@indigoai-us/hq-cli 5.345.155 → 5.345.159

package/dist/lib/hook-engine/resolve.js

@@ -84,9 +84,13 @@ export function installHookEngine(options = {}) {
     if (!existsSync(engine.pinnedDirectory)) {
         const stage = mkdtempSync(join(dirname(engine.pinnedDirectory), '.install-'));
         try {
-            cpSync(engine.sourceDirectory, stage, { recursive: true, errorOnExist: true, force: false });
+            // Copy into a path that does not exist yet. Node 24.22 rejects an
+            // existing destination directory (such as the mkdtemp stage itself)
+            // with ERR_FS_CP_EEXIST when errorOnExist is set.
+            const payload = join(stage, 'engine');
+            cpSync(engine.sourceDirectory, payload, { recursive: true, errorOnExist: true, force: false });
             try {
-                renameSync(stage, engine.pinnedDirectory);
+                renameSync(payload, engine.pinnedDirectory);
             }
             catch (error) {
                 if (!existsSync(engine.pinned))

package/dist/lib/index-render/company-knowledge.d.ts

@@ -1,3 +1,3 @@
 import { RenderContext, RenderResult } from "./shared.js";
-export declare function renderCompanyKnowledge(context: RenderContext): RenderResult;
+export declare function renderCompanyKnowledge(context: RenderContext, selectedCompany?: string): RenderResult;
 //# sourceMappingURL=company-knowledge.d.ts.map

package/dist/lib/index-render/company-knowledge.js

@@ -1,5 +1,5 @@
 import * as fs from "fs";
-import { at, basename, date, extractKeepFences, generatedFingerprint, generatedStamp, hasUnclosedKeepMarker, heading, immediateEntries, isHidden, log, looksAutoGenerated, readJson, readText, sanitize, stampGenerated, titleize, truncate, write, } from "./shared.js";
+import { at, basename, date, extractKeepFences, generatedFingerprint, generatedStamp, hasUnclosedKeepMarker, heading, immediateEntries, isHidden, log, readJson, readText, sanitize, stampGenerated, titleize, truncate, write, } from "./shared.js";
 function describe(item) {
     const name = basename(item);
     try {
@@ -65,16 +65,15 @@ function shouldOverwrite(context, existing, next) {
         return "write";
     if (stored)
         return "refuse";
-    if (looksAutoGenerated(existing))
-        return "write";
     if (generatedFingerprint(existing) === generatedFingerprint(next))
         return "write";
     return "refuse";
 }
-export function renderCompanyKnowledge(context) {
+export function renderCompanyKnowledge(context, selectedCompany) {
     const written = [];
     let refused = 0;
-    for (const companyDir of immediateEntries(context.root, "companies", "dir")) {
+    const companies = selectedCompany === undefined ? immediateEntries(context.root, "companies", "dir") : [at(context.root, `companies/${selectedCompany}`)];
+    for (const companyDir of companies) {
         const company = basename(companyDir);
         if (company.startsWith("_") || isHidden(company))
             continue;

