@indigoai-us/hq-cli 5.345.152 → 5.345.154

package/dist/commands/lanes-resume.js

@@ -4,7 +4,7 @@ import { appendCappedHistory, isFailedQuotaKeepAliveLane, providerSessionPortabl
 import { parseCliEffort } from "../lib/lanes/effort.js";
 import { parseOutpostHireGrantContext } from "../lib/lanes/hire-grant-dispatch.js";
 import { assertNoSecretText } from "../lib/lanes/text-scan.js";
-import { laneStories, laneStory, storyWarning } from "../lib/lanes/stories.js";
+import { attributedStoryRow, laneStories, storiesAfterAttribution, storyWarning } from "../lib/lanes/stories.js";
 import { artifactIdentityKeys, rollbackStorySwitchAttribution, storySwitchNotice } from "../lib/lanes/story-switch.js";
 import { markSpawnFailure, spawnLaneWorker } from "../lib/lanes/spawn.js";
 import { appendProjectFocusOverride, removeProjectFocusOverride } from "../lib/lanes/story-ledger.js";
@@ -359,15 +359,13 @@ export function createLaneResumeHandlers(deps) {
                 const already = current.attribution_history.some((entry) => entry.message_id === messageId);
                 if (already)
                     return current;
-                const existingStory = laneStory(current, projectId, storyId);
+                const addedStory = attributedStoryRow(current, projectId, storyId, at);
                 storySwitchRollback = {
                     message_id: messageId,
                     project_id: current.project_id,
                     story_id: current.story_id,
                     no_story_reason: current.no_story_reason,
-                    ...(!existingStory ? {
-                        added_story: { project_id: projectId, story_id: storyId, status: "in_progress", added_at: at, updated_at: at },
-                    } : {}),
+                    ...(addedStory ? { added_story: addedStory } : {}),
                     story_switch_unacknowledged: current.story_switch_unacknowledged,
                 };
                 return {
@@ -375,12 +373,7 @@ export function createLaneResumeHandlers(deps) {
                     project_id: projectId,
                     story_id: storyId,
                     no_story_reason: storyId ? undefined : current.no_story_reason,
-                    stories: laneStory(current, projectId, storyId)
-                        ? laneStories(current)
-                        : [
-                            ...laneStories(current),
-                            { project_id: projectId, story_id: storyId, status: "in_progress", added_at: at, updated_at: at },
-                        ],
+                    stories: storiesAfterAttribution(current, projectId, storyId, at),
                     attribution_history: appendCappedHistory(current.attribution_history, {
                         project_id: projectId,
                         story_id: storyId,

package/dist/commands/lanes-stories.js

@@ -44,6 +44,9 @@ export function createLaneStoryHandlers(deps) {
         };
     }
     function addCarriedStory(lane, projectId, storyId, at) {
+        if (!storyId.trim()) {
+            throw new LanesError("missing_story", "A story id is required to add a story to a lane", { lane_id: lane.lane_id });
+        }
         if (laneStory(lane, projectId, storyId)) {
             throw new LanesError("story_already_on_lane", `Story ${projectId}/${storyId} is already carried by lane ${lane.lane_id}`, {
                 lane_id: lane.lane_id,

package/dist/commands/lanes.js

@@ -7801,7 +7801,13 @@ async function selectAutomaticClaudeResumeAccount(ctx, lane, workerProfile, opti
         accountModel: lane.account === undefined ? undefined : config.providers.claude.accounts[lane.account]?.model,
         providerModel: config.providers.claude.model,
     });
-    const mayRebalance = BALANCE_MOVABLE_STATES.includes(lane.state);
+    // An account the operator chose with --account (account_source "cli") is a
+    // pin, not a balancing hint. Plain resumes and messages keep it; only a repair
+    // of an unusable account may move the lane, and only an explicit --account
+    // may pick another healthy account. Rebalancing a pinned lane moved company
+    // lanes onto another company's account (feedback_4a563e61).
+    const cliAccountPin = lane.account !== undefined && lane.account_source === "cli";
+    const mayRebalance = !cliAccountPin && BALANCE_MOVABLE_STATES.includes(lane.state);
     if (!accountNeedsRepair && !mayRebalance)
         return undefined;
     const balanceHosts = await loadClaudeBalanceHostSnapshots(ctx, hqRoot, config, {

