@indigoai-us/hq-cli 5.314.0 → 5.315.0

package/dist/lib/mesh/api.d.ts

@@ -16,17 +16,71 @@ export interface MeshThread {
     projectId?: string;
     companyUid?: string;
     threadStatus?: string;
+    kind?: "project" | "work-session" | "lane" | string;
+    lane?: MeshLaneDescriptor;
+    laneStatus?: MeshLaneStatus;
+    projectChannelId?: string;
     ownerUid?: string;
+    ownerType?: "human" | "agent";
+    senderMachineUid?: string;
+    senderPrincipalType?: "agent" | "outpost";
+    senderAuthenticatedSub?: string;
     progressSummary?: string;
     sourceSignalSummary?: string;
     blockedReason?: string;
     lastActivityAt?: string;
     createdAt?: string;
 }
+export type MeshLaneStatus = "queued" | "running" | "awaiting_input" | "blocked" | "done" | "failed" | "interrupted" | "cancelled" | "killed";
+export interface MeshLaneDescriptor {
+    laneId: string;
+    storyId?: string;
+    workerProfile?: string;
+    model?: string;
+    account?: string;
+    parentLaneId?: string;
+    senior?: {
+        kind: "user" | "session" | "lane";
+        id?: string;
+    };
+    laneVersion: number;
+}
+export interface MeshProjectStoryInput {
+    id: string;
+    title: string;
+    description?: string;
+    acceptanceCriteria?: string[];
+    status?: string;
+    passes?: boolean;
+    priority?: number;
+    assigneeUid?: string;
+}
+export interface MeshProjectRepo {
+    path: string;
+    branch: string;
+}
+export interface MeshProjectView {
+    companyUid: string;
+    projectId: string;
+    name: string;
+    description: string;
+    stories: MeshProjectStoryInput[];
+    repos: MeshProjectRepo[];
+    version?: number;
+}
+export interface MeshProjectRegistration {
+    companyUid: string;
+    projectId: string;
+    threadId: string;
+    channelId: string;
+    channelCreated: boolean;
+}
 export declare function meshJson(token: string, path: string, init?: {
     method?: string;
     body?: Record<string, unknown>;
     query?: Record<string, string>;
+    headers?: Record<string, string>;
+    signal?: AbortSignal;
 }): Promise<unknown>;
 export declare function resolveMeshCompany(token: string, company?: string): Promise<MeshCompany>;
 /**
@@ -40,14 +94,21 @@ export declare function listActiveMembershipCompanies(token: string): Promise<Me
  *
  * Lists the caller's active companies via GET /membership/me and matches the
  * requested slug (case-insensitive). Does **not** honour HQ_COMPANY_UID /
- * HQ_WORK_MESH_COMPANY_UID env overrides or treat a raw `cmp_`/`co_` ref as
- * proof of membership without an active membership row.
+ * HQ_WORK_MESH_COMPANY_UID env overrides or treat a raw `cmp_` ref as proof
+ * of membership without an active membership row.
  *
  * Returns null when the caller is not an active member. Throws on transport /
  * auth failures so the caller can surface DEFAULT_COMPANY_UNAVAILABLE.
  */
-export declare function resolveActiveMembershipCompany(token: string, slug: string): Promise<MeshCompany | null>;
-export declare function requireToken(): Promise<string>;
+export declare function resolveActiveMembershipCompany(token: string, slug: string, signal?: AbortSignal): Promise<MeshCompany | null>;
+export interface RequireTokenOptions {
+    /**
+     * False from detached or unattended callers (the lane watcher). A person
+     * cache that cannot refresh then throws instead of opening a browser.
