@indigoai-us/hq-cli 5.312.2-beta.0 → 5.314.0

package/dist/lib/mesh/live/daemon/board-refresh.js

@@ -1,16 +1,12 @@
 /**
  * Refresh ~/.hq/work-context/sessions/<sid>/board.md for bound sessions
- * from the ProjectView read route at most every 60s.
- *
- * Board JSON remains the fallback for older projects, but story status is
- * authoritative in ProjectView because `hq mesh story` writes there.
+ * from GET /companies/{companyUid}/board at most every 60s.
  * Metadata-only snapshot — never prompts or tokens.
  */
 import * as fs from "node:fs";
 import * as path from "node:path";
 import { workContextSessionsDir } from "../../../work-context/paths.js";
 import { readSessionState } from "../../../work-context/state.js";
-import { mapReaderStoryStatus } from "../../story-status.js";
 import { sessionBoardPath } from "./paths.js";
 export const BOARD_REFRESH_INTERVAL_MS = 60_000;
 function listBoundSessionIds(workContextRoot) {
@@ -93,12 +89,6 @@ export async function refreshBoundSessionBoards(deps) {
             skipped += 1;
             continue;
         }
-        if (state.companyConfidence === "device_default" &&
-            deps.authorizeDeviceDefaultTenant &&
-            !(await deps.authorizeDeviceDefaultTenant(sessionId, state))) {
-            skipped += 1;
-            continue;
-        }
         try {
             const board = await deps.readBoard(state.companyUid, state.projectId);
             if (!board) {
@@ -125,72 +115,9 @@ export async function refreshBoundSessionBoards(deps) {
     }
     return { refreshed, skipped, errors };
 }
-function storiesFromProject(project) {
-    const storiesRaw = Array.isArray(project.stories) ? project.stories : [];
-    const stories = [];
-    for (const s of storiesRaw) {
-        if (!s || typeof s !== "object" || Array.isArray(s))
-            continue;
-        const row = s;
-        const id = typeof row.id === "string"
-            ? row.id
-            : typeof row.storyId === "string"
-                ? row.storyId
-                : typeof row.taskId === "string"
-                    ? row.taskId
-                    : "";
-        if (!id)
-            continue;
-        stories.push({
-            id,
-            title: typeof row.title === "string"
-                ? row.title.slice(0, 120)
-                : typeof row.name === "string"
-                    ? row.name.slice(0, 120)
-                    : undefined,
-            status: mapReaderStoryStatus(row),
-        });
-    }
-    return stories;
-}
-function projectViewSnapshot(raw, companyUid, projectId) {
-    if (!raw || typeof raw !== "object" || Array.isArray(raw))
-        return null;
-    const project = raw;
-    if (project.companyUid !== companyUid || project.projectId !== projectId)
-        return null;
-    return {
-        projectId,
-        projectName: typeof project.name === "string"
-            ? project.name
-            : typeof project.title === "string"
-                ? project.title
-                : undefined,
-        stories: storiesFromProject(project),
-    };
-}
-function isMissingProject(error) {
-    // hq-pro's GET ProjectView handler emits PROJECT_VIEW_NOT_FOUND; retain the
-    // legacy PROJECT_NOT_FOUND code for compatibility with older producers.
-    return (error instanceof Error &&
-        /^404\s+(?:PROJECT_VIEW_NOT_FOUND|PROJECT_NOT_FOUND)\b/.test(error.message));
-}
 /** Build a BoardReader from meshJson-compatible fetch. */
 export function createVaultBoardReader(opts) {
     return async (companyUid, projectId) => {
-        // ProjectView is the live story-status source. Only use board.json when
-        // this project has not been migrated into ProjectView yet.