package/dist/commands/run.js

@@ -149,11 +149,20 @@ export function registerRunCommand(program) {
             // error instead of hanging on varlock's never-settling promise, in case
             // the shape-dependent guard above ever silently degrades.
             await resolveEnvValuesOrThrow(graph);
-            const schemaErrors = Object.entries(graph.configSchema)
-                .filter(([, item]) => item.errors?.length > 0);
-            if (schemaErrors.length > 0) {
-                const msgs = schemaErrors.flatMap(([k, item]) => item.errors.map((e) => `  ${k}: ${e.message ?? String(e)}`));
-                process.stderr.write(`Error: failed to resolve env vars:\n${msgs.join('\n')}\n`);
+            // varlock's item.errors includes warning-severity entries (isWarning),
+            // e.g. "Value is very short! Is it actually sensitive?" for a short
+            // sensitive value. Print those and carry on; only real errors are fatal.
+            const schemaItems = Object.entries(graph.configSchema);
+            const itemMessages = (wantWarnings) => schemaItems.flatMap(([k, item]) => (item.errors ?? [])
+                .filter((e) => Boolean(e?.isWarning) === wantWarnings)
+                .map((e) => `  ${k}: ${e?.message ?? String(e)}`));
+            const warningMsgs = itemMessages(true);
+            if (warningMsgs.length > 0) {
+                process.stderr.write(`Warning: env var checks reported warnings:\n${warningMsgs.join('\n')}\n`);
+            }
+            const errorMsgs = itemMessages(false);
+            if (errorMsgs.length > 0) {
+                process.stderr.write(`Error: failed to resolve env vars:\n${errorMsgs.join('\n')}\n`);
                 process.exit(1);
             }
             const resolvedEnv = graph.getResolvedEnvObject();

package/dist/lib/agent-kit/adopt-identity.d.ts

@@ -12,7 +12,11 @@
  *
  * So before any `hq agent` subcommand runs, the resolved tree is published to
  * the environment. An explicit `HQ_MACHINE_CREDS_FILE` is never overwritten —
- * a daemon unit that pins one stays pinned.
+ * a daemon unit that pins one stays pinned. A pinned creds file still gets its
+ * own token cache (beside the creds file) when `HQ_MACHINE_TOKEN_STATE_DIR` is
+ * unset, so an agent's minted tokens never land in the shared default cache
+ * at ~/.hq/work-mesh/daemon, where the deploy resolver on a person's laptop
+ * would read them as machine mode.
  *
  * The person's own session file is not read, moved, or changed by any of this.
  */
@@ -24,4 +28,6 @@ export declare const MACHINE_TOKEN_STATE_DIR_ENV = "HQ_MACHINE_TOKEN_STATE_DIR";
  * Returns the variables it set, for tests and for `--verbose` output.
  */
 export declare function adoptAgentIdentityEnv(paths: Pick<AgentKitPaths, "agentDir" | "machineCredsPath">, env?: NodeJS.ProcessEnv): Record<string, string>;
+/** The agent's own minted-token cache directory, inside its tree. */
+export declare function agentTokenStateDir(paths: Pick<AgentKitPaths, "agentDir">): string;
 //# sourceMappingURL=adopt-identity.d.ts.map