+     */
+    interactive?: boolean;
+}
+export declare function requireToken(opts?: RequireTokenOptions): Promise<string>;
 export declare function listActiveThreads(token: string, companyUid: string, projectId?: string): Promise<MeshThread[]>;
 export declare function clamp(value: string, max: number): string;
 export declare function eventPayload(kind: string, opts: {
@@ -62,15 +123,48 @@ export declare function ensureProjectThread(token: string, company: MeshCompany,
     threadId: string;
     created: boolean;
 }>;
-export declare function appendThreadEvent(token: string, companyUid: string, threadId: string, eventKind: string, payload: Record<string, unknown>): Promise<{
+/** Ensure the server-owned, stable Work Mesh thread for one lane. */
+export declare function ensureLaneMeshThread(token: string, company: MeshCompany, projectId: string, lane: MeshLaneDescriptor, laneStatus: MeshLaneStatus, signal?: AbortSignal): Promise<{
+    threadId: string;
+}>;
+export declare function appendThreadEvent(token: string, companyUid: string, threadId: string, eventKind: string, payload: Record<string, unknown>, signal?: AbortSignal): Promise<{
     eventId?: string;
     createdAt?: string;
 }>;
+export interface StoryPatch {
+    status?: string;
+    assigneeUid?: string;
+    clearAssignee?: boolean;
+}
+export interface StoryPatchResult {
+    projectId: string;
+    status: string;
+    version?: number;
+    assigneeUid: string | null;
+}
+/**
+ * PATCH one Board story. The server derives the actor from the request
+ * credential. This body never includes actorUid.
+ */
+export declare function patchStory(token: string, companyUid: string, projectId: string, storyId: string, patch: StoryPatch): Promise<StoryPatchResult>;
 export declare function patchStoryStatus(token: string, companyUid: string, projectId: string, storyId: string, status: string): Promise<{
     status: string;
     version?: number;
     projectId: string;
 }>;
+/** Read the full durable Board view before preparing a replacement PUT. */
+export declare function getProjectView(token: string, companyUid: string, projectId: string): Promise<MeshProjectView>;
+/** Replace a project's durable Board view and keep the local project cache current. */
+export declare function putProjectView(token: string, companyUid: string, projectId: string, input: {
+    name?: string;
+    description?: string;
+    stories?: MeshProjectStoryInput[];
+    repos?: MeshProjectRepo[];
+    version?: number;
+    expectedVersion?: number;
+}): Promise<MeshProjectView>;
+/** Register the project genesis thread and deterministic project channel. */
+export declare function registerMeshProject(token: string, companyUid: string, projectId: string, channelId?: string): Promise<MeshProjectRegistration>;
 export declare function pairDmUidsFromInbox(inbox: unknown): string[];
 export interface WarmCacheResult {
     directory: boolean;
@@ -94,13 +188,12 @@ export declare function meshCachePrincipalUid(tokens: {
     accessToken?: string;
 } | null | undefined, fallbackToken?: string): string;
 /**
- * Resolve the cache principal. JWT first; if the human access/id tokens have
- * no entityUid, ask `/v1/realtime/credentials` (same fallback as the pack
- * doctor). Only the uid is kept — credentials are discarded.
+ * Resolve the authenticated request principal. The request token is the source
+ * of truth; cached credentials may contribute an entity uid only when they
+ * identify the same caller. Only the uid is kept — credentials are discarded.
  */
 export declare function resolveMeshPrincipalUid(token: string, tokens?: {
     idToken?: string;
     accessToken?: string;
-} | null): Promise<string>;
-export declare function callerLabelFromToken(token: string): string;
+} | null): Promise<string | undefined>;
 //# sourceMappingURL=api.d.ts.map

package/dist/lib/mesh/api.js

@@ -30,6 +30,8 @@ export async function meshJson(token, path, init = {}) {
         method: init.method,
         body: init.body,
         query: init.query,
+        headers: init.headers,
+        signal: init.signal,
     });
     const text = await res.text();
     let data = {};
@@ -48,19 +50,40 @@ export async function meshJson(token, path, init = {}) {
         // 400 whose body text matched no pattern was retried forever.