-        try {
-            const view = await opts.getJson(`/v1/work-mesh/projects/${encodeURIComponent(projectId)}?companyUid=${encodeURIComponent(companyUid)}`);
-            const snapshot = projectViewSnapshot(view, companyUid, projectId);
-            if (snapshot)
-                return snapshot;
-            throw new Error("ProjectView response did not match the requested company and project");
-        }
-        catch (error) {
-            if (!isMissingProject(error))
-                throw error;
-        }
         const raw = await opts.getJson(`/companies/${encodeURIComponent(companyUid)}/board`);
         if (!raw || typeof raw !== "object")
             return null;
@@ -213,10 +140,35 @@ export function createVaultBoardReader(opts) {
             const id = typeof p.id === "string" ? p.id : typeof p.projectId === "string" ? p.projectId : "";
             if (id !== projectId)
                 continue;
-            const stories = storiesFromProject({
-                ...p,
-                stories: Array.isArray(p.stories) ? p.stories : p.tasks,
-            });
+            const storiesRaw = Array.isArray(p.stories)
+                ? p.stories
+                : Array.isArray(p.tasks)
+                    ? p.tasks
+                    : [];
+            const stories = [];
+            for (const s of storiesRaw) {
+                if (!s || typeof s !== "object" || Array.isArray(s))
+                    continue;
+                const row = s;
+                const sid = typeof row.id === "string"
+                    ? row.id
+                    : typeof row.storyId === "string"
+                        ? row.storyId
+                        : typeof row.taskId === "string"
+                            ? row.taskId
+                            : "";
+                if (!sid)
+                    continue;
+                stories.push({
+                    id: sid,
+                    title: typeof row.title === "string"
+                        ? row.title.slice(0, 120)
+                        : typeof row.name === "string"
+                            ? row.name.slice(0, 120)
+                            : undefined,
+                    status: typeof row.status === "string" ? row.status : undefined,
+                });
+            }
             return {
                 projectId,
                 projectName: typeof p.name === "string"

package/dist/lib/mesh/live/daemon/credentials.d.ts

@@ -3,7 +3,14 @@
  * Never logs or persists credential material.
  */
 import type { IotCredentials } from "./presign.js";
+export declare const REALTIME_CREDENTIALS_PATH = "/v1/realtime/credentials";
 export declare const MQTT_KEEPALIVE_SECONDS = 15;
+/** Renew at 80% of credential lifetime. */
+export declare const CREDENTIAL_RENEWAL_FRACTION = 0.8;
+export declare const MIN_RENEWAL_DELAY_MS = 5000;
+/** Long retry when the server refuses credentials (disabled / unsupported). */
+export declare const DEFAULT_REFUSED_RETRY_MS: number;
+export declare const REFUSED_RETRY_ENV = "HQ_MESH_DAEMON_REFUSED_RETRY_MS";
 /**
  * Node's setTimeout treats delays above this as ~1ms (signed 32-bit overflow).
  * Always schedule long waits via {@link scheduleBoundedTimeout}.
@@ -11,8 +18,6 @@ export declare const MQTT_KEEPALIVE_SECONDS = 15;
 export declare const MAX_TIMER_DELAY_MS = 2147483647;
 /** Cap any single retry so a bogus Retry-After cannot park the daemon. */
 export declare const MAX_RETRY_DELAY_MS: number;
-/** Preferred-set changes re-vend at most this often. */
-export declare const PREFERRED_REVEND_MIN_MS = 60000;
 export type CredentialVendFailureKind = "refused" | "transient";
 /**
  * Typed vend failure. `refused` = server will not vend right now
@@ -33,23 +38,17 @@ export declare class CredentialVendError extends Error {
     });
 }
 export declare function parseRetryAfterMs(value: string | null | undefined, nowMs?: number): number | undefined;
+export declare function extractVendErrorCode(body: unknown): string | undefined;
 /** True for server "not now" responses that should use the long retry. */
 export declare function isCredentialVendRefused(status: number, code: string | undefined): boolean;
 export declare function classifyCredentialVendFailure(status: number, body: unknown, retryAfterHeader?: string | null, nowMs?: number): CredentialVendError;
 export declare function defaultRefusedRetryMs(env?: NodeJS.ProcessEnv): number;
 /** ±20% jitter around the refused-retry base interval. */
 export declare function refusedRetryDelayMs(baseMs: number, random: () => number): number;
-interface PresenceCompany {
+export interface PresenceCompany {
     companyUid: string;
     presenceTopic: string;
 }
-export interface DroppedPresenceCompany {
-    companyUid: string;
-    /** Short name for doctor text when the server sent one. */
-    label?: string;
-    /** Server-supplied cause when available; otherwise a deliberately neutral label. */
-    reason: string;
-}
 export interface Contract3Bundle {
     contractVersion: 3;
     credentials: IotCredentials;
@@ -59,7 +58,7 @@ export interface Contract3Bundle {
     actorUid: string;
     actorType: "human" | "agent";
     companies: PresenceCompany[];
-    droppedCompanies: DroppedPresenceCompany[];
+    droppedCompanies: string[];
     expiresAt: string;
 }
 export type CredentialsFetcher = () => Promise<Contract3Bundle>;
@@ -94,26 +93,6 @@ export declare function normalizeContract3Bundle(raw: unknown): Contract3Bundle;
  * No identity file → return the bundle unchanged (person laptop).