package/dist/lib/agent-kit/adopt-identity.js

@@ -12,7 +12,11 @@
  *
  * So before any `hq agent` subcommand runs, the resolved tree is published to
  * the environment. An explicit `HQ_MACHINE_CREDS_FILE` is never overwritten —
- * a daemon unit that pins one stays pinned.
+ * a daemon unit that pins one stays pinned. A pinned creds file still gets its
+ * own token cache (beside the creds file) when `HQ_MACHINE_TOKEN_STATE_DIR` is
+ * unset, so an agent's minted tokens never land in the shared default cache
+ * at ~/.hq/work-mesh/daemon, where the deploy resolver on a person's laptop
+ * would read them as machine mode.
  *
  * The person's own session file is not read, moved, or changed by any of this.
  */
@@ -27,8 +31,15 @@ export const MACHINE_TOKEN_STATE_DIR_ENV = "HQ_MACHINE_TOKEN_STATE_DIR";
  */
 export function adoptAgentIdentityEnv(paths, env = process.env) {
     const applied = {};
-    if (env[MACHINE_CREDS_FILE_ENV]?.trim())
+    const pinnedCreds = env[MACHINE_CREDS_FILE_ENV]?.trim();
+    if (pinnedCreds) {
+        if (!env[MACHINE_TOKEN_STATE_DIR_ENV]?.trim()) {
+            const dir = path.join(path.dirname(pinnedCreds), "token-state");
+            applied[MACHINE_TOKEN_STATE_DIR_ENV] = dir;
+            env[MACHINE_TOKEN_STATE_DIR_ENV] = dir;
+        }
         return applied;
+    }
     // Only adopt a tree that actually holds an identity: on a host that has not
     // enrolled yet, leaving the environment alone keeps today's error messages.
     try {
@@ -51,10 +62,14 @@ export function adoptAgentIdentityEnv(paths, env = process.env) {
     // Per-agent token cache. Two identities on one computer must never share a
     // minted-token file; the agent's belongs inside the agent's own tree.
     if (!env[MACHINE_TOKEN_STATE_DIR_ENV]?.trim()) {
-        const dir = path.join(paths.agentDir, "token-state");
+        const dir = agentTokenStateDir(paths);
         applied[MACHINE_TOKEN_STATE_DIR_ENV] = dir;
         env[MACHINE_TOKEN_STATE_DIR_ENV] = dir;
     }
     return applied;
 }
+/** The agent's own minted-token cache directory, inside its tree. */
+export function agentTokenStateDir(paths) {
+    return path.join(paths.agentDir, "token-state");
+}
 //# sourceMappingURL=adopt-identity.js.map

package/dist/lib/agent-kit/services.d.ts

@@ -12,7 +12,9 @@ export declare function isKitService(value: string): value is KitService;
  * Environment every service inherits. HQ_MACHINE_CREDS_FILE pins hq-cloud's
  * mint to the kit's creds file; HQ_REQUIRE_MACHINE_IDENTITY makes a missing
  * file a loud error instead of a browser-login hang; HQ_AGENT_DIR keeps a
- * relocated kit consistent across restarts.
+ * relocated kit consistent across restarts. HQ_MACHINE_TOKEN_STATE_DIR keeps
+ * the agent's minted tokens in its own tree instead of the shared default
+ * cache a person's tools also read.
  */
 export declare function kitServiceEnv(paths: AgentKitPaths, env?: NodeJS.ProcessEnv): Record<string, string>;
 export declare function kitServiceSpec(service: KitService, paths: AgentKitPaths, env?: NodeJS.ProcessEnv): ServiceSpec;