         const detail = err.error || err.message || res.statusText || "request failed";
         const code = typeof err.code === "string" && err.code ? `${err.code}: ` : "";
-        throw new Error(`${res.status} ${code}${detail}`);
+        const context = [
+            typeof err.stage === "string" && err.stage ? `stage=${err.stage}` : "",
+            typeof err.recovery === "string" && err.recovery ? `recovery=${err.recovery}` : "",
+        ].filter(Boolean);
+        const failure = new Error(`${res.status} ${code}${detail}${context.length ? ` (${context.join("; ")})` : ""}`);
+        failure.status = res.status;
+        if (typeof err.code === "string" && err.code)
+            failure.code = err.code;
+        throw failure;
     }
     return data;
 }
 export async function resolveMeshCompany(token, company) {
-    const explicit = process.env.HQ_WORK_MESH_COMPANY_UID || process.env.HQ_COMPANY_UID;
-    if (explicit?.trim()) {
-        return { companyUid: explicit.trim(), companySlug: company || explicit.trim() };
+    const meshOverride = process.env.HQ_WORK_MESH_COMPANY_UID?.trim();
+    const companyOverride = process.env.HQ_COMPANY_UID?.trim();
+    const explicit = meshOverride || companyOverride;
+    const explicitSource = meshOverride ? "HQ_WORK_MESH_COMPANY_UID" : "HQ_COMPANY_UID";
+    if (explicit && explicit.startsWith("cmp_")) {
+        return { companyUid: explicit, companySlug: company || explicit };
     }
-    if (company && /^(cmp|co)_/.test(company)) {
+    if (explicit) {
+        // hq-pro accepts companyUid only with the cmp_ prefix (flags-resolve.ts:145-150).
+        // Ignore a malformed UID override so it cannot become a request identity.
+        process.stderr.write(`${JSON.stringify({
+            event: "work_mesh.invalid_company_uid_override",
+            source: explicitSource,
+            expected_prefix: "cmp_",
+        })}\n`);
+    }
+    if (company?.startsWith("cmp_")) {
         return { companyUid: company, companySlug: company };
     }
-    const uid = await getCompanyUid(token, company);
+    const companySlug = company?.trim();
+    const uid = await getCompanyUid(token, companySlug || undefined);
     return { companyUid: uid, companySlug: company || uid };
 }
 /**
@@ -97,17 +120,25 @@ export async function listActiveMembershipCompanies(token) {
  *
  * Lists the caller's active companies via GET /membership/me and matches the
  * requested slug (case-insensitive). Does **not** honour HQ_COMPANY_UID /
- * HQ_WORK_MESH_COMPANY_UID env overrides or treat a raw `cmp_`/`co_` ref as
- * proof of membership without an active membership row.
+ * HQ_WORK_MESH_COMPANY_UID env overrides or treat a raw `cmp_` ref as proof
+ * of membership without an active membership row.
  *
  * Returns null when the caller is not an active member. Throws on transport /
  * auth failures so the caller can surface DEFAULT_COMPANY_UNAVAILABLE.
  */
-export async function resolveActiveMembershipCompany(token, slug) {
+export async function resolveActiveMembershipCompany(token, slug, signal) {
     const trimmed = slug.trim();
     if (!trimmed)
         return null;
-    const rows = await listActiveMembershipCompanies(token);
+    // An aborted lookup is not "not a member". Throw so callers defer.
+    if (signal?.aborted) {
+        throw new Error("membership lookup aborted");
+    }
+    const payload = asRecord(await meshJson(token, "/membership/me", { signal }));
+    if (!payload || !Array.isArray(payload.memberships)) {
+        throw new Error("Malformed membership response: expected memberships array");
+    }
+    const rows = activeMembershipCompanies(payload.memberships);
     const needle = trimmed.toLowerCase();
     const matches = rows.filter((c) => c.companySlug.toLowerCase() === needle ||
         c.companyUid.toLowerCase() === needle);
@@ -118,7 +149,29 @@ export async function resolveActiveMembershipCompany(token, slug) {
     // Ambiguous slug across memberships — refuse rather than guess.
