@indigoai-us/hq-cli 5.314.0 → 5.316.0

package/dist/lib/agent-kit/wake.js

@@ -0,0 +1,243 @@
+/**
+ * Wake hook: tell the bot's own framework that HQ mail is waiting.
+ *
+ * Hosted agents are woken by the box watcher, which runs the model per inbox
+ * item. An external bot brings its own brain, so the kit cannot run it, but
+ * it can poke it. Two kinds, stored in ~/.hq-agent/wake.json (0600):
+ *
+ *   url      POST a small JSON notice to a URL the framework gives you, such
+ *            as a Grok Bot routine webhook. The URL is treated as a secret:
+ *            it is never logged or printed in full.
+ *   command  Run a local command (argv, no shell) for frameworks with a CLI
+ *            (such as OpenClaw). The notice is written to its stdin. One run
+ *            at a time; mail that arrives mid-run triggers one more run after.
+ *
+ * The notice never carries message text. It only says how many items are
+ * pending and their ids; the bot reads them through HQ (`hq agent inbox`).
+ *
+ * The inbox poller fires the wake when new items are mirrored, and re-fires
+ * every `retryMs` while items stay pending, so a missed webhook heals.
+ */
+import { spawn } from "node:child_process";
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { writePrivateFile } from "./private-file.js";
+export const WAKE_FILE_NAME = "wake.json";
+export const WAKE_STATE_NAME = "wake-state.json";
+export const DEFAULT_WAKE_RETRY_MS = 10 * 60_000;
+export const WAKE_URL_TIMEOUT_MS = 15_000;
+export const DEFAULT_WAKE_COMMAND_TIMEOUT_MS = 10 * 60_000;
+export const WAKE_INSTRUCTIONS = "New HQ messages are waiting. Run `hq agent inbox` (or the hq_inbox_read tool). Reply where each message " +
+    "arrived: if it has a channelId, post in that channel with `hq dm <channelId> \"…\"`; otherwise reply to the " +
+    "sender with `hq dm <sender-uid> \"…\"` (or hq_dm_send). Do not reply to another bot's greeting, thanks or " +
+    "sign-off that asks for nothing. Then mark each handled with `hq agent inbox done <id>` (or hq_inbox_done).";
+export function wakePath(paths) {
+    return path.join(paths.agentDir, WAKE_FILE_NAME);
+}
+function wakeStatePath(paths) {
+    return path.join(paths.stateDir, WAKE_STATE_NAME);
+}
+export function validateWakeUrl(raw) {
+    const url = raw.trim();
+    let parsed;
+    try {
+        parsed = new URL(url);
+    }
+    catch {
+        throw new Error("wake URL is not a valid URL");
+    }
+    const local = parsed.hostname === "localhost" || parsed.hostname === "127.0.0.1" || parsed.hostname === "::1";
+    if (parsed.protocol !== "https:" && !(parsed.protocol === "http:" && local)) {
+        throw new Error("wake URL must use https (http is allowed only for localhost)");
+    }
+    if (parsed.username || parsed.password)
+        throw new Error("wake URL must not embed a username or password");
+    return url;
+}
+/** Origin plus a masked path: enough to recognise, not enough to call. */
+export function redactWakeUrl(url) {
+    try {
+        const u = new URL(url);
+        return `${u.origin}/…`;
+    }
+    catch {
+        return "(invalid url)";
+    }
+}
+export function describeWake(config) {
+    if (!config)
+        return "not configured";
+    return config.kind === "url"
+        ? `url ${redactWakeUrl(config.url)}`
+        : `command ${config.command[0]}${config.command.length > 1 ? " …" : ""}`;
+}
+export function readWakeConfig(paths) {
+    let raw;
+    try {
+        raw = JSON.parse(fs.readFileSync(wakePath(paths), "utf8"));
+    }
+    catch {
+        return null;
+    }
+    const retryMs = typeof raw.retryMs === "number" && raw.retryMs >= 60_000 ? raw.retryMs : DEFAULT_WAKE_RETRY_MS;
+    if (raw.kind === "url" && typeof raw.url === "string") {
+        try {
+            return { kind: "url", url: validateWakeUrl(raw.url), retryMs };
+        }
+        catch {
+            return null;
+        }
+    }
+    if (raw.kind === "command" && Array.isArray(raw.command) && raw.command.length > 0 && raw.command.every((x) => typeof x === "string" && x)) {
+        const timeoutMs = typeof raw.timeoutMs === "number" && raw.timeoutMs > 0 ? raw.timeoutMs : DEFAULT_WAKE_COMMAND_TIMEOUT_MS;
+        return { kind: "command", command: raw.command, timeoutMs, retryMs };
+    }
+    return null;
+}
+export function writeWakeConfig(paths, config) {
+    // Owner-only if the filesystem allows it. A bot whose only persistent
+    // storage is a CIFS share cannot have owner-only files at all, and refusing
+    // to write there would mean it could never be woken.
+    writePrivateFile(wakePath(paths), `${JSON.stringify(config, null, 2)}\n`, 0o600);
+}
+export function clearWakeConfig(paths) {
+    try {
+        fs.unlinkSync(wakePath(paths));
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function readWakeState(paths) {
+    try {
+        return JSON.parse(fs.readFileSync(wakeStatePath(paths), "utf8"));
+    }
+    catch {
+        return {};
+    }
+}
+function writeWakeState(paths, state) {
+    fs.mkdirSync(paths.stateDir, { recursive: true, mode: 0o700 });