package/dist/lib/agent-kit/services.js

@@ -4,6 +4,7 @@
  * machine-creds file itself, so the units carry paths and nothing else.
  */
 import { serviceLogPath } from "./paths.js";
+import { agentTokenStateDir } from "./adopt-identity.js";
 export const KIT_SERVICES = ["sync", "inbox", "heartbeat"];
 const KIT_LABEL_PREFIX = "ai.getindigo.hq-agent";
 export function isKitService(value) {
@@ -18,13 +19,16 @@ const DESCRIPTIONS = {
  * Environment every service inherits. HQ_MACHINE_CREDS_FILE pins hq-cloud's
  * mint to the kit's creds file; HQ_REQUIRE_MACHINE_IDENTITY makes a missing
  * file a loud error instead of a browser-login hang; HQ_AGENT_DIR keeps a
- * relocated kit consistent across restarts.
+ * relocated kit consistent across restarts. HQ_MACHINE_TOKEN_STATE_DIR keeps
+ * the agent's minted tokens in its own tree instead of the shared default
+ * cache a person's tools also read.
  */
 export function kitServiceEnv(paths, env = process.env) {
     const flagsApiUrl = env.HQ_FLAGS_API_URL;
     return {
         HQ_AGENT_DIR: paths.agentDir,
         HQ_MACHINE_CREDS_FILE: paths.machineCredsPath,
+        HQ_MACHINE_TOKEN_STATE_DIR: agentTokenStateDir(paths),
         HQ_REQUIRE_MACHINE_IDENTITY: "1",
         ...(flagsApiUrl?.trim() ? { HQ_FLAGS_API_URL: flagsApiUrl } : {}),
     };

package/dist/lib/daemon/ops/policy.d.ts

@@ -11,7 +11,11 @@
  *
  * The policy index (which policy files exist for a company) is cached
  * in-process and invalidated by fs.watch on core/policies, personal/policies
- * and companies/<co>/policies.
+ * and companies/<co>/policies. Each list() also compares the scanned
+ * directories' stat stamps with those taken during the last rebuild, because
+ * a watcher can miss a change: on macOS fs.watch is backed by an FSEvents
+ * stream that starts asynchronously, so a change made right after a rebuild
+ * re-arms the watchers is never reported.
  */
 export declare const SCOPE_AUTHORIZER = ".claude/hooks/mandatory-scope-authorizer.sh";
 export declare const POLICY_TRIGGER = ".claude/hooks/inject-policy-on-trigger.sh";
@@ -30,6 +34,8 @@ export declare class PolicyIndex {
     readonly hqRoot: string;
     private readonly log;
     private entries;
+    /** Directory stat stamps taken while building `entries` (dir -> stamp). */
+    private stamps;
     private watchers;
     private closed;
     /** Bumped on every invalidation; lets callers see that the cache was rebuilt. */
@@ -39,6 +45,8 @@ export declare class PolicyIndex {
     list(company?: string): PolicyEntry[];
     invalidate(): void;
     close(): void;
+    /** True when any directory scanned by the last rebuild changed since. */
+    private isStale;
     private rebuild;
     private rewatch;
 }