     return null;
 }
-export async function requireToken() {
+function activeMembershipCompanies(rows) {
+    const out = [];
+    const seen = new Set();
+    for (const row of rows) {
+        const rec = asRecord(row);
+        if (!rec)
+            continue;
+        if (String(rec.status || "").toLowerCase() !== "active")
+            continue;
+        const companyUid = typeof rec.companyUid === "string" ? rec.companyUid : "";
+        if (!companyUid || seen.has(companyUid))
+            continue;
+        const companySlug = typeof rec.companySlug === "string"
+            ? rec.companySlug
+            : typeof rec.companyFolderSlug === "string"
+                ? rec.companyFolderSlug
+                : companyUid;
+        seen.add(companyUid);
+        out.push({ companyUid, companySlug: companySlug || companyUid });
+    }
+    return out;
+}
+export async function requireToken(opts = {}) {
     // Agent/machine boxes must authenticate the way the mesh daemon does:
     // an agent's identity claims (custom:entityType=agent, custom:entityUid)
     // ride the ID token ONLY; a person-cache ACCESS token on the box carries
@@ -129,48 +182,122 @@ export async function requireToken() {
     // hard policy indigo-agent-caller-resolution-id-token, agent claims ride
     // the ID token only; the server is correct to require it. Humans keep the
     // person access token (unchanged).
+    const interactive = opts.interactive ?? true;
     if (isMachineIdentity()) {
-        return ensureCognitoToken({ tokenSource: "machine" });
+        return ensureCognitoToken({ tokenSource: "machine", interactive });
     }
-    return ensureCognitoToken();
+    return ensureCognitoToken({ interactive });
 }
 function asRecord(value) {
     return value && typeof value === "object" && !Array.isArray(value)
         ? value
         : null;
 }
-export async function listActiveThreads(token, companyUid, projectId) {
+function threadRows(data) {
+    const rows = Array.isArray(data?.threads)
+        ? data.threads
+        : Array.isArray(data?.items)
+            ? data.items
+            : [];
+    const out = [];
+    for (const row of rows) {
+        const rec = asRecord(row);
+        if (!rec)
+            continue;
+        out.push(rec);
+    }
+    return out;
+}
+function sortThreadsByActivity(threads) {
+    return [...threads].sort((a, b) => String(b.lastActivityAt || b.createdAt || "").localeCompare(String(a.lastActivityAt || a.createdAt || "")));
+}
+function isActiveThread(thread) {
+    const status = String(thread.threadStatus || "").toLowerCase();
+    return !status || ACTIVE_STATUSES.has(status);
+}
+function threadKey(thread) {
+    const id = typeof thread.threadId === "string" ? thread.threadId.trim() : "";
+    return id || undefined;
+}
+async function listThreadsByQuery(token, query) {
+    const collected = [];
+    let cursor = "";
+    for (let page = 0; page < 10; page += 1) {
+        const pageQuery = { ...query, limit: "100" };
+        if (cursor)
+            pageQuery.cursor = cursor;
+        const data = asRecord(await meshJson(token, "/v1/work-mesh/threads", { query: pageQuery }));
+        collected.push(...threadRows(data));
+        cursor = typeof data?.nextCursor === "string" ? data.nextCursor : "";
+        if (!cursor)
+            break;
+    }
+    return collected;
+}
+async function listThreadsByStatus(token, companyUid) {
     const collected = [];
     for (const status of ACTIVE_STATUSES) {
-        let cursor = "";
-        for (let page = 0; page < 10; page += 1) {
-            const query = {
+        collected.push(...(await listThreadsByQuery(token, { companyUid, status })));
+    }
+    return collected;
+}
+/**
+ * Project facets contain all project-owned threads, including terminal lane
+ * threads that have been removed from the active-status index.
