL_MAX_MS = 120000;
 export declare const TRANSCRIPT_WATCH_BACKOFF_ENTRIES = 2000;
 /** Double the interval when a tick takes longer than this many ms. */
 export declare const TRANSCRIPT_WATCH_BACKOFF_DURATION_MS = 500;
-/** Hard cap on entries examined (dir stats, readdir children, file stats) per tick. */
-export declare const TRANSCRIPT_WATCH_ENTRY_CAP = 20000;
 /**
  * Even when a directory mtime matches the cache, force a full relist (readdir +
  * re-stat) after this many ms so content appends and coarse mtime granularity
@@ -62,11 +60,6 @@ export declare const TRANSCRIPT_WATCH_REVALIDATE_MS: number;
 export declare const TRANSCRIPT_TURN_QUIET_MS = 5000;
 export declare const TRANSCRIPT_SESSION_END_MS: number;
 export declare const TRANSCRIPT_HOOK_COVER_MS = 60000;
-/** Retry unavailable transcript-start reconciliation without hot-looping. */
-export declare const TRANSCRIPT_START_RETRY_BASE_MS = 30000;
-export declare const TRANSCRIPT_START_RETRY_MAX_MS = 120000;
-/** Ignore cold transcripts whose mtime is older than this on first sight. */
-export declare const TRANSCRIPT_FRESH_MS: number;
 /**
  * Hook-covered sessions skipped as "stale" on first sight never got a quiet
  * session_end (live: skippedHook=411, ended=0). Adopt them for this long after
@@ -75,7 +68,6 @@ export declare const TRANSCRIPT_FRESH_MS: number;
  */
 export declare const TRANSCRIPT_HOOK_QUIET_ADOPT_MS: number;
 export declare const TRANSCRIPT_MARKER: "from transcript";
-export declare const TRANSCRIPT_ADAPTER_VERSION: string;
 /** Network `source` stamped on every synthesized event (AMEND-001). */
 export declare const TRANSCRIPT_EVENT_SOURCE: "transcript";
 /** Fs surface used by the watcher — intentionally no open/readFile. */
@@ -91,7 +83,7 @@ export interface TranscriptFs {
     existsSync: (p: string) => boolean;
 }
 export declare const defaultTranscriptFs: TranscriptFs;
-export type TranscriptKind = "claude" | "codex";
+type TranscriptKind = "claude" | "codex";
 export interface DiscoveredTranscript {
     path: string;
     sessionId: string;
@@ -166,7 +158,7 @@ export interface TranscriptWatchTickResult {
     skippedConcurrent: boolean;
 }
 /** Per-directory mtime + child cache for incremental discovery. */
-export interface TranscriptDirCacheEntry {
+interface TranscriptDirCacheEntry {
     mtimeMs: number;
     files: DiscoveredTranscript[];
     subdirs: string[];
@@ -176,7 +168,7 @@ export interface TranscriptDirCacheEntry {
 export interface TranscriptDiscoverCache {
     dirs: Map<string, TranscriptDirCacheEntry>;
 }
-export interface DiscoverScanMeta {
+interface DiscoverScanMeta {
     entriesExamined: number;
     dirsListed: number;
     dirsSkipped: number;
@@ -318,4 +310,5 @@ export declare function nextTranscriptWatchIntervalMs(currentMs: number, opts: {
     entriesExamined: number;
     durationMs: number;
 }): number;
+export {};
 //# sourceMappingURL=transcript-watch.d.ts.map