package/dist/lib/daemon/ops/policy.js

@@ -11,7 +11,11 @@
  *
  * The policy index (which policy files exist for a company) is cached
  * in-process and invalidated by fs.watch on core/policies, personal/policies
- * and companies/<co>/policies.
+ * and companies/<co>/policies. Each list() also compares the scanned
+ * directories' stat stamps with those taken during the last rebuild, because
+ * a watcher can miss a change: on macOS fs.watch is backed by an FSEvents
+ * stream that starts asynchronously, so a change made right after a rebuild
+ * re-arms the watchers is never reported.
  */
 import { spawn } from "node:child_process";
 import * as fs from "node:fs";
@@ -33,6 +37,8 @@ export class PolicyIndex {
     hqRoot;
     log;
     entries = null;
+    /** Directory stat stamps taken while building `entries` (dir -> stamp). */
+    stamps = new Map();
     watchers = [];
     closed = false;
     /** Bumped on every invalidation; lets callers see that the cache was rebuilt. */
@@ -43,6 +49,8 @@ export class PolicyIndex {
     }
     /** Policies visible to `company`: core, personal, and that company only. */
     list(company) {
+        if (this.entries && this.isStale())
+            this.invalidate();
         if (!this.entries)
             this.rebuild();
         return this.entries.filter((e) => e.scope !== "company" || e.company === company);
@@ -59,22 +67,38 @@ export class PolicyIndex {
             w.close();
         this.watchers = [];
     }
+    /** True when any directory scanned by the last rebuild changed since. */
+    isStale() {
+        for (const [dir, stamp] of this.stamps)
+            if (dirStamp(dir) !== stamp)
+                return true;
+        return false;
+    }
     rebuild() {
+        // Stamp each directory before reading it, so a change racing the read
+        // either shows up in the read or leaves a stale stamp for the next list().
+        const stamps = new Map();
         const dirs = [
             { dir: path.join(this.hqRoot, "core", "policies"), scope: "core" },
             { dir: path.join(this.hqRoot, "personal", "policies"), scope: "personal" },
         ];
         const companiesDir = path.join(this.hqRoot, "companies");
         const companyDirs = [];
+        for (const d of dirs)
+            stamps.set(d.dir, dirStamp(d.dir));
+        stamps.set(companiesDir, dirStamp(companiesDir));
         for (const co of readDirNames(companiesDir)) {
             if (!SLUG_RE.test(co))
                 continue;
             const companyDir = path.join(companiesDir, co);
+            stamps.set(companyDir, dirStamp(companyDir));
             if (isDir(companyDir))
                 companyDirs.push(companyDir);
             const dir = path.join(companiesDir, co, "policies");
-            if (isDir(dir))
+            if (isDir(dir)) {
+                stamps.set(dir, dirStamp(dir));
                 dirs.push({ dir, scope: "company", company: co });
+            }
         }
         const entries = [];
         for (const d of dirs) {
@@ -85,6 +109,7 @@ export class PolicyIndex {
             }
         }
         this.entries = entries;
+        this.stamps = stamps;
         this.rewatch([...dirs.map((d) => d.dir), ...companyDirs, companiesDir]);
     }
     rewatch(dirs) {
@@ -120,6 +145,16 @@ function readDirNames(dir) {
         throw err;
     }
 }
+/** Identity plus modification time of a directory, or "missing". */
+function dirStamp(dir) {
+    try {
+        const st = fs.statSync(dir, { bigint: true });
+        return `${st.dev}:${st.ino}:${st.mtimeNs}`;
+    }
+    catch {
+        return "missing";
+    }
+}
 function isDir(dir) {
     try {
         return fs.statSync(dir).isDirectory();

package/dist/lib/decisions/client.d.ts

@@ -0,0 +1,67 @@
+import { vaultApiFetch } from "../../utils/vault-api.js";
+export type DecisionState = "open" | "talking" | "answered" | "expired" | "withdrawn";
+export interface DecisionOption {
+    id: string;
+    label: string;
+    recommended: boolean;
+}
+export interface Decision {
+    id: string;
+    askerPrincipal: string;
+    companyUid: string;
+    audience: {
+        kind: "person";
+        personUid: string;
+    } | {
+        kind: "company_admins";
+    };
+    statement: string;
+    options: DecisionOption[];
+    context: {
+        links: string[];
+        brief: string;
+        commitmentId: string | null;
+    };
+    state: DecisionState;
+    answer: {
+        choiceId: string;
+        by: string;
+        at: string;
+        source: "tap" | "thread" | "desktop";
+    } | null;
+    talkThreadId: string | null;
+    createdAt: string;
+    expiresAt: string;
+    updatedAt: string;
+}
+export interface AskDecision {
+    companyUid: string;
+    expiresAt: string;
+    audience: {
+        kind: "person";
+        personUid: string;
+    };
+    statement: string;
+    options: DecisionOption[];
+    context: Decision["context"];
+}
+export declare class DecisionError extends Error {
+    readonly code: string;
+    readonly status?: number | undefined;
+    constructor(code: string, message: string, status?: number | undefined);
+}
+/** US-001 transport envelopes live here so real producer fixtures replace one boundary. */
+export declare function parseDecision(raw: unknown): Decision;
+export declare function parseOptions(raw: string[], recommend?: string): DecisionOption[];
+export declare class DecisionsClient {
+    private readonly token;
+    private readonly request;
+    constructor(token: () => Promise<string>, request?: typeof vaultApiFetch);
+    private call;
+    ask(input: AskDecision): Promise<Decision>;
+    list(open?: boolean): Promise<Decision[]>;
+    show(id: string): Promise<Decision>;
+    answer(id: string, choiceId: string, source: "desktop" | "thread"): Promise<Decision>;
+    transition(id: string, action: "answer" | "talk" | "withdraw", body?: Record<string, unknown>): Promise<Decision>;
+}
+//# sourceMappingURL=client.d.ts.map