package/dist/lib/index-render/index.js

@@ -1,4 +1,6 @@
-import { renderCompanies } from "./companies.js";
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { CompanyIndexUserError, renderCompanies } from "./companies.js";
 import { renderCompanyKnowledge } from "./company-knowledge.js";
 import { renderOrchestrator } from "./orchestrator.js";
 import { renderProjects } from "./projects.js";
@@ -8,12 +10,51 @@ import { renderSocialDrafts } from "./social-drafts.js";
 import { renderThreads } from "./threads.js";
 import { renderWorkers } from "./workers.js";
 const allOrder = ["threads", "orchestrator", "companies", "projects", "company-knowledge", "public-knowledge", "workers", "reports", "social-drafts"];
+function companyScope(target, context, args) {
+    let company;
+    for (let i = 0; i < args.length; i += 1) {
+        let value = args[i];
+        if (value === "--company")
+            value = args[++i] ?? "";
+        else if (value.startsWith("--company="))
+            value = value.slice("--company=".length);
+        if (!value || value.startsWith("-"))
+            throw new CompanyIndexUserError(`rebuild-index ${target}: expected a company slug; unknown or incomplete option`);
+        if (company !== undefined)
+            throw new CompanyIndexUserError(`rebuild-index ${target}: supply only one company slug`);
+        if (!/^[a-zA-Z0-9][a-zA-Z0-9_-]*$/.test(value))
+            throw new CompanyIndexUserError(`rebuild-index ${target}: invalid company slug`);
+        company = value;
+    }
+    if (company !== undefined) {
+        const directory = path.join(context.root, "companies", company);
+        try {
+            if (!fs.lstatSync(directory).isDirectory())
+                throw new CompanyIndexUserError(`rebuild-index ${target}: company must be a real directory`);
+            const contentDirectory = path.join(directory, target === "projects" ? "projects" : "knowledge");
+            if (fs.existsSync(contentDirectory) && !fs.lstatSync(contentDirectory).isDirectory())
+                throw new CompanyIndexUserError(`rebuild-index ${target}: content must be a real directory`);
+        }
+        catch (error) {
+            if (error.code === "ENOENT")
+                throw new CompanyIndexUserError(`rebuild-index ${target}: no company directory named "${company}"`);
+            throw error;
+        }
+    }
+    return company;
+}
 export function renderIndexTarget(target, context, args = []) {
+    if (target === "company-knowledge" || target === "projects") {
+        if (args.some((arg) => arg === "--help" || arg === "-h")) {
+            (context.output ?? ((message) => process.stdout.write(message)))(`Usage: hq core rebuild-index ${target} [<company> | --company <company>] [--accept]\n\nWith a company, rebuild only that company's index. Without a company, retain the all-company rebuild. Help performs no writes.\n`);
+            return { written: [] };
+        }
+        const company = companyScope(target, context, args);
+        return target === "projects" ? renderProjects(context, company) : renderCompanyKnowledge(context, company);
+    }
     switch (target) {
         case "companies": return renderCompanies(context, args);
-        case "company-knowledge": return renderCompanyKnowledge(context);
         case "orchestrator": return renderOrchestrator(context);
-        case "projects": return renderProjects(context);
         case "public-knowledge": return renderPublicKnowledge(context);
         case "reports": return renderReports(context);
         case "social-drafts": return renderSocialDrafts(context);

package/dist/lib/index-render/projects.d.ts

@@ -1,3 +1,3 @@
 import { RenderContext, RenderResult } from "./shared.js";
-export declare function renderProjects(context: RenderContext): RenderResult;
+export declare function renderProjects(context: RenderContext, selectedCompany?: string): RenderResult;
 //# sourceMappingURL=projects.d.ts.map

package/dist/lib/index-render/projects.js

@@ -1,6 +1,6 @@
 import * as fs from "fs";
 import * as path from "path";
-import { at, basename, date, exists, extractKeepFences, generatedFingerprint, generatedStamp, hasUnclosedKeepMarker, immediateEntries, isHidden, log, looksAutoGenerated, projectStatus, readJson, readText, sanitize, stampGenerated, titleize, truncate, write, } from "./shared.js";
+import { at, basename, date, exists, extractKeepFences, generatedFingerprint, generatedStamp, hasUnclosedKeepMarker, immediateEntries, isHidden, log, projectStatus, readJson, readText, sanitize, stampGenerated, titleize, truncate, write, } from "./shared.js";
 function composeCompanyProjectsIndex(raw, existing) {
     const stamped = stampGenerated(raw);
     const fences = existing === undefined ? "" : extractKeepFences(existing);
@@ -20,8 +20,6 @@ function shouldOverwriteCompanyProjectsIndex(context, existing, next) {
         return "write";
     if (stored)
         return "refuse";
-    if (looksAutoGenerated(existing))
-        return "write";
     if (generatedFingerprint(existing) === generatedFingerprint(next))
         return "write";
     return "refuse";
@@ -64,9 +62,9 @@ function renderCompanyProjects(context, company, projectRoot) {
     log(context, `rebuild-projects-index: wrote ${output}`);
     return written;
 }
-export function renderProjects(context) {
+export function renderProjects(context, selectedCompany) {
     const written = [];
-    const companyDirectories = immediateEntries(context.root, "companies", "dir");
+    const companyDirectories = selectedCompany === undefined ? immediateEntries(context.root, "companies", "dir") : [at(context.root, `companies/${selectedCompany}`)];
     for (const companyDirectory of companyDirectories) {
         const company = basename(companyDirectory);
         if (company.startsWith("_") || isHidden(company))
@@ -76,6 +74,8 @@ export function renderProjects(context) {
             written.push(...renderCompanyProjects(context, company, projectRoot));
         }
     }
+    if (selectedCompany !== undefined)
+        return { written };
     const base = "personal/projects";
     if (!exists(context.root, base)) {
         log(context, "rebuild-projects-index: personal/projects/ missing, skipping");