package/dist/lib/mesh/live/daemon/transcript-watch.js

@@ -58,7 +58,7 @@ export const TRANSCRIPT_WATCH_BACKOFF_ENTRIES = 2_000;
 /** Double the interval when a tick takes longer than this many ms. */
 export const TRANSCRIPT_WATCH_BACKOFF_DURATION_MS = 500;
 /** Hard cap on entries examined (dir stats, readdir children, file stats) per tick. */
-export const TRANSCRIPT_WATCH_ENTRY_CAP = 20_000;
+const TRANSCRIPT_WATCH_ENTRY_CAP = 20_000;
 /**
  * Even when a directory mtime matches the cache, force a full relist (readdir +
  * re-stat) after this many ms so content appends and coarse mtime granularity
@@ -69,10 +69,10 @@ export const TRANSCRIPT_TURN_QUIET_MS = 5_000;
 export const TRANSCRIPT_SESSION_END_MS = 10 * 60_000;
 export const TRANSCRIPT_HOOK_COVER_MS = 60_000;
 /** Retry unavailable transcript-start reconciliation without hot-looping. */
-export const TRANSCRIPT_START_RETRY_BASE_MS = 30_000;
-export const TRANSCRIPT_START_RETRY_MAX_MS = 120_000;
+const TRANSCRIPT_START_RETRY_BASE_MS = 30_000;
+const TRANSCRIPT_START_RETRY_MAX_MS = 120_000;
 /** Ignore cold transcripts whose mtime is older than this on first sight. */
-export const TRANSCRIPT_FRESH_MS = TRANSCRIPT_SESSION_END_MS;
+const TRANSCRIPT_FRESH_MS = TRANSCRIPT_SESSION_END_MS;
 /**
  * Hook-covered sessions skipped as "stale" on first sight never got a quiet
  * session_end (live: skippedHook=411, ended=0). Adopt them for this long after
@@ -81,7 +81,7 @@ export const TRANSCRIPT_FRESH_MS = TRANSCRIPT_SESSION_END_MS;
  */
 export const TRANSCRIPT_HOOK_QUIET_ADOPT_MS = 2 * 60 * 60 * 1000;
 export const TRANSCRIPT_MARKER = "from transcript";
-export const TRANSCRIPT_ADAPTER_VERSION = CLI_VERSION;
+const TRANSCRIPT_ADAPTER_VERSION = CLI_VERSION;
 /** Network `source` stamped on every synthesized event (AMEND-001). */
 export const TRANSCRIPT_EVENT_SOURCE = "transcript";
 export const defaultTranscriptFs = {

package/dist/lib/work-context/company.d.ts

@@ -20,14 +20,12 @@
  */
 import type { TrustedExplicitContext } from "./contract.js";
 import { type SessionStateFile } from "./state.js";
-export type CompanyResolutionSource = "trusted_explicit" | "existing_scope" | "session_meta" | "repo_map" | "device_default" | "deterministic_cwd" | "deterministic_remote";
+type CompanyResolutionSource = "trusted_explicit" | "existing_scope" | "session_meta" | "repo_map" | "device_default" | "deterministic_cwd" | "deterministic_remote";
 export interface ResolvedCompany {
     slug?: string;
     uid?: string;
     source: CompanyResolutionSource;
 }
-/** Pointer to the US-017B correction client (never auto-switches). */
-export declare const COMPANY_CORRECTION_PATH_PREFIX = "hq mesh context correct --session";
 export declare function companyCorrectionPath(sessionId: string): string;
 export type CompanyResolution = {
     status: "resolved";
@@ -72,18 +70,6 @@ export interface CompanyResolveInput {
 /** Env naming the on-box identity.json (fleet agent boxes). */
 export declare const HQ_AGENT_IDENTITY_FILE_ENV = "HQ_AGENT_IDENTITY_FILE";
 export declare const DEFAULT_AGENT_IDENTITY_FILE = "/var/lib/hq-agent/identity.json";
-/**
- * Read `companyUid` from the agent identity file when
- * `HQ_AGENT_IDENTITY_FILE` is set, or the conventional fleet path otherwise.
- * Missing/unreadable/malformed → undefined
- * (never throws; never logs file contents).
- */
-export interface AgentIdentityCompany {
-    uid?: string;
-    slug?: string;
-}
-/** Company uid and slug from the fleet identity file. Missing file → undefined. */
-export declare function readAgentIdentityCompany(env?: NodeJS.ProcessEnv): AgentIdentityCompany | undefined;
 export declare function readAgentIdentityCompanyUid(env?: NodeJS.ProcessEnv): string | undefined;
 /**
  * Company named for a machine session.
@@ -126,15 +112,6 @@ export declare function projectIdFromCwd(cwd: string | undefined, hqRoot?: strin
  * Read company_slug from workspace/sessions/<sid>/meta.yaml (best-effort, no yaml dep).
  */
 export declare function readMetaCompanySlug(sessionId: string, hqRoot: string | undefined): string | undefined;
-/**
- * Deterministic mapping: exactly one of cwd companies/{slug} or remote owner.
- * Multiple distinct signals that disagree → no deterministic mapping (needs_company
- * unless a higher-precedence source exists). Matching signals collapse to one.
- */
-export declare function resolveDeterministicCompany(input: {
-    cwd?: string;
-    hqRoot?: string;
-    remoteOwnerSlug?: string | null;
-}): ResolvedCompany | null;
 export declare function resolveCompany(input: CompanyResolveInput): CompanyResolution;
+export {};
 //# sourceMappingURL=company.d.ts.map