+    fs.writeFileSync(wakeStatePath(paths), JSON.stringify(state), { mode: 0o600 });
+}
+function pidAlive(pid) {
+    if (!pid)
+        return false;
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+export function buildWakeNotice(agentUid, reason, ids, now) {
+    return {
+        event: "hq.inbox.pending",
+        agentUid,
+        reason,
+        pending: ids.length,
+        messageIds: ids.slice(0, 50),
+        at: now.toISOString(),
+        instructions: WAKE_INSTRUCTIONS,
+    };
+}
+/**
+ * Decide whether to wake now: always on new mail, otherwise only when items
+ * are still pending and the last wake is older than retryMs.
+ */
+export function shouldWake(config, state, freshCount, pendingCount, now) {
+    if (pendingCount === 0)
+        return null;
+    if (freshCount > 0)
+        return "new";
+    const last = state.lastWakeAt ? Date.parse(state.lastWakeAt) : NaN;
+    if (Number.isNaN(last) || now.getTime() - last >= config.retryMs)
+        return "retry";
+    return null;
+}
+export async function fireWake(config, notice, deps) {
+    const now = deps.now ?? (() => new Date());
+    const state = readWakeState(deps.paths);
+    const alive = deps.pidAlive ?? pidAlive;
+    if (config.kind === "url") {
+        const doFetch = deps.fetchImpl ?? fetch;
+        const controller = new AbortController();
+        const timer = setTimeout(() => controller.abort(), WAKE_URL_TIMEOUT_MS);
+        const target = redactWakeUrl(config.url);
+        try {
+            const res = await doFetch(config.url, {
+                method: "POST",
+                headers: { "content-type": "application/json", "user-agent": "hq-agent-kit" },
+                body: JSON.stringify(notice),
+                signal: controller.signal,
+            });
+            writeWakeState(deps.paths, { ...state, lastWakeAt: now().toISOString() });
+            const ok = res.status >= 200 && res.status < 300;
+            const detail = `wake url ${target} → ${res.status} (${notice.reason}, ${notice.pending} pending)`;
+            deps.log(ok ? "info" : "warn", detail);
+            return { fired: true, ok, detail };
+        }
+        catch (err) {
+            const detail = `wake url ${target} failed: ${err instanceof Error ? err.name === "AbortError" ? "timeout" : err.message : String(err)}`;
+            deps.log("warn", detail);
+            return { fired: true, ok: false, detail };
+        }
+        finally {
+            clearTimeout(timer);
+        }
+    }
+    if (alive(state.runningPid)) {
+        writeWakeState(deps.paths, { ...state, rerun: true });
+        const detail = `wake command still running (pid ${state.runningPid}); will run again after it exits`;
+        deps.log("info", detail);
+        return { fired: false, ok: true, detail };
+    }
+    const doSpawn = deps.spawnImpl ?? spawn;
+    const logFd = fs.openSync(path.join(deps.paths.logsDir, "wake.log"), "a", 0o600);
+    let child;
+    try {
+        child = doSpawn(config.command[0], config.command.slice(1), {
+            // stdout is discarded: a wake command's normal output (a routine record,
+            // a prompt echo) has no diagnostic value and would land in a log that is
+            // world-readable on a share without permissions. stderr is kept so a
+            // failing wake can still be diagnosed.
+            stdio: ["pipe", "ignore", logFd],
+            env: {
+                ...process.env,
+                HQ_WAKE_EVENT: notice.event,
+                HQ_WAKE_REASON: notice.reason,
+                HQ_WAKE_PENDING: String(notice.pending),
+                HQ_AGENT_UID: notice.agentUid,
+            },
+        });
+    }
+    catch (err) {
+        fs.closeSync(logFd);
+        const detail = `wake command failed to start: ${err instanceof Error ? err.message : String(err)}`;
+        deps.log("warn", detail);
+        return { fired: false, ok: false, detail };
+    }
+    fs.closeSync(logFd);
+    child.stdin?.end(`${JSON.stringify(notice)}\n`);
+    writeWakeState(deps.paths, { lastWakeAt: now().toISOString(), runningPid: child.pid, rerun: false });
+    const timer = setTimeout(() => child.kill("SIGTERM"), config.timeoutMs);
+    const detail = `wake command started pid ${child.pid} (${notice.reason}, ${notice.pending} pending)`;
+    deps.log("info", detail);
+    child.on("error", (err) => deps.log("warn", `wake command error: ${err.message}`));
+    child.on("exit", (code, signal) => {
+        clearTimeout(timer);
+        const after = readWakeState(deps.paths);
+        writeWakeState(deps.paths, { lastWakeAt: after.lastWakeAt, rerun: false });
+        deps.log(code === 0 ? "info" : "warn", `wake command exited ${signal ?? code}`);
+        if (after.rerun) {
+            void fireWake(config, { ...notice, reason: "new", at: now().toISOString() }, deps);
+        }
+    });
+    return { fired: true, ok: true, detail };
+}
+export function currentWakeState(paths) {
+    return { lastWakeAt: readWakeState(paths).lastWakeAt };
+}
+//# sourceMappingURL=wake.js.map