package/dist/lib/lanes/account-company.d.ts

@@ -0,0 +1,28 @@
+import { LanesError } from "./errors.js";
+import type { AccountConfig, LaneCompanyRef } from "./types.js";
+type ProviderAccounts = Record<string, AccountConfig | undefined>;
+/**
+ * Company enforcement is opt-in per provider: it begins once any account for
+ * that provider carries a `company` tag. Until then every account stays open
+ * to every lane, so existing installs keep creating company lanes after upgrade.
+ */
+export declare function companyEnforcementActive(providerAccounts: ProviderAccounts | undefined): boolean;
+/**
+ * Account ownership is explicit; names and homes never imply a tenant.
+ * Pass the provider's account map to apply the opt-in rule above.
+ */
+export declare function accountMatchesCompany(account: AccountConfig | undefined, company: LaneCompanyRef | null, providerAccounts?: ProviderAccounts): boolean;
+/** Legacy untagged accounts may retain an existing lane, never acquire one. */
+export declare function accountMayRetainLane(account: AccountConfig | undefined, company: LaneCompanyRef | null, providerAccounts?: ProviderAccounts): boolean;
+/**
+ * When enforcement is active and every enabled candidate was excluded only by
+ * company ownership, name the problem instead of reporting no enabled account.
+ */
+export declare function companyMismatchError(input: {
+    provider: string;
+    providerAccounts: ProviderAccounts;
+    candidates: readonly string[];
+    company: LaneCompanyRef | null;
+}): LanesError | undefined;
+export {};
+//# sourceMappingURL=account-company.d.ts.map

package/dist/lib/lanes/account-company.js

@@ -0,0 +1,53 @@
+import { LanesError } from "./errors.js";
+/**
+ * Company enforcement is opt-in per provider: it begins once any account for
+ * that provider carries a `company` tag. Until then every account stays open
+ * to every lane, so existing installs keep creating company lanes after upgrade.
+ */
+export function companyEnforcementActive(providerAccounts) {
+    if (providerAccounts === undefined)
+        return true;
+    return Object.values(providerAccounts).some((account) => account?.company !== undefined);
+}
+/**
+ * Account ownership is explicit; names and homes never imply a tenant.
+ * Pass the provider's account map to apply the opt-in rule above.
+ */
+export function accountMatchesCompany(account, company, providerAccounts) {
+    if (account === undefined)
+        return false;
+    if (providerAccounts !== undefined && !companyEnforcementActive(providerAccounts))
+        return true;
+    if (company === null)
+        return account.company === undefined;
+    return account.company === company.uid || account.company === company.slug;
+}
+/** Legacy untagged accounts may retain an existing lane, never acquire one. */
+export function accountMayRetainLane(account, company, providerAccounts) {
+    return account !== undefined && (account.company === undefined || accountMatchesCompany(account, company, providerAccounts));
+}
+/**
+ * When enforcement is active and every enabled candidate was excluded only by
+ * company ownership, name the problem instead of reporting no enabled account.
+ */
+export function companyMismatchError(input) {
+    if (!companyEnforcementActive(input.providerAccounts))
+        return undefined;
+    const enabled = input.candidates.filter((id) => input.providerAccounts[id]?.enabled === true);
+    if (enabled.length === 0)
+        return undefined;
+    if (enabled.some((id) => accountMatchesCompany(input.providerAccounts[id], input.company, input.providerAccounts)))
+        return undefined;
+    const companyLabel = input.company === null ? "(no company)" : input.company.slug;
+    const excluded = enabled.map((id) => ({ account: id, company: input.providerAccounts[id]?.company ?? null }));
+    return new LanesError("account_company_mismatch", `No enabled ${input.provider} account belongs to lane company ${companyLabel}. ` +
+        `Excluded for company: ${excluded.map((row) => `${row.account} (${row.company ?? "untagged"})`).join(", ")}. ` +
+        `Set "company" on an account under providers.${input.provider}.accounts in personal/lanes/config.json.`, {
+        provider: input.provider,
+        company: input.company?.slug ?? null,
+        excluded_accounts: excluded,
+        config_key: `providers.${input.provider}.accounts.<id>.company`,
+        config_file: "personal/lanes/config.json",
+    });
+}
+//# sourceMappingURL=account-company.js.map