  */
 export declare function scopeBundleToAgentIdentity(bundle: Contract3Bundle, env?: NodeJS.ProcessEnv): Contract3Bundle;
-/**
- * Device default first, then distinct company uids from session files updated
- * in the last 24 hours, newest first, max 5. Any read error returns undefined
- * so the vend body omits the field.
- */
-export declare function readPreferredCompanyUids(input: {
-    workContextRoot: string;
-    nowMs?: number;
-}): string[] | undefined;
-export declare function preferredCompanyKey(uids: readonly string[] | undefined): string;
-/** True when a new preferred set should force a vend, at most once per minute. */
-export declare function shouldRevendPreferredCompanies(input: {
-    previous: readonly string[] | undefined;
-    next: readonly string[] | undefined;
-    lastVendMs: number;
-    nowMs: number;
-    minIntervalMs?: number;
-}): boolean;
-/** Plain doctor line for one company the vend left out. */
-export declare function formatDroppedPresenceCompany(company: DroppedPresenceCompany): string;
 export type CredentialVendPostResult = {
     status: number;
     body: unknown;
@@ -126,8 +105,6 @@ export declare function createContract3Fetcher(opts: {
     post?: (path: string, body: unknown) => Promise<CredentialVendPostResult>;
     /** Process env for identity-file scoping (tests). */
     env?: NodeJS.ProcessEnv;
-    /** Companies to ask for. Undefined (read error) omits the field. */
-    readPreferredCompanyUids?: () => string[] | undefined;
 }): CredentialsFetcher;
 export interface CredentialRenewalErrorInfo {
     /** Absolute ISO timestamp when the renewal retry is scheduled to fire. */
@@ -148,41 +125,10 @@ export declare class CredentialRenewalManager {
     private readonly random;
     private handle;
     private stopped;
-    private inflight;
     constructor(fetchCredentials: CredentialsFetcher, onRenewed: (bundle: Contract3Bundle) => void, onError?: (err: unknown, info?: CredentialRenewalErrorInfo) => void, timers?: TimerHost, retryDelayMs?: number, refusedRetryMs?: number, random?: () => number);
     schedule(bundle: Contract3Bundle): void;
-    /** Vend now (preferred companies changed). No-op while a vend is in flight. */
-    renewNow(): void;
     private renew;
     stop(): void;
     private clear;
 }
-/**
- * Contract-2 (personal) realtime vend. Backed server-side by the personal
- * session policy, which grants Subscribe/Receive on the caller's own
- * `hq/{principalUid}/{dm,sessions,work,notifications,meeting,sync}` topics —
- * unlike contract 3, whose policy only covers company presence and the thread
- * directory. Doorbell listeners on personal topics MUST use this contract;
- * subscribing to personal topics with a contract-3 session makes AWS IoT drop
- * the connection before SUBACK.
- */
-export interface PersonalRealtimeBundle {
-    contractVersion: 2;
-    credentials: IotCredentials;
-    iotEndpoint: string;
-    region: string;
-    clientId: string;
-    actorUid: string;
-    /** Advertised personal topics keyed by kind (dm, sessions, work, notifications, …). */
-    topics: Record<string, string>;
-    expiresAt: string;
-}
-export type PersonalCredentialsFetcher = () => Promise<PersonalRealtimeBundle>;
-export declare function normalizePersonalRealtimeBundle(raw: unknown): PersonalRealtimeBundle;
-export declare function createPersonalRealtimeFetcher(opts: {
-    token: string;
-    baseUrl?: string;
-    post?: (path: string, body: unknown) => Promise<CredentialVendPostResult>;
-}): PersonalCredentialsFetcher;
-export {};
 //# sourceMappingURL=credentials.d.ts.map

package/dist/lib/mesh/live/daemon/credentials.js

@@ -2,21 +2,17 @@
  * Contract-3 realtime credential vend + 80%-of-lifetime renewal.