package/dist/lib/agents/model-catalog.d.ts

@@ -0,0 +1,62 @@
+export declare const AGENT_MODEL_PROVIDERS: readonly ["codex", "grok", "claude"];
+export type AgentModelProvider = (typeof AGENT_MODEL_PROVIDERS)[number];
+interface AgentCatalogModel {
+    id: string;
+    label: string;
+    visibility: string;
+    isNew: boolean;
+    authModes: string[];
+    efforts: string[];
+    selectable: boolean;
+    unavailableReason?: string | null;
+}
+interface AgentCatalogProvider {
+    models: AgentCatalogModel[];
+    defaultModel: string;
+}
+export interface AgentModelCatalog {
+    providers: Record<AgentModelProvider, AgentCatalogProvider>;
+    generatedAt: string;
+}
+export type AgentModelCatalogResult = {
+    ok: true;
+    catalog: AgentModelCatalog;
+    etag: string;
+    fetchedAt: number;
+    source: "network" | "cache";
+} | {
+    ok: false;
+    reason: "unavailable";
+} | {
+    ok: false;
+    reason: "request_failed";
+    status: number;
+};
+export interface ReadAgentModelCatalogOptions {
+    baseUrl?: string;
+    cacheFile?: string;
+    now?: () => number;
+    request?: (headers: Record<string, string>, signal: AbortSignal) => Promise<Response>;
+    timeoutMs?: number;
+}
+/** Use the same effective state directory as the CLI's person-token cache. */
+export declare function agentModelCatalogCacheFile(baseUrl?: string, home?: string, env?: NodeJS.ProcessEnv): string;
+/** Parse the documented response without constraining forward-compatible string values. */
+export declare function parseAgentModelCatalog(value: unknown): AgentModelCatalog | null;
+/** Read the live endpoint, conditionally refresh it, and fall back to the last good cache. */
+export declare function readAgentModelCatalog(token: string, options?: ReadAgentModelCatalogOptions): Promise<AgentModelCatalogResult>;
+export type ModelSelectionResult = {
+    ok: true;
+} | {
+    ok: false;
+    reason: "unknown" | "not_selectable";
+    provider?: AgentModelProvider;
+    suggestions: string[];
+};
+/** Check an explicit model against the selected provider or inferred agents-v2 brain. */
+export declare function validateAgentModelSelection(catalog: AgentModelCatalog, modelId: string, chosenProvider?: string): ModelSelectionResult;
+export declare function modelSelectionErrorMessage(modelId: string, result: Extract<ModelSelectionResult, {
+    ok: false;
+}>): string;
+export {};
+//# sourceMappingURL=model-catalog.d.ts.map