package/dist/lib/lanes/accounts.d.ts

@@ -4,11 +4,15 @@
  * Naming an account and omitting one mean different things: an explicit
  * disabled id is refused; omitting picks the least-loaded eligible account.
  * Status reports `configured` and `logged_in` separately. logged_in is
- * derived from credential-file existence or a provider status command; this
- * module never reads, prints, copies, or hashes credential files.
+ * derived from credential-file existence or a provider status command. For
+ * Claude, an injected `readClaudeCredential` also checks the access-token
+ * expiry of the credential the worker will use (see claude-credential.ts), so
+ * an expired sign-in reports `logged_in: false` with `sign_in_state: "expired"`.
+ * This module never prints, copies, or hashes credentials.
  */
 import { type LaneRecord, type LaneProvider } from "./types.js";
 import type { LanesConfig } from "./types.js";
+import type { ClaudeCredentialReader, ClaudeTokenState } from "./claude-credential.js";
 export declare const PROVIDER_HOME_ENV: Record<LaneProvider, string>;
 /**
  * Claude Code keys its OS keychain credential by `CLAUDE_CONFIG_DIR`: with
@@ -71,6 +75,12 @@ export interface AccountDeps {
     /** Provider status output is parsed for a boolean only; it is never printed. */
     probe?: (command: string, args: string[], env: NodeJS.ProcessEnv) => AccountStatusProbeResult;
     env?: NodeJS.ProcessEnv;
+    /**
+     * Reads the access-token expiry of the Claude credential the worker uses.
+     * Production callers pass readLaneClaudeCredential; omitted, expiry is not
+     * checked and logged_in keeps the presence-only result.
+     */
+    readClaudeCredential?: ClaudeCredentialReader;
 }
 export interface AccountResolveContext {
     hqRoot?: string;
@@ -110,9 +120,16 @@ export interface AccountStatus {
     disabled_reason?: string;
     /** Present in personal/lanes/config.json. */
     configured: boolean;
-    /** True/false comes from file existence or the provider status command. */
+    /**
+     * True/false comes from file existence or the provider status command.
+     * For Claude, an expired access token forces false.
+     */
     logged_in: boolean | null;
     auth_state: AuthState;
+    /** Claude only, when the credential was read: whether its access token is still valid. */
+    sign_in_state?: ClaudeTokenState;
+    /** Claude only: when the access token expires, if the credential records it. */
+    sign_in_expires_at?: string | null;
     envVar: string;
 }
 export declare function credentialPaths(provider: LaneProvider, home: string): string[];
@@ -129,6 +146,8 @@ export declare function authStateFor(provider: LaneProvider, present: boolean):
 export declare function loggedInFromAuthState(state: AuthState): boolean | null;
 /** Admission and listing share this: refuse only a conclusive logged-out. */
 export declare function isLoggedOut(status: Pick<AccountStatus, "logged_in">): boolean;
+/** True when the Claude credential exists but its access token has expired. */
+export declare function isSignInExpired(status: Pick<AccountStatus, "sign_in_state">): boolean;
 /** Auto-select requires a positive file or provider-status login result. */
 export declare function isCredentialProven(status: Pick<AccountStatus, "logged_in">): boolean;
 /**