  * Never logs or persists credential material.
  */
-import * as fs from "node:fs";
-import * as path from "node:path";
 import { DEFAULT_VAULT_API_URL } from "../../../../utils/cognito-session.js";
 import { vaultApiFetch } from "../../../../utils/vault-api.js";
 import { readAgentIdentityCompanyUid } from "../../../work-context/company.js";
-import { readDeviceConfig } from "../../../work-context/config.js";
-import { workContextSessionsDir } from "../../../work-context/paths.js";
-const REALTIME_CREDENTIALS_PATH = "/v1/realtime/credentials";
+export const REALTIME_CREDENTIALS_PATH = "/v1/realtime/credentials";
 export const MQTT_KEEPALIVE_SECONDS = 15;
 /** Renew at 80% of credential lifetime. */
-const CREDENTIAL_RENEWAL_FRACTION = 0.8;
-const MIN_RENEWAL_DELAY_MS = 5_000;
+export const CREDENTIAL_RENEWAL_FRACTION = 0.8;
+export const MIN_RENEWAL_DELAY_MS = 5_000;
 /** Long retry when the server refuses credentials (disabled / unsupported). */
-const DEFAULT_REFUSED_RETRY_MS = 10 * 60_000;
-const REFUSED_RETRY_ENV = "HQ_MESH_DAEMON_REFUSED_RETRY_MS";
+export const DEFAULT_REFUSED_RETRY_MS = 10 * 60_000;
+export const REFUSED_RETRY_ENV = "HQ_MESH_DAEMON_REFUSED_RETRY_MS";
 /**
  * Node's setTimeout treats delays above this as ~1ms (signed 32-bit overflow).
  * Always schedule long waits via {@link scheduleBoundedTimeout}.
@@ -24,12 +20,6 @@ const REFUSED_RETRY_ENV = "HQ_MESH_DAEMON_REFUSED_RETRY_MS";
 export const MAX_TIMER_DELAY_MS = 2_147_483_647;
 /** Cap any single retry so a bogus Retry-After cannot park the daemon. */
 export const MAX_RETRY_DELAY_MS = 24 * 60 * 60 * 1000;
-/** Contract-3 vend accepts at most this many preferred company uids. */
-const PREFERRED_COMPANY_LIMIT = 5;
-/** Session files older than this do not count as companies in use. */
-const PREFERRED_SESSION_WINDOW_MS = 24 * 60 * 60 * 1000;
-/** Preferred-set changes re-vend at most this often. */
-export const PREFERRED_REVEND_MIN_MS = 60_000;
 /**
  * Typed vend failure. `refused` = server will not vend right now
  * (FEATURE_DISABLED / REALTIME_CONTRACT_UNSUPPORTED / 403); daemon should
@@ -66,7 +56,7 @@ export function parseRetryAfterMs(value, nowMs = Date.now()) {
     }
     return undefined;
 }
-function extractVendErrorCode(body) {
+export function extractVendErrorCode(body) {
     if (!body || typeof body !== "object" || Array.isArray(body))
         return undefined;
     const code = body.code;
@@ -239,31 +229,9 @@ export function normalizeContract3Bundle(raw) {
     if (!expiresAt) {
         throw new Error("contract-3 vend missing expiresAt");
     }
-    const droppedCompanies = [];
-    for (const item of Array.isArray(r.droppedCompanies) ? r.droppedCompanies : []) {
-        if (typeof item === "string" && item.trim()) {
-            droppedCompanies.push({ companyUid: item, reason: "unknown" });
-            continue;
-        }
-        if (!item || typeof item !== "object" || Array.isArray(item))
-            continue;
-        const row = item;
-        const companyUid = typeof row.companyUid === "string" ? row.companyUid.trim() : "";
-        if (!companyUid)
-            continue;
-        const slug = typeof row.companySlug === "string"
-            ? row.companySlug.trim()
-            : typeof row.slug === "string"
-                ? row.slug.trim()
-                : "";
-        droppedCompanies.push({
-            companyUid,
-            ...(slug ? { label: slug } : {}),
-            reason: typeof row.reason === "string" && row.reason.trim()
-                ? row.reason.trim()
-                : "not included",
-        });
-    }
+    const dropped = Array.isArray(r.droppedCompanies)
+        ? r.droppedCompanies.filter((x) => typeof x === "string")
+        : [];
     return {
         contractVersion: 3,
         credentials: {
@@ -278,7 +246,7 @@ export function normalizeContract3Bundle(raw) {
         actorUid,
         actorType,
         companies,