package/dist/lib/agents/model-catalog.js

@@ -0,0 +1,275 @@
+import { createHash } from "node:crypto";
+import * as fs from "node:fs";
+import * as os from "node:os";
+import * as path from "node:path";
+import { DEFAULT_VAULT_API_URL, personTokenCacheFile } from "../../utils/cognito-session.js";
+import { vaultApiFetch } from "../../utils/vault-api.js";
+export const AGENT_MODEL_PROVIDERS = ["codex", "grok", "claude"];
+const MODEL_CATALOG_REQUEST_TIMEOUT_MS = 15_000;
+/** Use the same effective state directory as the CLI's person-token cache. */
+export function agentModelCatalogCacheFile(baseUrl = DEFAULT_VAULT_API_URL, home = os.homedir(), env = process.env) {
+    const scope = createHash("sha256").update(baseUrl).digest("hex").slice(0, 16);
+    return path.join(path.dirname(personTokenCacheFile(home, env)), `agent-model-catalog-${scope}.json`);
+}
+/** Parse the documented response without constraining forward-compatible string values. */
+export function parseAgentModelCatalog(value) {
+    if (!isRecord(value) || !isRecord(value.providers))
+        return null;
+    if (typeof value.generatedAt !== "string" || !Number.isFinite(Date.parse(value.generatedAt))) {
+        return null;
+    }
+    const providers = {};
+    for (const provider of AGENT_MODEL_PROVIDERS) {
+        const rawProvider = value.providers[provider];
+        if (!isRecord(rawProvider) ||
+            !Array.isArray(rawProvider.models) ||
+            typeof rawProvider.defaultModel !== "string") {
+            return null;
+        }
+        const models = [];
+        for (const rawModel of rawProvider.models) {
+            if (!isRecord(rawModel) ||
+                typeof rawModel.id !== "string" ||
+                !/^[A-Za-z0-9._-]{1,128}$/.test(rawModel.id) ||
+                typeof rawModel.label !== "string" ||
+                typeof rawModel.visibility !== "string" ||
+                typeof rawModel.isNew !== "boolean" ||
+                !isStringArray(rawModel.authModes) ||
+                !isStringArray(rawModel.efforts) ||
+                typeof rawModel.selectable !== "boolean" ||
+                (rawModel.unavailableReason !== undefined &&
+                    rawModel.unavailableReason !== null &&
+                    typeof rawModel.unavailableReason !== "string")) {
+                return null;
+            }
+            models.push({
+                id: rawModel.id,
+                label: rawModel.label,
+                visibility: rawModel.visibility,
+                isNew: rawModel.isNew,
+                authModes: rawModel.authModes,
+                efforts: rawModel.efforts,
+                selectable: rawModel.selectable,
+                ...(rawModel.unavailableReason !== undefined
+                    ? { unavailableReason: rawModel.unavailableReason }
+                    : {}),
+            });
+        }
+        if (!models.some((model) => model.id === rawProvider.defaultModel && model.selectable)) {
+            return null;
+        }
+        providers[provider] = { models, defaultModel: rawProvider.defaultModel };
+    }
+    return { providers, generatedAt: value.generatedAt };
+}
+/** Read the live endpoint, conditionally refresh it, and fall back to the last good cache. */
+export async function readAgentModelCatalog(token, options = {}) {
+    const baseUrl = options.baseUrl ?? DEFAULT_VAULT_API_URL;
+    const cacheFile = options.cacheFile ?? agentModelCatalogCacheFile(baseUrl);
+    const now = options.now ?? Date.now;
+    const signal = AbortSignal.timeout(options.timeoutMs ?? MODEL_CATALOG_REQUEST_TIMEOUT_MS);
+    const cached = readCache(cacheFile);
+    const headers = cached
+        ? { "If-None-Match": cached.etag }
+        : {};
+    let response;
+    try {
+        response = options.request