+ */
+async function listProjectThreads(token, companyUid, projectId) {
+    try {
+        return await listThreadsByQuery(token, {
+            companyUid,
+            projectId,
+        });
+    }
+    catch {
+        try {
+            return await listThreadsByQuery(token, {
                 companyUid,
-                status,
-                limit: "100",
-            };
-            if (cursor)
-                query.cursor = cursor;
-            const data = asRecord(await meshJson(token, "/v1/work-mesh/threads", { query }));
-            const rows = Array.isArray(data?.threads)
-                ? data.threads
-                : Array.isArray(data?.items)
-                    ? data.items
-                    : [];
-            for (const row of rows) {
-                const rec = asRecord(row);
-                if (!rec)
-                    continue;
-                collected.push(rec);
-            }
-            cursor = typeof data?.nextCursor === "string" ? data.nextCursor : "";
-            if (!cursor)
-                break;
+                projectId,
+                status: "open",
+            });
+        }
+        catch {
+            return [];
         }
     }
-    return collected
-        .filter((thread) => !projectId || thread.projectId === projectId)
-        .sort((a, b) => String(b.lastActivityAt || b.createdAt || "").localeCompare(String(a.lastActivityAt || a.createdAt || "")));
+}
+function mergeProjectAndStatusThreads(projectThreads, statusThreads, projectId) {
+    const seen = new Set();
+    const merged = [];
+    for (const thread of sortThreadsByActivity(projectThreads.filter((t) => (!t.projectId || t.projectId === projectId) &&
+        (isActiveThread(t) ||
+            (t.kind === "lane" &&
+                ["done", "failed", "interrupted", "cancelled", "killed"].includes(String(t.laneStatus))))))) {
+        const key = threadKey(thread);
+        if (key) {
+            if (seen.has(key))
+                continue;
+            seen.add(key);
+        }
+        merged.push(thread);
+    }
+    for (const thread of sortThreadsByActivity(statusThreads.filter((t) => t.projectId === projectId && isActiveThread(t)))) {
+        const key = threadKey(thread);
+        if (key) {
+            if (seen.has(key))
+                continue;
+            seen.add(key);
+        }
+        merged.push(thread);
+    }
+    return merged;
+}
+export async function listActiveThreads(token, companyUid, projectId) {
+    const statusListed = await listThreadsByStatus(token, companyUid);
+    if (!projectId) {
+        return sortThreadsByActivity(statusListed);
+    }
+    const projectListed = await listProjectThreads(token, companyUid, projectId);
+    return mergeProjectAndStatusThreads(projectListed, statusListed, projectId);
 }
 export function clamp(value, max) {
     return value.length <= max ? value : value.slice(0, max);
@@ -203,7 +330,7 @@ export function eventPayload(kind, opts, claimedBy) {
 export async function ensureProjectThread(token, company, projectId, opts) {
     if (opts.threadId)
         return { threadId: opts.threadId, created: false };
-    const existing = (await listActiveThreads(token, company.companyUid, projectId))[0];
+    const existing = (await listActiveThreads(token, company.companyUid, projectId)).find((thread) => (thread.kind ?? "project") === "project" && !!thread.threadId);
     if (existing?.threadId)
         return { threadId: existing.threadId, created: false };
     const created = asRecord(await meshJson(token, "/v1/work-mesh/threads", {
@@ -223,20 +350,57 @@ export async function ensureProjectThread(token, company, projectId, opts) {
         throw new Error("Work mesh did not return a threadId");
     return { threadId, created: true };
 }
-export async function appendThreadEvent(token, companyUid, threadId, eventKind, payload) {
+/** Ensure the server-owned, stable Work Mesh thread for one lane. */
+export async function ensureLaneMeshThread(token, company, projectId, lane, laneStatus, signal) {
+    const result = asRecord(await meshJson(token, "/v1/work-mesh/threads", {
+        method: "POST",
+        body: {
+            companyUid: company.companyUid,
+            projectId,
+            routing: {
+                priority: "normal",
+                tags: ["hq-lane", `project:${projectId}`, `lane:${lane.laneId}`],
+            },
+            lane,
+            laneStatus,
+        },
+        signal,
+    }));
+    const threadId = typeof result?.threadId === "string" ? result.threadId.trim() : "";
+    if (!threadId)
+        throw new Error("Work mesh lane registration did not return a threadId");
+    return { threadId };
+}
+export async function appendThreadEvent(token, companyUid, threadId, eventKind, payload, signal) {
     const data = asRecord(await meshJson(token, `/v1/work-mesh/threads/${encodeURIComponent(threadId)}/events`, {
         method: "POST",
         body: { companyUid, eventKind, payload },
+        signal,
     }));
     return {
         eventId: typeof data?.eventId === "string" ? data.eventId : undefined,
         createdAt: typeof data?.createdAt === "string" ? data.createdAt : undefined,
     };
 }
-export async function patchStoryStatus(token, companyUid, projectId, storyId, status) {
+/**
+ * PATCH one Board story. The server derives the actor from the request
+ * credential. This body never includes actorUid.