-        droppedCompanies,
+        droppedCompanies: dropped,
         expiresAt,
     };
 }
@@ -298,101 +266,6 @@ export function scopeBundleToAgentIdentity(bundle, env = process.env) {
     }
     return { ...bundle, companies: matched };
 }
-function pushDistinct(out, seen, uid) {
-    const trimmed = uid?.trim();
-    if (!trimmed || seen.has(trimmed) || out.length >= PREFERRED_COMPANY_LIMIT)
-        return;
-    seen.add(trimmed);
-    out.push(trimmed);
-}
-/**
- * Device default first, then distinct company uids from session files updated
- * in the last 24 hours, newest first, max 5. Any read error returns undefined
- * so the vend body omits the field.
- */
-export function readPreferredCompanyUids(input) {
-    try {
-        const nowMs = input.nowMs ?? Date.now();
-        const config = readDeviceConfig({ root: input.workContextRoot });
-        const out = [];
-        const seen = new Set();
-        if (config.defaultCompany?.enabled && config.defaultCompany.uid) {
-            pushDistinct(out, seen, config.defaultCompany.uid);
-        }
-        const dir = workContextSessionsDir(input.workContextRoot);
-        let names = [];
-        try {
-            names = fs.readdirSync(dir);
-        }
-        catch (err) {
-            const code = err.code;
-            if (code !== "ENOENT")
-                throw err;
-        }
-        const recent = [];
-        for (const name of names) {
-            if (!name.endsWith(".json"))
-                continue;
-            const full = path.join(dir, name);
-            const stat = fs.statSync(full);
-            if (!stat.isFile())
-                continue;
-            const raw = JSON.parse(fs.readFileSync(full, "utf8"));
-            const parsedAt = typeof raw.updatedAt === "string" ? Date.parse(raw.updatedAt) : Number.NaN;
-            const at = Number.isFinite(parsedAt) ? parsedAt : stat.mtimeMs;
-            if (!Number.isFinite(at) || nowMs - at > PREFERRED_SESSION_WINDOW_MS)
-                continue;
-            if (nowMs < at)
-                continue;
-            if (typeof raw.companyUid !== "string")
-                continue;
-            recent.push({ uid: raw.companyUid, at });
-        }
-        recent.sort((a, b) => b.at - a.at || a.uid.localeCompare(b.uid));
-        for (const row of recent)
-            pushDistinct(out, seen, row.uid);
-        return out;
-    }
-    catch {
-        return undefined;
-    }
-}
-export function preferredCompanyKey(uids) {
-    return (uids ?? []).join("\n");
-}
-/** True when a new preferred set should force a vend, at most once per minute. */
-export function shouldRevendPreferredCompanies(input) {
-    if (!input.next)
-        return false;
-    if (preferredCompanyKey(input.previous) === preferredCompanyKey(input.next)) {
-        return false;
-    }
-    const min = input.minIntervalMs ?? PREFERRED_REVEND_MIN_MS;
-    return input.nowMs - input.lastVendMs >= min;
-}
-function contract3VendBody(preferredCompanyUids) {
-    const body = {
-        contractVersion: 3,
-    };
-    if (preferredCompanyUids && preferredCompanyUids.length > 0) {
-        body.preferredCompanyUids = preferredCompanyUids.slice(0, PREFERRED_COMPANY_LIMIT);
-    }
-    return body;
-}
-/** Plain doctor line for one company the vend left out. */
-export function formatDroppedPresenceCompany(company) {
-    const name = company.label?.trim() || company.companyUid;
-    if (company.reason === "gate_disabled") {
-        return `${name}: not included (presence is turned off for this company)`;
-    }
-    if (company.reason === "policy_budget") {
-        return `${name}: not included (too many companies for one credential)`;
-    }
-    if (!company.reason || company.reason === "unknown" || company.reason === "not included") {
-        return `${name}: not included`;
-    }
-    return `${name}: not included (${company.reason})`;
-}