package/dist/lib/lanes/accounts.js

@@ -4,8 +4,11 @@
  * Naming an account and omitting one mean different things: an explicit
  * disabled id is refused; omitting picks the least-loaded eligible account.
  * Status reports `configured` and `logged_in` separately. logged_in is
- * derived from credential-file existence or a provider status command; this
- * module never reads, prints, copies, or hashes credential files.
+ * derived from credential-file existence or a provider status command. For
+ * Claude, an injected `readClaudeCredential` also checks the access-token
+ * expiry of the credential the worker will use (see claude-credential.ts), so
+ * an expired sign-in reports `logged_in: false` with `sign_in_state: "expired"`.
+ * This module never prints, copies, or hashes credentials.
  */
 import * as fs from "node:fs";
 import * as os from "node:os";
@@ -184,6 +187,10 @@ export function loggedInFromAuthState(state) {
 export function isLoggedOut(status) {
     return status.logged_in === false;
 }
+/** True when the Claude credential exists but its access token has expired. */
+export function isSignInExpired(status) {
+    return status.sign_in_state === "expired";
+}
 /** Auto-select requires a positive file or provider-status login result. */
 export function isCredentialProven(status) {
     return status.logged_in === true;
@@ -330,6 +337,9 @@ export function selectBalancedAccount(provider, config, ctx = {}) {
             ...(ctx.accountDeps?.probe ? { probe: ctx.accountDeps.probe } : {}),
             ...(ctx.accountDeps?.env ? { env: ctx.accountDeps.env } : {}),
             ...(ctx.accountDeps?.homedir ? { homedir: ctx.accountDeps.homedir } : {}),
+            ...(ctx.accountDeps?.readClaudeCredential
+                ? { readClaudeCredential: ctx.accountDeps.readClaudeCredential }
+                : {}),
             ...(ctx.hostname !== undefined ? { hostname: ctx.hostname } : {}),
         });
         if (status.logged_in === true)
@@ -434,6 +444,9 @@ export function resolveAccount(provider, requestedId, config, ctx = {}) {
                     probe: ctx.accountDeps.probe,
                     ...(ctx.accountDeps.env ? { env: ctx.accountDeps.env } : {}),
                     ...(ctx.accountDeps.homedir ? { homedir: ctx.accountDeps.homedir } : {}),
+                    ...(ctx.accountDeps.readClaudeCredential
+                        ? { readClaudeCredential: ctx.accountDeps.readClaudeCredential }
+                        : {}),
                     ...(ctx.hostname !== undefined ? { hostname: ctx.hostname } : {}),
                 });
                 throwIfQuotaBlocked(block, provider, requestedId, status.identity);
@@ -469,6 +482,18 @@ export function accountStatus(provider, accountId, config, deps = defaultAccount
     let auth_state = homeExists ? authStateFor(provider, present) : "home_missing";
     let logged_in = homeExists ? loggedInFromAuthState(auth_state) : false;
     let identity;
+    let token;
+    if (homeExists && provider === "claude" && deps.readClaudeCredential !== undefined) {
+        try {
+            token = deps.readClaudeCredential({
+                home: effective.home,
+                defaultHome: isDefaultProviderHome("claude", effective.home, deps.homedir),
+            });
+        }
+        catch {
+            process.stderr.write(`hq lanes: Claude credential expiry check failed for account ${accountId}\n`);
+        }
+    }
     if (homeExists && !present && provider === "claude" && deps.probe !== undefined) {
         try {
             const result = deps.probe("claude", ["auth", "status"], withProviderHomeEnv(deps.env ?? process.env, "claude", effective.home, deps.homedir));
@@ -483,6 +508,13 @@ export function accountStatus(provider, accountId, config, deps = defaultAccount
             process.stderr.write(`hq lanes: Claude auth status probe failed for account ${accountId}\n`);
         }
     }
+    if (token?.state === "expired") {
+        // The credential is there but the worker would start with a dead token.
+        logged_in = false;
+    }
+    else if (token?.state === "valid" && logged_in === null) {
+        logged_in = true;
+    }
     const status = {
         provider,
         id: accountId,
@@ -494,6 +526,10 @@ export function accountStatus(provider, accountId, config, deps = defaultAccount
         auth_state,
         envVar,
     };
+    if (token !== undefined) {
+        status.sign_in_state = token.state;
+        status.sign_in_expires_at = token.expires_at;
+    }
     if (identity)
         status.identity = identity;
     if (account.disabled_reason !== undefined) {