package/dist/lib/work-context/company.js

@@ -23,7 +23,7 @@ import * as path from "node:path";
 import { getDefaultCompany, getRepoCompany } from "./config.js";
 import { authoritativeCompanyFromState, readSessionState, } from "./state.js";
 /** Pointer to the US-017B correction client (never auto-switches). */
-export const COMPANY_CORRECTION_PATH_PREFIX = "hq mesh context correct --session";
+const COMPANY_CORRECTION_PATH_PREFIX = "hq mesh context correct --session";
 export function companyCorrectionPath(sessionId) {
     return `${COMPANY_CORRECTION_PATH_PREFIX} ${sessionId}`;
 }
@@ -58,7 +58,7 @@ function readAgentIdentityRecord(env) {
     }
 }
 /** Company uid and slug from the fleet identity file. Missing file → undefined. */
-export function readAgentIdentityCompany(env = process.env) {
+function readAgentIdentityCompany(env = process.env) {
     const raw = readAgentIdentityRecord(env);
     if (!raw)
         return undefined;
@@ -209,7 +209,7 @@ export function readMetaCompanySlug(sessionId, hqRoot) {
  * Multiple distinct signals that disagree → no deterministic mapping (needs_company
  * unless a higher-precedence source exists). Matching signals collapse to one.
  */
-export function resolveDeterministicCompany(input) {
+function resolveDeterministicCompany(input) {
     const fromCwd = companySlugFromCwd(input.cwd, input.hqRoot);
     const fromRemote = normalizeSlug(input.remoteOwnerSlug ?? undefined);
     if (fromCwd && fromRemote && fromCwd.toLowerCase() !== fromRemote.toLowerCase()) {

package/dist/lib/work-context/config.d.ts

@@ -4,8 +4,7 @@
  */
 import * as fs from "node:fs";
 import { type WindowsAclCheckOptions } from "./windows-acl.js";
-import { WORK_CONTEXT_CONTRACT_VERSION } from "./contract.js";
-export declare const DEVICE_CONFIG_SCHEMA_VERSION: 1;
+declare const DEVICE_CONFIG_SCHEMA_VERSION: 1;
 export interface DeviceDefaultCompany {
     slug: string;
     uid?: string;
@@ -44,7 +43,7 @@ export interface RepoCompanyMapping {
     uid?: string;
     updatedAt: string;
 }
-export type RepoCompanyMap = Record<string, RepoCompanyMapping>;
+type RepoCompanyMap = Record<string, RepoCompanyMapping>;
 export interface WorkContextDeviceConfig {
     schemaVersion: typeof DEVICE_CONFIG_SCHEMA_VERSION;
     /** Explicit device default. Never copied from activeCompany. */
@@ -77,7 +76,6 @@ export interface DeviceConfigDeps {
     validateMembership?: (slug: string) => Promise<MembershipValidationResult> | MembershipValidationResult;
     now?: () => Date;
 }
-export declare const CONFIG_LOCK_STALE_MS = 30000;
 /** Acquire an interprocess config lock; exported for direct lock regression tests. */
 export declare function acquireDeviceConfigLock(root: string, options?: {
     timeoutMs?: number;
@@ -132,8 +130,5 @@ export declare function setAutoDefaultCompany(membership: DefaultCompanyMembersh
     afterCompareAndSwap?: () => void;
 }): WorkContextDeviceConfig;
 export declare function setRepairHeldWithDefault(enabled: boolean, deps: Pick<DeviceConfigDeps, "root" | "now">): WorkContextDeviceConfig;
-/** Convenience: build deps from HOME / injectable root. */
-export declare function deviceConfigDepsFromHome(home?: string, extras?: Partial<DeviceConfigDeps>): DeviceConfigDeps;
-/** Re-export for callers that stamp contractVersion on related state. */
-export { WORK_CONTEXT_CONTRACT_VERSION };
+export {};
 //# sourceMappingURL=config.d.ts.map