+            ? await options.request(headers, signal)
+            : await vaultApiFetch({ token, baseUrl, path: "/v1/agents/models", headers, signal });
+    }
+    catch {
+        return cached ? fromCache(cached) : { ok: false, reason: "unavailable" };
+    }
+    if (response.status === 304) {
+        if (!cached)
+            return { ok: false, reason: "unavailable" };
+        const refreshed = {
+            ...cached,
+            etag: response.headers.get("etag") ?? cached.etag,
+            fetchedAt: now(),
+        };
+        if (isStrongEtag(refreshed.etag))
+            writeCache(cacheFile, refreshed);
+        return fromCache(refreshed, "network");
+    }
+    if (response.status === 404 || response.status === 429 || response.status >= 500) {
+        return cached ? fromCache(cached) : { ok: false, reason: "unavailable" };
+    }
+    if (!response.ok) {
+        return { ok: false, reason: "request_failed", status: response.status };
+    }
+    try {
+        const catalog = parseAgentModelCatalog(await response.json());
+        const etag = response.headers.get("etag");
+        if (!catalog || !etag || !isStrongEtag(etag)) {
+            return cached ? fromCache(cached) : { ok: false, reason: "unavailable" };
+        }
+        const entry = {
+            version: 1,
+            catalog,
+            etag,
+            fetchedAt: now(),
+        };
+        writeCache(cacheFile, entry);
+        return { ok: true, ...entry, source: "network" };
+    }
+    catch {
+        return cached ? fromCache(cached) : { ok: false, reason: "unavailable" };
+    }
+}
+/** Check an explicit model against the selected provider or inferred agents-v2 brain. */
+export function validateAgentModelSelection(catalog, modelId, chosenProvider) {
+    const provider = isCatalogProvider(chosenProvider) ? chosenProvider : undefined;
+    const inferred = providerFromModelId(modelId);
+    const providers = provider
+        ? [provider]
+        : inferred
+            ? [inferred]
+            : [...AGENT_MODEL_PROVIDERS];
+    const rows = providers.flatMap((name) => catalog.providers[name].models.map((model) => ({ provider: name, model })));
+    const exact = rows.find(({ model }) => model.id.toLowerCase() === modelId.toLowerCase());
+    if (exact?.model.selectable)
+        return { ok: true };
+    const suggestions = closestSelectableModels(modelId, rows.filter(({ model }) => model.selectable).map(({ model }) => model.id));
+    return {
+        ok: false,
+        reason: exact ? "not_selectable" : "unknown",
+        ...(providers.length === 1 ? { provider: providers[0] } : {}),
+        suggestions,
+    };
+}
+export function modelSelectionErrorMessage(modelId, result) {
+    const scope = result.provider ? `the ${result.provider} catalog` : "the model catalog";
+    const problem = result.reason === "not_selectable" ? "not selectable in" : "not listed in";
+    const suggestion = result.suggestions.length
+        ? ` Close matches: ${result.suggestions.join(", ")}.`
+        : "";
+    const command = result.provider
+        ? ` Run \`hq agents models --provider ${result.provider}\` to see available models.`
+        : " Run `hq agents models` to see available models.";
+    return `Model '${modelId}' is ${problem} ${scope}.${suggestion}${command}`;
+}
+function providerFromModelId(modelId) {
+    const normalized = modelId.toLowerCase();
+    if (normalized.startsWith("gpt-"))
+        return "codex";
+    if (normalized.startsWith("grok-"))
+        return "grok";
+    if (normalized.startsWith("claude-"))
+        return "claude";
+    return undefined;
+}
+function closestSelectableModels(modelId, candidates) {
+    const needle = modelId.toLowerCase();
+    return candidates
+        .map((id) => ({
+        id,