package/dist/lib/decisions/client.js

@@ -0,0 +1,120 @@
+import { vaultApiFetch } from "../../utils/vault-api.js";
+import { assertNoSecretText } from "../lanes/text-scan.js";
+export class DecisionError extends Error {
+    code;
+    status;
+    constructor(code, message, status) {
+        super(`${code}: ${message}`);
+        this.code = code;
+        this.status = status;
+    }
+}
+function object(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        throw new DecisionError("invalid_decision_response", "Expected an object");
+    return value;
+}
+function string(value) {
+    if (typeof value !== "string" || !value.trim())
+        throw new DecisionError("invalid_decision_response", "Expected a non-empty string");
+    return value;
+}
+/** US-001 transport envelopes live here so real producer fixtures replace one boundary. */
+export function parseDecision(raw) {
+    const row = object(raw);
+    const context = object(row.context);
+    const audience = object(row.audience);
+    if (audience.kind !== "person" && audience.kind !== "company_admins")
+        throw new DecisionError("invalid_decision_response", "Unknown audience kind");
+    if (!Array.isArray(row.options) || !Array.isArray(context.links))
+        throw new DecisionError("invalid_decision_response", "Expected options and context.links arrays");
+    const state = string(row.state);
+    if (!["open", "talking", "answered", "expired", "withdrawn"].includes(state))
+        throw new DecisionError("invalid_decision_response", "Unknown state");
+    const options = row.options.map(rawOption => {
+        const option = object(rawOption);
+        if (typeof option.recommended !== "boolean")
+            throw new DecisionError("invalid_decision_response", "Expected recommended boolean");
+        return { id: string(option.id), label: string(option.label), recommended: option.recommended };
+    });
+    if (new Set(options.map(option => option.id)).size !== options.length)
+        throw new DecisionError("invalid_decision_response", "Duplicate option ids");
+    if (typeof context.brief !== "string")
+        throw new DecisionError("invalid_decision_response", "Expected context brief");
+    if (context.commitmentId !== null && typeof context.commitmentId !== "string")
+        throw new DecisionError("invalid_decision_response", "Expected nullable commitment id");
+    const answer = row.answer == null ? row.answer : object(row.answer);
+    if (answer && !["tap", "thread", "desktop"].includes(string(answer.source)))
+        throw new DecisionError("invalid_decision_response", "Unknown answer source");
+    return {
+        id: string(row.id), askerPrincipal: string(row.askerPrincipal), companyUid: string(row.companyUid),
+        audience: audience.kind === "person" ? { kind: "person", personUid: string(audience.personUid) } : { kind: "company_admins" },
+        statement: string(row.statement), options, state,
+        context: { links: context.links.map(string), brief: context.brief, commitmentId: context.commitmentId },
+        ...(answer == null ? { answer: null } : { answer: { choiceId: string(answer.choiceId), by: string(answer.by), at: string(answer.at), source: answer.source } }),
+        ...(row.talkThreadId == null ? { talkThreadId: null } : { talkThreadId: string(row.talkThreadId) }),
+        createdAt: string(row.createdAt), updatedAt: string(row.updatedAt),
+        expiresAt: string(row.expiresAt),
+    };
+}
+export function parseOptions(raw, recommend) {
+    if (raw.length < 2)
+        throw new DecisionError("invalid_options", "Supply at least two --option 'id|label' choices");
+    const options = raw.map(value => {
+        const index = value.indexOf("|");
+        const id = value.slice(0, index).trim();
+        const label = value.slice(index + 1).trim();
+        if (index < 1 || !/^[A-Za-z0-9_-]+$/.test(id) || !label)
+            throw new DecisionError("invalid_options", "Each option must be id|label");