package/dist/lib/work-context/config.js

@@ -6,13 +6,11 @@ import * as fs from "node:fs";
 import * as path from "node:path";
 import { atomicWriteJson, ensureOwnerDir, resolveRealTarget } from "./atomic.js";
 import { DefaultCompanyUnavailableError, UnsafeConfigPathError, WorkContextError, } from "./errors.js";
-import { workContextConfigPath, workContextRoot } from "./paths.js";
+import { workContextConfigPath } from "./paths.js";
 import { assertWindowsOwnerOnlyAcl } from "./windows-acl.js";
-import { WORK_CONTEXT_CONTRACT_VERSION } from "./contract.js";
-export const DEVICE_CONFIG_SCHEMA_VERSION = 1;
+const DEVICE_CONFIG_SCHEMA_VERSION = 1;
 const CONFIG_LOCK_TIMEOUT_MS = 5_000;
 const CONFIG_LOCK_RETRY_MS = 10;
-export const CONFIG_LOCK_STALE_MS = 30_000;
 function waitForConfigLock(ms) {
     Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
 }
@@ -497,13 +495,4 @@ export function setRepairHeldWithDefault(enabled, deps) {
         return next;
     });
 }
-/** Convenience: build deps from HOME / injectable root. */
-export function deviceConfigDepsFromHome(home, extras = {}) {
-    return {
-        root: extras.root ?? workContextRoot(home),
-        ...extras,
-    };
-}
-/** Re-export for callers that stamp contractVersion on related state. */
-export { WORK_CONTEXT_CONTRACT_VERSION };
 //# sourceMappingURL=config.js.map