 function headerGet(headers, name) {
     if (!headers)
         return null;
@@ -405,19 +278,11 @@ function headerGet(headers, name) {
 }
 export function createContract3Fetcher(opts) {
     return async () => {
-        let preferred;
-        if (opts.readPreferredCompanyUids) {
-            try {
-                preferred = opts.readPreferredCompanyUids();
-            }
-            catch {
-                preferred = undefined;
-            }
-        }
-        const body = contract3VendBody(preferred);
         let bundle;
         if (opts.post) {
-            const res = await opts.post(REALTIME_CREDENTIALS_PATH, body);
+            const res = await opts.post(REALTIME_CREDENTIALS_PATH, {
+                contractVersion: 3,
+            });
             if (res.status < 200 || res.status >= 300) {
                 throw classifyCredentialVendFailure(res.status, res.body, headerGet(res.headers, "Retry-After"));
             }
@@ -428,23 +293,23 @@ export function createContract3Fetcher(opts) {
                 token: opts.token,
                 path: REALTIME_CREDENTIALS_PATH,
                 method: "POST",
-                body,
+                body: { contractVersion: 3 },
                 baseUrl: opts.baseUrl ?? DEFAULT_VAULT_API_URL,
             });
             const text = await res.text();
-            let parsed = {};
+            let body = {};
             if (text) {
                 try {
-                    parsed = JSON.parse(text);
+                    body = JSON.parse(text);
                 }
                 catch {
-                    parsed = { raw: text.slice(0, 200) };
+                    body = { raw: text.slice(0, 200) };
                 }
             }
             if (!res.ok) {
-                throw classifyCredentialVendFailure(res.status, parsed, res.headers.get("Retry-After"));
+                throw classifyCredentialVendFailure(res.status, body, res.headers.get("Retry-After"));
             }
-            bundle = normalizeContract3Bundle(parsed);
+            bundle = normalizeContract3Bundle(body);
         }
         return scopeBundleToAgentIdentity(bundle, opts.env ?? process.env);
     };
@@ -463,7 +328,6 @@ export class CredentialRenewalManager {
     random;
     handle = null;
     stopped = false;
-    inflight = false;
     constructor(fetchCredentials, onRenewed, onError = () => { }, timers = realTimerHost, retryDelayMs = 30_000, refusedRetryMs = DEFAULT_REFUSED_RETRY_MS, random = Math.random) {
         this.fetchCredentials = fetchCredentials;
         this.onRenewed = onRenewed;
@@ -480,17 +344,9 @@ export class CredentialRenewalManager {
         const delay = renewalDelayMs(this.timers.now(), bundle.expiresAt);
         this.handle = scheduleBoundedTimeout(this.timers, () => void this.renew(), delay);
     }
-    /** Vend now (preferred companies changed). No-op while a vend is in flight. */
-    renewNow() {
-        if (this.stopped || this.inflight)
-            return;
-        this.clear();
-        void this.renew();
-    }
     async renew() {
-        if (this.stopped || this.inflight)
+        if (this.stopped)
             return;
-        this.inflight = true;
         try {
             const bundle = await this.fetchCredentials();
             if (this.stopped)
@@ -517,9 +373,6 @@ export class CredentialRenewalManager {
                 return;
             this.handle = scheduleBoundedTimeout(this.timers, () => void this.renew(), delay);
         }
-        finally {
-            this.inflight = false;
-        }
     }
     stop() {
         this.stopped = true;
@@ -532,107 +385,4 @@ export class CredentialRenewalManager {
         }
     }
 }
-export function normalizePersonalRealtimeBundle(raw) {
-    if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
-        throw new Error("contract-2 vend response is not an object");
-    }
-    const r = raw;
-    if (r.contractVersion !== 2) {