+        return { id, label, recommended: id === recommend };
+    });
+    if (new Set(options.map(option => option.id)).size !== options.length || (recommend !== undefined && !options.some(option => option.id === recommend))) {
+        throw new DecisionError("invalid_options", "Option ids must be unique and --recommend must name one");
+    }
+    return options;
+}
+export class DecisionsClient {
+    token;
+    request;
+    constructor(token, request = vaultApiFetch) {
+        this.token = token;
+        this.request = request;
+    }
+    async call(path, method = "GET", body, query) {
+        const response = await this.request({ token: await this.token(), path, method, body, query, signal: AbortSignal.timeout(30_000) });
+        if (!response.ok) {
+            // Do not echo arbitrary server bodies (which may contain confidential input).
+            const codes = new Set(["invalid_decision", "invalid_answer", "invalid_expiry", "invalid_audience", "invalid_state", "invalid_json", "invalid_audience_filter", "asker_not_allowed", "company_forbidden", "agent_owner_only", "agent_owner_required", "decision_not_found", "already_answered", "decision_expired", "decision_withdrawn", "decision_closed", "decision_conflict", "route_not_found"]);
+            const payload = await response.json().catch(() => null);
+            const code = typeof payload?.code === "string" && codes.has(payload.code) ? payload.code : "decision_request_failed";
+            throw new DecisionError(code, `${method} ${path} returned ${response.status}`, response.status);
+        }
+        return object(await response.json());
+    }
+    async ask(input) {
+        assertNoSecretText("decision", JSON.stringify(input));
+        return parseDecision((await this.call("/v1/decisions", "POST", { ...input })).decision);
+    }
+    async list(open = false) {
+        const result = await this.call("/v1/decisions", "GET", undefined, { for: "me", ...(open ? { state: "open" } : {}) });
+        if (!Array.isArray(result.decisions))
+            throw new DecisionError("invalid_decision_response", "Expected decisions array");
+        return result.decisions.map(parseDecision).sort((a, b) => a.createdAt.localeCompare(b.createdAt));
+    }
+    async show(id) {
+        // US-001 has no GET-by-id route. Use the authorised across-company list.
+        const record = (await this.list()).find(decision => decision.id === id);
+        if (!record)
+            throw new DecisionError("decision_not_found", `Decision ${id} is not visible to this principal`);
+        return record;
+    }
+    async answer(id, choiceId, source) {
+        return this.transition(id, "answer", { choiceId, source });
+    }
+    async transition(id, action, body = {}) {
+        if (!id.trim())
+            throw new DecisionError("invalid_decision_id", "Decision id is required");
+        return parseDecision((await this.call(`/v1/decisions/${encodeURIComponent(id)}/${action}`, "POST", body)).decision);
+    }
+}
+//# sourceMappingURL=client.js.map

package/dist/lib/decisions/expiry.d.ts

@@ -0,0 +1,2 @@
+export declare function decisionExpiry(value?: string, now?: number): string;
+//# sourceMappingURL=expiry.d.ts.map

package/dist/lib/decisions/expiry.js

@@ -0,0 +1,12 @@
+import { DecisionError } from "./client.js";
+export function decisionExpiry(value = "72h", now = Date.now()) {
+    const duration = /^(\d+(?:\.\d+)?)(m|h|d)$/.exec(value);
+    const timestamp = duration
+        ? now + Number(duration[1]) * ({ m: 60_000, h: 3_600_000, d: 86_400_000 }[duration[2]] ?? 0)
+        : /^\d{4}-\d{2}-\d{2}T.*(?:Z|[+-]\d{2}:\d{2})$/.test(value) ? Date.parse(value) : NaN;
+    if (!Number.isFinite(timestamp) || timestamp <= now || timestamp > 8.64e15) {
+        throw new DecisionError("invalid_expiry", "Use a future ISO date-time or positive duration such as 72h");
+    }
+    return new Date(timestamp).toISOString();
+}
+//# sourceMappingURL=expiry.js.map