+ */
+export async function patchStory(token, companyUid, projectId, storyId, patch) {
+    if (typeof projectId !== "string" || projectId.trim() === "" ||
+        typeof storyId !== "string" || storyId.trim() === "") {
+        throw new TypeError("Work Mesh projectId and storyId must be non-empty strings");
+    }
+    const body = { companyUid };
+    if (patch.status)
+        body.status = patch.status;
+    if (patch.assigneeUid)
+        body.assigneeUid = patch.assigneeUid;
+    if (patch.clearAssignee)
+        body.clearAssignee = true;
     const view = asRecord(await meshJson(token, `/v1/work-mesh/projects/${encodeURIComponent(projectId)}/stories/${encodeURIComponent(storyId)}`, {
         method: "PATCH",
-        body: { companyUid, status },
+        body,
     }));
     if (view && typeof view.projectId === "string" && typeof view.companyUid === "string") {
         writeMeshCacheFile(["projects", view.companyUid, `${view.projectId}.json`], view);
@@ -245,10 +409,99 @@ export async function patchStoryStatus(token, companyUid, projectId, storyId, st
     const patched = stories
         .map(asRecord)
         .find((row) => row && row.id === storyId);
+    const assigneeUid = patch.clearAssignee
+        ? typeof patched?.assigneeUid === "string"
+            ? patched.assigneeUid
+            : null
+        : typeof patched?.assigneeUid === "string"
+            ? patched.assigneeUid
+            : patch.assigneeUid ?? null;
     return {
         projectId: String(view?.projectId || projectId),
-        status: typeof patched?.status === "string" ? patched.status : status,
+        status: typeof patched?.status === "string" ? patched.status : patch.status || "",
         version: typeof view?.version === "number" ? view.version : undefined,
+        assigneeUid,
+    };
+}
+export async function patchStoryStatus(token, companyUid, projectId, storyId, status) {
+    const patched = await patchStory(token, companyUid, projectId, storyId, { status });
+    return {
+        projectId: patched.projectId,
+        status: patched.status,
+        version: patched.version,
+    };
+}
+function projectViewFromResponse(view, companyUid, projectId) {
+    const returnedProjectId = String(view.projectId || projectId).trim();
+    const returnedCompanyUid = String(view.companyUid || companyUid).trim();
+    const stories = Array.isArray(view.stories)
+        ? view.stories.filter((story) => asRecord(story))
+        : [];
+    const repos = Array.isArray(view.repos)
+        ? view.repos.flatMap((repo) => {
+            const row = asRecord(repo);
+            const path = typeof row?.path === "string" ? row.path.trim() : "";
+            if (!path)
+                return [];
+            return [{ path, branch: typeof row?.branch === "string" ? row.branch.trim() : "" }];
+        })
+        : [];
+    return {
+        companyUid: returnedCompanyUid,
+        projectId: returnedProjectId,
+        name: String(view.name || returnedProjectId),
+        description: typeof view.description === "string" ? view.description : "",
+        stories,
+        repos,
+        version: typeof view.version === "number" ? view.version : undefined,
+    };
+}
+/** Read the full durable Board view before preparing a replacement PUT. */
+export async function getProjectView(token, companyUid, projectId) {
+    const view = asRecord(await meshJson(token, `/v1/work-mesh/projects/${encodeURIComponent(projectId)}`, {
+        query: { companyUid },
+    }));
+    if (!view)
+        throw new Error("Work mesh returned an invalid project view");
+    return projectViewFromResponse(view, companyUid, projectId);
+}
+/** Replace a project's durable Board view and keep the local project cache current. */
+export async function putProjectView(token, companyUid, projectId, input) {
+    const { expectedVersion, ...document } = input;
+    const view = asRecord(await meshJson(token, `/v1/work-mesh/projects/${encodeURIComponent(projectId)}`, {
+        method: "PUT",
+        body: {
+            companyUid,
+            ...document,
+            ...(expectedVersion !== undefined ? { expectedVersion } : {}),
+        },
+        ...(expectedVersion !== undefined
+            ? { headers: { "If-Match": String(expectedVersion) } }