+        distance: editDistance(needle, id.toLowerCase()),
+        prefix: commonPrefixLength(needle, id.toLowerCase()),
+    }))
+        .filter(({ distance, id }) => distance <= Math.max(2, Math.floor(needle.length / 4)) ||
+        id.toLowerCase().startsWith(needle))
+        .sort((a, b) => a.distance - b.distance || b.prefix - a.prefix || a.id.localeCompare(b.id))
+        .slice(0, 3)
+        .map(({ id }) => id);
+}
+function editDistance(left, right) {
+    let previous = Array.from({ length: right.length + 1 }, (_, index) => index);
+    for (let i = 1; i <= left.length; i += 1) {
+        const current = [i];
+        for (let j = 1; j <= right.length; j += 1) {
+            current[j] = Math.min(current[j - 1] + 1, previous[j] + 1, previous[j - 1] + (left[i - 1] === right[j - 1] ? 0 : 1));
+        }
+        previous = current;
+    }
+    return previous[right.length];
+}
+function commonPrefixLength(left, right) {
+    let index = 0;
+    while (index < left.length && index < right.length && left[index] === right[index])
+        index += 1;
+    return index;
+}
+function readCache(file) {
+    let serialized;
+    try {
+        serialized = fs.readFileSync(file, "utf8");
+    }
+    catch (error) {
+        if (isMissingFile(error))
+            return null;
+        console.warn("Unable to read the model catalog cache; continuing without cached data.");
+        return null;
+    }
+    let value;
+    try {
+        value = JSON.parse(serialized);
+    }
+    catch {
+        console.warn("Ignoring an invalid model catalog cache file.");
+        return null;
+    }
+    if (!isRecord(value) || value.version !== 1 || !isStrongEtag(value.etag)) {
+        console.warn("Ignoring an invalid model catalog cache file.");
+        return null;
+    }
+    if (typeof value.fetchedAt !== "number" || !Number.isFinite(value.fetchedAt)) {
+        console.warn("Ignoring an invalid model catalog cache file.");
+        return null;
+    }
+    const catalog = parseAgentModelCatalog(value.catalog);
+    if (!catalog) {
+        console.warn("Ignoring an invalid model catalog cache file.");
+        return null;
+    }
+    return { version: 1, catalog, etag: value.etag, fetchedAt: value.fetchedAt };
+}
+function writeCache(file, cache) {
+    const temporary = `${file}.${process.pid}.${cache.fetchedAt}.tmp`;
+    try {
+        fs.mkdirSync(path.dirname(file), { recursive: true, mode: 0o700 });
+        fs.writeFileSync(temporary, JSON.stringify(cache), { encoding: "utf8", mode: 0o600 });
+        fs.renameSync(temporary, file);
+    }
+    catch {
+        console.warn("Unable to save the model catalog cache; offline use may be unavailable.");
+        try {
+            fs.rmSync(temporary, { force: true });
+        }
+        catch (error) {
+            if (!isMissingFile(error)) {
+                console.warn("Unable to remove a temporary model catalog cache file.");
+            }
+        }
+    }
+}
+function fromCache(cache, source = "cache") {
+    return {
+        ok: true,
+        catalog: cache.catalog,
+        etag: cache.etag,
+        fetchedAt: cache.fetchedAt,
+        source,
+    };
+}
+function isStrongEtag(value) {
+    return typeof value === "string" &&
+        value.length >= 2 &&
+        value.startsWith('"') &&
+        value.endsWith('"') &&
+        !/[\r\n]/.test(value);
+}
+function isMissingFile(error) {
+    return error instanceof Error && "code" in error && error.code === "ENOENT";
+}
+function isCatalogProvider(value) {
+    return value !== undefined && AGENT_MODEL_PROVIDERS.includes(value);
+}
+function isStringArray(value) {
+    return Array.isArray(value) && value.every((item) => typeof item === "string");
+}
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+//# sourceMappingURL=model-catalog.js.map