package/dist/lib/lanes/claude-balance.d.ts

@@ -1,6 +1,6 @@
 import type { AuthState } from "./accounts.js";
 import type { HostCapacityAccount, HostCapacitySnapshot } from "./host-capacity.js";
-import type { LaneHost, LanePlacementPolicy, LaneRecord, LanesConfig } from "./types.js";
+import type { LaneCompanyRef, LaneHost, LanePlacementPolicy, LaneRecord, LanesConfig } from "./types.js";
 import { type QuotaState } from "./quota.js";
 export declare const BALANCE_LIVE_STATES: readonly ["running", "queued", "awaiting_input"];
 export declare const BALANCE_MOVABLE_STATES: readonly ["interrupted", "done", "awaiting_input"];
@@ -71,6 +71,9 @@ export interface BalanceMoveSuggestion {
     skip_reason?: "running_turn" | "state_not_movable" | "no_provider_session" | "pending_resume";
 }
 export declare function selectClaudeAccount(input: {
+    company?: LaneRecord["company"];
+    /** Only an already-recorded account may use the legacy untagged exception. */
+    retainedAccount?: string;
     hosts: readonly BalanceHostSnapshot[];
     targetHost: LaneHost;
     config: LanesConfig;
@@ -95,5 +98,7 @@ export declare function accountLoadsForReport(input: {
 export declare function planClaudeBalanceMoves(input: {
     hosts: readonly BalanceHostSnapshot[];
     config: LanesConfig;
+    /** Resolves a lane's effective company (lane, mesh company, then project owner). */
+    laneCompany?: (lane: LaneRecord) => LaneCompanyRef | null;
 }): BalanceMoveSuggestion[];
 //# sourceMappingURL=claude-balance.d.ts.map

package/dist/lib/lanes/claude-balance.js

@@ -1,4 +1,5 @@
 import { LanesError } from "./errors.js";
+import { accountMatchesCompany, accountMayRetainLane } from "./account-company.js";
 import { quotaBlockFor } from "./quota.js";
 export const BALANCE_LIVE_STATES = ["running", "queued", "awaiting_input"];
 export const BALANCE_MOVABLE_STATES = ["interrupted", "done", "awaiting_input"];
@@ -134,7 +135,10 @@ function buildLoads(input) {
         const quotaBlock = input.quotaState === undefined
             ? undefined
             : quotaBlockFor(input.quotaState, "claude", account, quotaModel, input.now);
-        const ineligible = targetIneligibilityReason(account, configAccounts[account]?.enabled === true, input.allowedAccounts, targetLoad) ?? (quotaBlock?.blocked === true ? "quota_held" : undefined);
+        const companyMismatch = input.company !== undefined && !(account === input.retainedAccount
+            ? accountMayRetainLane(configAccounts[account], input.company, configAccounts)
+            : accountMatchesCompany(configAccounts[account], input.company, configAccounts));
+        const ineligible = companyMismatch ? "company_mismatch" : targetIneligibilityReason(account, configAccounts[account]?.enabled === true, input.allowedAccounts, targetLoad) ?? (quotaBlock?.blocked === true ? "quota_held" : undefined);
         if (ineligible !== undefined)
             skipped.push({ account, host: targetHost, reason: ineligible });
         const knownCounts = hosts.flatMap((host) => host.live_lanes === null ? [] : [host.live_lanes]);
@@ -285,6 +289,7 @@ export function planClaudeBalanceMoves(input) {
         if (sourceStatus === undefined)
             continue;
         const candidates = Object.keys(input.config.providers.claude.accounts)
+            .filter((account) => accountMatchesCompany(input.config.providers.claude.accounts[account], input.laneCompany ? input.laneCompany(lane) : lane.company, input.config.providers.claude.accounts))
             .filter((account) => account !== source && input.config.providers.claude.accounts[account]?.enabled === true)
             .map((account) => ({
             account,