-        throw new Error(`expected contractVersion 2, got ${String(r.contractVersion)}`);
-    }
-    const creds = r.credentials;
-    if (!creds ||
-        typeof creds.accessKeyId !== "string" ||
-        typeof creds.secretAccessKey !== "string" ||
-        typeof creds.sessionToken !== "string") {
-        throw new Error("contract-2 vend missing credentials");
-    }
-    for (const key of ["clientId", "iotEndpoint", "region"]) {
-        if (typeof r[key] !== "string" || !r[key].trim()) {
-            throw new Error(`contract-2 vend missing ${key}`);
-        }
-    }
-    const topicsRaw = r.topics && typeof r.topics === "object" && !Array.isArray(r.topics)
-        ? r.topics
-        : {};
-    const topics = {};
-    for (const [k, v] of Object.entries(topicsRaw)) {
-        if (typeof v === "string" && v.trim())
-            topics[k] = v.trim();
-    }
-    if (!topics.dm && typeof r.topic === "string")
-        topics.dm = r.topic;
-    const agentInboxTopic = typeof r.agentInboxTopic === "string" ? r.agentInboxTopic.trim() : "";
-    const actorUid = (typeof r.principalUid === "string" && /^(?:prs|agt)_[A-Za-z0-9]+$/.test(r.principalUid)
-        ? r.principalUid
-        : undefined) ||
-        actorUidFromPersonalTopic(topics.dm) ||
-        actorUidFromPersonalTopic(agentInboxTopic) ||
-        "";
-    if (!actorUid)
-        throw new Error("contract-2 vend could not derive actorUid");
-    // hq-pro advertises the agent's own inbox topic as a top-level capability.
-    // Keep it only for the exact actor-owned topic; it reuses this personal MQTT
-    // session and never grants the subscriber a topic supplied by another actor.
-    if (actorUid.startsWith("agt_") && agentInboxTopic === `hq/${actorUid}/inbox`) {
-        topics.inbox = agentInboxTopic;
-    }
-    // Only keep topics that belong to the vended principal.
-    for (const [k, v] of Object.entries(topics)) {
-        if (actorUidFromPersonalTopic(v) !== actorUid)
-            delete topics[k];
-    }
-    const expiresAt = (typeof r.expiresAt === "string" && r.expiresAt) ||
-        (typeof creds.expiration === "string" && creds.expiration) ||
-        "";
-    if (!expiresAt)
-        throw new Error("contract-2 vend missing expiresAt");
-    return {
-        contractVersion: 2,
-        credentials: {
-            accessKeyId: creds.accessKeyId,
-            secretAccessKey: creds.secretAccessKey,
-            sessionToken: creds.sessionToken,
-            expiration: expiresAt,
-        },
-        iotEndpoint: r.iotEndpoint,
-        region: r.region,
-        clientId: r.clientId,
-        actorUid,
-        topics,
-        expiresAt,
-    };
-}
-export function createPersonalRealtimeFetcher(opts) {
-    return async () => {
-        if (opts.post) {
-            const res = await opts.post(REALTIME_CREDENTIALS_PATH, { contractVersion: 2 });
-            if (res.status < 200 || res.status >= 300) {
-                throw classifyCredentialVendFailure(res.status, res.body, headerGet(res.headers, "Retry-After"));
-            }
-            return normalizePersonalRealtimeBundle(res.body);
-        }
-        const res = await vaultApiFetch({
-            token: opts.token,
-            path: REALTIME_CREDENTIALS_PATH,
-            method: "POST",
-            body: { contractVersion: 2 },
-            baseUrl: opts.baseUrl ?? DEFAULT_VAULT_API_URL,
-        });
-        const text = await res.text();
-        let body = {};
-        if (text) {
-            try {
-                body = JSON.parse(text);
-            }
-            catch {
-                body = { raw: text.slice(0, 200) };
-            }
-        }
-        if (!res.ok) {
-            throw classifyCredentialVendFailure(res.status, body, res.headers.get("Retry-After"));
-        }
-        return normalizePersonalRealtimeBundle(body);
-    };
-}
 //# sourceMappingURL=credentials.js.map