package/dist/lib/auth-login-provider-state.d.ts

@@ -0,0 +1,8 @@
+import type { RememberedLoginProvider } from "../utils/login-provider.js";
+export declare const LOGIN_PROVIDER_STATE_FILE_NAME = "auth-login-provider.json";
+export declare function getLastLoginProviderStatePath(): string;
+/** Read only the provider preference; malformed or unknown state is ignored. */
+export declare function loadLastLoginProvider(): RememberedLoginProvider | undefined;
+/** Store only the provider name, clearing stale state when the choice is unknown. */
+export declare function storeLastLoginProvider(provider: RememberedLoginProvider | undefined): void;
+//# sourceMappingURL=auth-login-provider-state.d.ts.map

package/dist/lib/auth-login-provider-state.js

@@ -0,0 +1,63 @@
+import { randomUUID } from "node:crypto";
+import { mkdirSync, readFileSync, renameSync, rmSync, writeFileSync, } from "node:fs";
+import path from "node:path";
+import { personTokenCacheFile } from "../utils/cognito-session.js";
+export const LOGIN_PROVIDER_STATE_FILE_NAME = "auth-login-provider.json";
+export function getLastLoginProviderStatePath() {
+    return path.join(path.dirname(personTokenCacheFile()), LOGIN_PROVIDER_STATE_FILE_NAME);
+}
+function isRememberedProvider(value) {
+    return value === "google" || value === "microsoft";
+}
+/** Read only the provider preference; malformed or unknown state is ignored. */
+export function loadLastLoginProvider() {
+    let raw;
+    try {
+        raw = readFileSync(getLastLoginProviderStatePath(), "utf8");
+    }
+    catch (error) {
+        if (error && typeof error === "object" && "code" in error && error.code === "ENOENT") {
+            return undefined;
+        }
+        throw error;
+    }
+    let value;
+    try {
+        value = JSON.parse(raw);
+    }
+    catch {
+        return undefined;
+    }
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return undefined;
+    const state = value;
+    const keys = Object.keys(state).sort();
+    if (keys.length !== 2
+        || keys[0] !== "lastProvider"
+        || keys[1] !== "schemaVersion"
+        || state.schemaVersion !== 1
+        || !isRememberedProvider(state.lastProvider)) {
+        return undefined;
+    }
+    return state.lastProvider;
+}
+/** Store only the provider name, clearing stale state when the choice is unknown. */
+export function storeLastLoginProvider(provider) {
+    const filePath = getLastLoginProviderStatePath();
+    if (!provider) {
+        rmSync(filePath, { force: true });
+        return;
+    }
+    const directory = path.dirname(filePath);
+    mkdirSync(directory, { recursive: true, mode: 0o700 });
+    const temporaryPath = `${filePath}.${process.pid}.${randomUUID()}.tmp`;
+    try {
+        const state = { schemaVersion: 1, lastProvider: provider };
+        writeFileSync(temporaryPath, JSON.stringify(state), { mode: 0o600, flag: "wx" });
+        renameSync(temporaryPath, filePath);
+    }
+    finally {
+        rmSync(temporaryPath, { force: true });
+    }
+}
+//# sourceMappingURL=auth-login-provider-state.js.map

package/dist/lib/aws-sdk-node-warning-output.d.ts

@@ -0,0 +1,12 @@
+export declare const AWS_SDK_NODE_VERSION_WARNING_ENV = "AWS_SDK_JS_NODE_VERSION_SUPPORT_WARNING_DISABLED";
+export interface AwsSdkWarningOutputOptions {
+    argv?: readonly string[];
+    env?: NodeJS.ProcessEnv;
+    enabled?: boolean;
+}
+/**
+ * Configure the AWS SDK's documented, warning-specific switch before loading
+ * the files command and its SDK clients. No other SDK warnings are affected.
+ */
+export declare function configureAwsSdkNodeVersionWarningOutput(options?: AwsSdkWarningOutputOptions): void;
+//# sourceMappingURL=aws-sdk-node-warning-output.d.ts.map

package/dist/lib/aws-sdk-node-warning-output.js

@@ -0,0 +1,22 @@
+import { companyErrorsSdkWarningEnabled } from "./company-errors-sdk-warning-flag.js";
+export const AWS_SDK_NODE_VERSION_WARNING_ENV = "AWS_SDK_JS_NODE_VERSION_SUPPORT_WARNING_DISABLED";
+/**
+ * Configure the AWS SDK's documented, warning-specific switch before loading
+ * the files command and its SDK clients. No other SDK warnings are affected.
+ */
+export function configureAwsSdkNodeVersionWarningOutput(options = {}) {
+    const env = options.env ?? process.env;
+    const argv = options.argv ?? process.argv;
+    const enabled = options.enabled ?? companyErrorsSdkWarningEnabled();
+    if (!enabled)
+        return;
+    const verbose = argv.includes("--verbose");
+    const debug = /^(1|true|yes)$/i.test(env.HQ_DEBUG?.trim() ?? "");
+    if (verbose || debug) {
+        delete env[AWS_SDK_NODE_VERSION_WARNING_ENV];
+    }
+    else {
+        env[AWS_SDK_NODE_VERSION_WARNING_ENV] = "true";
+    }
+}
+//# sourceMappingURL=aws-sdk-node-warning-output.js.map