package/dist/lib/lanes/claude-credential.d.ts

@@ -0,0 +1,78 @@
+/**
+ * Expiry check for the Claude OAuth credential a lane worker will use.
+ *
+ * `hq lanes accounts list` used to report `logged_in: true` when a
+ * credential merely existed (a `.credentials.json` file, or `claude auth
+ * status` saying a keychain item is present). An expired access token still
+ * passed, and the lane exited seconds after start with an OAuth expiry
+ * error. This module reads the same credential the worker reads and reports
+ * whether its access token is still valid.
+ *
+ * The worker's credential is keyed by CLAUDE_CONFIG_DIR:
+ * - macOS: the login user's Keychain item `Claude Code-credentials` for the
+ *   default home (the worker runs with the variable unset), or the
+ *   hash-suffixed item for any other home; `<home>/.credentials.json` when no
+ *   Keychain item exists.
+ * - elsewhere: `<home>/.credentials.json`.
+ *
+ * An access token past its expiry is only reported expired when there is no
+ * refresh token, or the capacity collector has recorded the refresh token as
+ * revoked. Otherwise Claude Code renews the access token at startup, so the
+ * account is still usable.
+ *
+ * Only `claudeAiOauth.expiresAt` and the presence of the tokens are read.
+ * Token values are never returned, logged, or copied; the refresh token is
+ * only passed to the revoked check, which compares a fingerprint.
+ */
+/**
+ * valid: an access token whose expiry is in the future (or not recorded).
+ * expired: an access token whose expiry has passed and that cannot be renewed
+ *   (no refresh token, or the refresh token is recorded as revoked). A lane
+ *   started now fails.
+ * missing: no OAuth credential for this home (API-key setups land here).
+ * unknown: the credential could not be read (Keychain timeout, bad JSON).
+ */
+export type ClaudeTokenState = "valid" | "expired" | "missing" | "unknown";
+export interface ClaudeCredentialCheck {
+    state: ClaudeTokenState;
+    /** ISO time the access token expires, when the credential records it. */
+    expires_at: string | null;
+    source: "keychain" | "file" | null;
+}
+export interface ClaudeCredentialTarget {
+    /** The account home the lane runs with. */
+    home: string;
+    /** True when the worker runs with CLAUDE_CONFIG_DIR unset for this home. */
+    defaultHome: boolean;
+}
+export type ClaudeCredentialReader = (target: ClaudeCredentialTarget) => ClaudeCredentialCheck;
+export interface SecurityResult {
+    status: number | null;
+    /** Holds the credential JSON on success. Parsed in memory, never printed. */
+    stdout: string;
+    timedOut: boolean;
+}
+export interface ClaudeCredentialReaderDeps {
+    platform?: NodeJS.Platform;
+    now?: () => number;
+    security?: (args: readonly string[]) => SecurityResult;
+    readFile?: (file: string) => string;
+    /** Keychain account name; defaults to the login user. */
+    username?: string;
+    /** True when this refresh token is recorded as revoked. */
+    isRefreshRevoked?: (refreshToken: string) => boolean;
+}
+/** Revoked check against the capacity collector's marker file. Never throws. */
+export declare function defaultIsRefreshRevoked(refreshToken: string): boolean;
+export declare const CLAUDE_CREDENTIAL_SECURITY_TIMEOUT_MS = 5000;
+/** Keychain service the worker reads for this home. */
+export declare function laneClaudeKeychainService(target: ClaudeCredentialTarget): string;
+/** Classify a credential document. Returns only state and expiry. */
+export declare function claudeTokenStateFromDocument(text: string, nowMs: number, isRefreshRevoked?: (refreshToken: string) => boolean): {
+    state: ClaudeTokenState;
+    expires_at: string | null;
+};
+export declare function createClaudeCredentialReader(deps?: ClaudeCredentialReaderDeps): ClaudeCredentialReader;
+/** Production reader: real Keychain on macOS, the credentials file elsewhere. */
+export declare const readLaneClaudeCredential: ClaudeCredentialReader;
+//# sourceMappingURL=claude-credential.d.ts.map