+            : {}),
+    }));
+    if (!view)
+        throw new Error("Work mesh returned an invalid project view");
+    const result = projectViewFromResponse(view, companyUid, projectId);
+    writeMeshCacheFile(["projects", result.companyUid, `${result.projectId}.json`], view);
+    return result;
+}
+/** Register the project genesis thread and deterministic project channel. */
+export async function registerMeshProject(token, companyUid, projectId, channelId) {
+    if (channelId !== undefined && !channelId.trim()) {
+        throw new Error("PROJECT_CHANNEL_INVALID: channelId must be non-empty");
+    }
+    const result = asRecord(await meshJson(token, `/v1/work-mesh/projects/${encodeURIComponent(projectId)}/register`, { method: "POST", body: { companyUid, ...(channelId ? { channelId: channelId.trim() } : {}) } }));
+    const threadId = String(result?.threadId || "").trim();
+    const registeredChannelId = String(result?.channelId || "").trim();
+    if (!threadId || !registeredChannelId) {
+        throw new Error("Work mesh registration did not return a threadId and channelId");
+    }
+    return {
+        companyUid: String(result?.companyUid || companyUid).trim(),
+        projectId: String(result?.projectId || projectId).trim(),
+        threadId,
+        channelId: registeredChannelId,
+        channelCreated: result?.channelCreated === true,
     };
 }
 export function pairDmUidsFromInbox(inbox) {
@@ -355,15 +608,43 @@ export function meshCachePrincipalUid(tokens, fallbackToken) {
     }
     return "session";
 }
+function tokensIdentifySamePrincipal(token, candidate) {
+    if (token === candidate)
+        return true;
+    const tokenClaims = peekIdToken(token);
+    const candidateClaims = peekIdToken(candidate);
+    const tokenEntityUid = entityUidFromJwt(token);
+    const candidateEntityUid = entityUidFromJwt(candidate);
+    if (tokenEntityUid && candidateEntityUid && tokenEntityUid !== candidateEntityUid) {
+        return false;
+    }
+    for (const claim of ["sub", "cognito:username", "username", "email"]) {
+        const tokenValue = tokenClaims[claim];
+        const candidateValue = candidateClaims[claim];
+        if (typeof tokenValue === "string" &&
+            tokenValue.length > 0 &&
+            tokenValue === candidateValue) {
+            return true;
+        }
+    }
+    return false;
+}
 /**
- * Resolve the cache principal. JWT first; if the human access/id tokens have
- * no entityUid, ask `/v1/realtime/credentials` (same fallback as the pack
- * doctor). Only the uid is kept — credentials are discarded.
+ * Resolve the authenticated request principal. The request token is the source
+ * of truth; cached credentials may contribute an entity uid only when they
+ * identify the same caller. Only the uid is kept — credentials are discarded.
  */
 export async function resolveMeshPrincipalUid(token, tokens) {
-    const fromJwt = meshCachePrincipalUid(tokens, token);
-    if (fromJwt !== "session")
-        return fromJwt;
+    const fromRequestToken = entityUidFromJwt(token);
+    if (fromRequestToken)
+        return fromRequestToken;
+    for (const candidate of [tokens?.idToken, tokens?.accessToken]) {
+        if (!candidate || !tokensIdentifySamePrincipal(token, candidate))
+            continue;
+        const uid = entityUidFromJwt(candidate);
+        if (uid)
+            return uid;
+    }
     try {
         const data = await meshJson(token, "/v1/realtime/credentials", {
             method: "POST",
@@ -374,19 +655,8 @@ export async function resolveMeshPrincipalUid(token, tokens) {
             return uid;
     }
     catch {
-        // best-effort; session.json is worse than failing doctor
+        // Best-effort; callers must fail rather than claim work as "session".
     }
-    return "session";
-}
-export function callerLabelFromToken(token) {
-    const claims = peekIdToken(token);
-    const entityUid = claims["custom:entityUid"];
-    if (typeof entityUid === "string" && entityUid)
-        return entityUid;
-    if (typeof claims.email === "string" && claims.email)
-        return claims.email;
-    if (typeof claims.sub === "string" && claims.sub)
-        return claims.sub;
-    return "hq-cli";
+    return undefined;
 }
 //# sourceMappingURL=api.js.map