package/dist/lib/work-context/state.d.ts

@@ -4,7 +4,7 @@
  */
 import type { ClassificationState } from "./contract.js";
 import { WORK_CONTEXT_CONTRACT_VERSION } from "./contract.js";
-export type DecisionOptionKind = "bind_existing" | "create_project" | "create_task" | "untracked" | "keep_default" | "override_evidence";
+type DecisionOptionKind = "bind_existing" | "create_project" | "create_task" | "untracked" | "keep_default" | "override_evidence";
 export interface SessionDecisionOption {
     optionId: string;
     label?: string;
@@ -27,9 +27,9 @@ export interface SessionDecision {
 /** Local-only origin of the session state writer (never sent on the wire). */
 export type SessionEventSource = "hook" | "transcript";
 /** Local-only harness label when network schema cannot carry it (US-018). */
-export type LocalHarnessLabel = "claude-desktop" | "codex";
+type LocalHarnessLabel = "claude-desktop" | "codex";
 /** Local tracking for an in-flight or completed cross-company migrate (US-017B). */
-export interface SessionMigrationRecord {
+interface SessionMigrationRecord {
     operationId: string;
     digest: string;
     sourceCompanyUid: string;
@@ -133,14 +133,6 @@ export interface AcknowledgedRegisterBinding {
     taskId?: string;
     receiptId: string;
 }
-/** Allowlisted keys that may appear in the durable state projection. */
-export declare const SESSION_STATE_ALLOWLIST: Set<string>;
-/**
- * Serialize a session-state read/modify/write with every state writer. Atomic
- * rename protects readers from torn files, but only this shared lock protects
- * a writer that has to verify the current binding before changing it.
- */
-export declare function withSessionStateLock<T>(sessionId: string, root: string, fn: () => T): T;
 export declare function readSessionState(sessionId: string, root: string): SessionStateFile | null;
 export declare function writeSessionState(state: SessionStateFile, root: string): string;
 /**
@@ -148,8 +140,6 @@ export declare function writeSessionState(state: SessionStateFile, root: string)
  * lock used by ordinary session writers. Returning null declines the write.
  */
 export declare function updateSessionState(sessionId: string, root: string, update: (current: SessionStateFile | null) => SessionStateFile | null): SessionStateFile | null;
-/** Strip any non-allowlisted fields before durable write. */
-export declare function projectSessionState(state: SessionStateFile): SessionStateFile;
 /**
  * Merge prior local fields into a new state write so PostToolUse bumps and
  * reconcile updates do not clobber an acknowledged company binding.
@@ -201,4 +191,5 @@ export declare function authoritativeCompanyFromState(state: SessionStateFile |
  * Carrying it forward makes the server drop every later session-event batch.
  */
 export declare function applyOperatorProjectBinding(state: SessionStateFile, projectId: string, now?: () => Date): SessionStateFile;
+export {};
 //# sourceMappingURL=state.d.ts.map

package/dist/lib/work-context/state.js

@@ -8,34 +8,6 @@ import { WORK_CONTEXT_CONTRACT_VERSION } from "./contract.js";
 import { atomicWriteJson, ensureOwnerDir, resolveRealTarget } from "./atomic.js";
 import { NotTrackingError, UnsafeConfigPathError } from "./errors.js";
 import { isSafeWorkContextSegment, workContextSessionPath, workContextSessionsDir, } from "./paths.js";
-/** Allowlisted keys that may appear in the durable state projection. */
-export const SESSION_STATE_ALLOWLIST = new Set([
-    "contractVersion",
-    "sessionId",
-    "companyUid",
-    "companySlug",
-    "contextStatus",
-    "projectId",
-    "taskId",
-    "bindingEpisodeId",
-    "version",
-    "decision",
-    "migration",
-    "untrackedReceipt",
-    "toolWrites",
-    "startedAt",
-    "hasTurn",
-    "source",
-    "localHarness",
-    "transcriptMarker",
-    "companyConfidence",
-    "projectBindReason",
-    "projectCandidates",
-    "projectGate",
-    "projectHint",
-    "presenceLeave",
-    "updatedAt",
-]);
 const SESSION_STATE_LOCK_TIMEOUT_MS = 5_000;
 const SESSION_STATE_LOCK_RETRY_MS = 10;
 function waitForSessionStateLock(ms) {
@@ -72,7 +44,7 @@ function reclaimStaleSessionStateLock(lockPath) {
  * rename protects readers from torn files, but only this shared lock protects
  * a writer that has to verify the current binding before changing it.
  */
-export function withSessionStateLock(sessionId, root, fn) {
+function withSessionStateLock(sessionId, root, fn) {
     if (!isSafeWorkContextSegment(sessionId)) {
         throw new NotTrackingError(`Unsafe session id for state file: ${sessionId}`, "NOT_TRACKING");
     }
@@ -192,7 +164,7 @@ export function updateSessionState(sessionId, root, update) {
     });
 }
 /** Strip any non-allowlisted fields before durable write. */
-export function projectSessionState(state) {
+function projectSessionState(state) {
     const out = {
         contractVersion: WORK_CONTEXT_CONTRACT_VERSION,
         sessionId: state.sessionId,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.309.1",
+  "version": "5.311.0",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {