@indigoai-us/hq-cli 5.345.92 → 5.345.93

package/dist/commands/integrations-connect.js

@@ -305,6 +305,57 @@ async function resolveKey(opts, appLabel) {
     }
     throw new IntegrationsCliError(`${appLabel} needs an API key. Pass it with --token-stdin (recommended, keeps it out of shell history) or --token <key>.`, { expected: true });
 }
+/**
+ * Remote MCP endpoints the integrations.sh catalog lists as MCP without a URL.
+ *
+ * Gmail's documented server is `https://gmailmcp.googleapis.com/mcp/v1`
+ * (Google Workspace "Configure the Gmail MCP server"). Catalog connect and
+ * reconnect otherwise POST domain/query, and hq-pro throws
+ * FactoryInstallationUnsupported — printed as a failure that still exited 0
+ * when the command returned instead of throwing.
+ */
+const DOCUMENTED_REMOTE_MCP_BY_DOMAIN = {
+    "gmail.com": { mcpUrl: "https://gmailmcp.googleapis.com/mcp/v1" },
+};
+function documentedRemoteMcp(domainOrName) {
+    const want = domainOrName?.trim().toLowerCase() ?? "";
+    if (!want)
+        return undefined;
+    const direct = DOCUMENTED_REMOTE_MCP_BY_DOMAIN[want];
+    if (direct)
+        return { mcpUrl: direct.mcpUrl, domain: want };
+    for (const [domain, overlay] of Object.entries(DOCUMENTED_REMOTE_MCP_BY_DOMAIN)) {
+        if (domainLabel(domain) === want)
+            return { mcpUrl: overlay.mcpUrl, domain };
+    }
+    return undefined;
+}
+/**
+ * When the catalog names an MCP app but has no server URL, use the documented
+ * endpoint and drop catalog/query handles so hq-pro takes the direct `mcpUrl`
+ * path. Keep `domain` + `provider` so a revoked factory:gmail row is revived
+ * instead of creating a second connection keyed on gmailmcp.googleapis.com.
+ */
+function withDocumentedRemoteMcp(target, domainHint) {
+    if (target.ref.mcpUrl || target.ref.discoveryReceiptId)
+        return target;
+    const overlay = documentedRemoteMcp(domainHint) ?? documentedRemoteMcp(target.ref.domain);
+    if (!overlay)
+        return target;
+    return {
+        ...target,
+        ref: {
+            mcpUrl: overlay.mcpUrl,
+            domain: overlay.domain,
+            provider: target.ref.provider ?? domainLabel(overlay.domain),
+            displayName: target.ref.displayName ?? target.label,
+        },
+    };
+}
+function unsupportedCatalogSurfaceError(label, cause) {
+    return new IntegrationsCliError(`${label} cannot be connected because the app catalog has no MCP server URL. ` +
+        "Re-run with --mcp-url <endpoint> (find it with `hq integrations inspect`).", { expected: true, status: cause.status, code: cause.code });
+}
 /**
  * Turn the caller's arguments into one unambiguous target. Precedence is
  * most-specific-first so an explicit flag always wins over the positional
@@ -354,13 +405,13 @@ async function resolveTarget(token, companyUid, app, opts, preserveDomain = fals
             // hq-pro. A catalog entry id is useful auth metadata, but replacing the
             // domain with it can create a distinct connection instead of reviving
             // the original acct_ row.
-            return {
+            return withDocumentedRemoteMcp({
                 ref: { domain: app },
                 ...(match?.authClass ? { authClass: match.authClass } : {}),
                 label: redactUrlsInText(match?.name || app),
-            };
+            }, app);
         }
-        return catalogEntryToTarget(match, { ref: { domain: app }, label: redactUrlsInText(app) });
+        return withDocumentedRemoteMcp(catalogEntryToTarget(match, { ref: { domain: app }, label: redactUrlsInText(app) }), match?.domain ?? app);
     }
     // A bare name (`notion`, `atlassian`) is how the catalog reads to a person —
     // the rows are titled `notion.com`, `atlassian.com`. Resolve it to that row
@@ -370,9 +421,9 @@ async function resolveTarget(token, companyUid, app, opts, preserveDomain = fals
     // unmatched → fall back to the server-side query resolver.
     const named = await findCatalogEntryByName(token, companyUid, app);
     if (named) {
-        return catalogEntryToTarget(named, { ref: { query: app }, label: redactUrlsInText(app) });
+        return withDocumentedRemoteMcp(catalogEntryToTarget(named, { ref: { query: app }, label: redactUrlsInText(app) }), named.domain);
     }
-    return { ref: { query: app }, label: redactUrlsInText(app) };
+    return withDocumentedRemoteMcp({ ref: { query: app }, label: redactUrlsInText(app) }, app);
 }
 /**
  * Turn a matched catalog entry into a connect target, preferring its opaque
@@ -1065,6 +1116,10 @@ async function connectApp(token, companyUid, app, opts, expectedRevivedConnectio
             }
             return;
         }
+        if (err instanceof IntegrationsCliError &&
+            err.code === "INTEGRATION_FACTORY_UNSUPPORTED_SURFACE") {
+            throw unsupportedCatalogSurfaceError(target.label, err);
+        }
         throw err;
     }
 }
@@ -1407,6 +1462,10 @@ export function registerConnectCommands(integrations) {
                     reportInstall(result, opts);
                 return;
             }
+            if (err instanceof IntegrationsCliError &&
+                err.code === "INTEGRATION_FACTORY_UNSUPPORTED_SURFACE") {
+                throw unsupportedCatalogSurfaceError(target.label, err);
+            }
             throw err;
         }
     });

package/dist/commands/lanes-accounts.d.ts

@@ -12,6 +12,7 @@ export declare function createLaneAccountsHandlers(deps: LaneAccountsHandlerDeps
         home?: string;
         deviceAuth?: boolean;
         company?: string;
+        capacityOnly?: boolean;
     }) => Promise<void>;
     runAccountsSetHome: (ctx: Ctx, providerRaw: string, accountIdRaw: string, homeRaw: string, opts: {
         host?: string;

package/dist/commands/lanes-accounts.js

@@ -8,6 +8,7 @@ import { AccountResolutionError, DEFAULT_ACCOUNT_HOMES, LANE_PROVIDERS, PROVIDER
 import { assertUniqueAccountHomes, providerCompactAfterMs } from "../lib/lanes/config.js";
 import { resolveLaneEffort } from "../lib/lanes/effort.js";
 import { LanesError } from "../lib/lanes/errors.js";
+import { CAPACITY_ONLY_REASON } from "../lib/capacity/accounts.js";
 import { accountQuotaView, clearAccountQuota, loadQuotaState } from "../lib/lanes/quota.js";
 import { resolveLaneModel } from "../lib/lanes/spawn.js";
 import { leadLaneIds } from "../lib/lanes/admission.js";
@@ -362,6 +363,11 @@ export function createLaneAccountsHandlers(deps) {
             }
         }
         delete nextAccount.disabled_reason;
+        if (opts.capacityOnly && registeredAccount?.enabled !== true) {
+            const prior = registeredAccount?.disabled_reason;
+            nextAccount.enabled = false;
+            nextAccount.disabled_reason = prior && prior !== CAPACITY_ONLY_REASON ? prior : CAPACITY_ONLY_REASON;
+        }
         assertUniqueAccountHomes(provider, {
             ...config.providers[provider].accounts,
             [id]: nextAccount,

package/dist/lib/capacity/accounts.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Capacity account list (US-011).
+ *
+ * The lane account registry plus each provider's default home. A missing
+ * config file is an empty registry: this module does not call
+ * documentedDefaultConfig, which would invent an enabled account "a".
+ */
+import { type LaneProvider, type LanesConfig } from "../lanes/types.js";
+export type CapacityAccountSource = "default" | "registry" | "host";
+export interface CapacityAccount {
+    provider: LaneProvider;
+    label: string;
+    home: string;
+    source: CapacityAccountSource;
+    /** False for a capacity-only account: read for usage, never used by lanes. */
+    lanes?: boolean;
+}
+/**
+ * `disabled_reason` that marks a registry account as capacity-only. Signing in
+ * for usage visibility must not opt an account into lane work, because lanes
+ * spread work across every enabled account and the accounts can belong to
+ * different companies. `hq lanes accounts enable` opts one in.
+ */
+export declare const CAPACITY_ONLY_REASON = "capacity-only: read for usage, not used by lanes";
+export interface ListCapacityAccountsOptions {
+    home?: string;
+    hqRoot?: string;
+    hostname?: string;
+    /** Injected config. `null` means the registry is empty. Omit to read the file. */
+    config?: LanesConfig | null;
+    env?: NodeJS.ProcessEnv;
+}
+export declare function defaultProviderHome(provider: LaneProvider, home?: string): string;
+export declare function listCapacityAccounts(options?: ListCapacityAccountsOptions): CapacityAccount[];
+export declare function registryAccountIds(hqRoot: string, provider: string): string[];
+//# sourceMappingURL=accounts.d.ts.map

package/dist/lib/capacity/accounts.js

@@ -0,0 +1,90 @@
+/**
+ * Capacity account list (US-011).
+ *
+ * The lane account registry plus each provider's default home. A missing
+ * config file is an empty registry: this module does not call
+ * documentedDefaultConfig, which would invent an enabled account "a".
+ */
+import * as fs from "node:fs";
+import * as os from "node:os";
+import * as path from "node:path";
+import { effectiveAccountHome } from "../lanes/account-home.js";
+import { lanesConfigPath, loadLanesConfig } from "../lanes/config.js";
+import { resolveLanesHqRoot } from "../lanes/hq-root.js";
+import { LANE_PROVIDERS } from "../lanes/types.js";
+/**
+ * `disabled_reason` that marks a registry account as capacity-only. Signing in
+ * for usage visibility must not opt an account into lane work, because lanes
+ * spread work across every enabled account and the accounts can belong to
+ * different companies. `hq lanes accounts enable` opts one in.
+ */
+export const CAPACITY_ONLY_REASON = "capacity-only: read for usage, not used by lanes";
+const DEFAULT_DIR = {
+    claude: ".claude",
+    codex: ".codex",
+    grok: ".grok",
+};
+export function defaultProviderHome(provider, home = os.homedir()) {
+    return path.join(home, DEFAULT_DIR[provider]);
+}
+export function listCapacityAccounts(options = {}) {
+    const home = options.home ?? os.homedir();
+    const hostname = options.hostname ?? os.hostname();
+    const config = resolveConfig(options);
+    const accounts = [];
+    for (const provider of LANE_PROVIDERS) {
+        accounts.push({
+            provider,
+            label: "default",
+            home: defaultProviderHome(provider, home),
+            source: "default",
+        });
+        const configured = config?.providers[provider]?.accounts ?? {};
+        for (const [label, account] of Object.entries(configured)) {
+            if (!account)
+                continue;
+            const capacityOnly = !account.enabled && account.disabled_reason === CAPACITY_ONLY_REASON;
+            if (!account.enabled && !capacityOnly)
+                continue;
+            const effective = effectiveAccountHome(account, hostname);
+            accounts.push({
+                provider,
+                label,
+                home: effective.home,
+                source: effective.source === "host" ? "host" : "registry",
+                lanes: account.enabled,
+            });
+        }
+    }
+    return accounts;
+}
+export function registryAccountIds(hqRoot, provider) {
+    if (!LANE_PROVIDERS.includes(provider))
+        return [];
+    const filePath = lanesConfigPath(hqRoot);
+    if (!fs.existsSync(filePath))
+        return [];
+    const config = loadLanesConfig(hqRoot);
+    return Object.keys(config.providers[provider].accounts);
+}
+function resolveConfig(options) {
+    if (options.config === null)
+        return null;
+    if (options.config)
+        return options.config;
+    const explicit = options.hqRoot?.trim() || options.env?.HQ_ROOT?.trim() || "";
+    let hqRoot = explicit;
+    if (!hqRoot) {
+        try {
+            hqRoot = resolveLanesHqRoot({ env: options.env });
+        }
+        catch {
+            return null;
+        }
+    }
+    const filePath = lanesConfigPath(hqRoot);
+    if (!fs.existsSync(filePath))
+        return null;
+    return loadLanesConfig(hqRoot);
+}
+//# sourceMappingURL=accounts.js.map

package/dist/lib/capacity/collect.d.ts

@@ -0,0 +1,33 @@
+/**
+ * One-shot capacity collection (US-011).
+ *
+ * The daemon is the resident collector. This runs the same readers once
+ * into whatever ledger root the caller passes, so a check never writes
+ * ~/.hq/capacity unless that root is requested.
+ */
+import { type CapacityAccount } from "./accounts.js";
+import { type CodexAppServerSpawn } from "./collectors/codex.js";
+import { type CollectClaudeOAuthOptions } from "./collectors/claude-oauth.js";
+import { type CollectGrokOptions } from "./collectors/grok.js";
+import { type NowView } from "./ledger.js";
+export interface CollectCapacityOnceOptions {
+    root?: string;
+    home?: string;
+    hqRoot?: string;
+    hostname?: string;
+    env?: NodeJS.ProcessEnv;
+    now?: () => Date;
+    /** Replaces registry discovery. Tests pass fixture homes here. */
+    accounts?: readonly CapacityAccount[];
+    claude?: Pick<CollectClaudeOAuthOptions, "platform" | "securityExec" | "fetchImpl" | "cliVersion" | "readVersion" | "endpoint">;
+    grok?: Pick<CollectGrokOptions, "fetchImpl" | "cliVersion" | "readVersion" | "endpoint">;
+    codex?: {
+        spawn?: CodexAppServerSpawn;
+        cliVersion?: string;
+        skipAppServer?: boolean;
+    };
+    /** Login passes false so a partial account list cannot label the whole spool. */
+    includeSpool?: boolean;
+}
+export declare function collectCapacityOnce(options?: CollectCapacityOnceOptions): Promise<NowView>;
+//# sourceMappingURL=collect.d.ts.map

package/dist/lib/capacity/collect.js

@@ -0,0 +1,164 @@
+/**
+ * One-shot capacity collection (US-011).
+ *
+ * The daemon is the resident collector. This runs the same readers once
+ * into whatever ledger root the caller passes, so a check never writes
+ * ~/.hq/capacity unless that root is requested.
+ */
+import { execFile } from "node:child_process";
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { listCapacityAccounts } from "./accounts.js";
+import { ingestCodexResult, isCodexProcessRunning, latestCodexSessionWriteAt, readCodexAppServer, readInstalledCodexVersion, shouldReadAppServer, tailCodexSessions, } from "./collectors/codex.js";
+import { collectClaudeOAuth, } from "./collectors/claude-oauth.js";
+import { consumeClaudeStatuslineSpool } from "./collectors/claude-statusline.js";
+import { collectGrok } from "./collectors/grok.js";
+import { capacityRoot, rebuildNow, } from "./ledger.js";
+export async function collectCapacityOnce(options = {}) {
+    const env = options.env ?? process.env;
+    const root = options.root ?? capacityRoot(env, options.home);
+    const ledger = {
+        root,
+        env,
+        home: options.home,
+        ...(options.now ? { now: options.now } : {}),
+    };
+    const accounts = options.accounts
+        ? [...options.accounts]
+        : listCapacityAccounts({
+            home: options.home,
+            hqRoot: options.hqRoot,
+            hostname: options.hostname,
+            env,
+        });
+    const claude = accounts.filter((account) => account.provider === "claude");
+    const codex = accounts.filter((account) => account.provider === "codex");
+    const grok = accounts.filter((account) => account.provider === "grok");
+    await collectClaudeOAuth({
+        ledger,
+        now: options.now,
+        allowDisabled: true,
+        accounts: claude.map((account) => ({ label: account.label, home: account.home })),
+        ...options.claude,
+    });
+    await collectCodexHomes(codex, ledger, options);
+    await collectGrok({
+        ledger,
+        now: options.now,
+        allowDisabled: true,
+        accounts: grok.map((account) => ({ label: account.label, home: account.home })),
+        ...options.grok,
+    });
+    if (options.includeSpool !== false) {
+        consumeClaudeStatuslineSpool({
+            root,
+            now: options.now ? options.now() : new Date(),
+            accounts: claude.map((account) => ({ label: account.label, home: account.home })),
+        });
+    }
+    return rebuildNow(ledger);
+}
+async function collectCodexHomes(accounts, ledger, options) {
+    const groups = new Map();
+    for (const account of accounts) {
+        const key = path.resolve(account.home);
+        const group = groups.get(key) ?? { home: account.home, labels: [] };
+        if (!group.labels.includes(account.label))
+            group.labels.push(account.label);
+        groups.set(key, group);
+    }
+    let cliVersion = options.codex?.cliVersion;
+    if (!cliVersion) {
+        try {
+            cliVersion = await readInstalledCodexVersion(options.codex?.spawn);
+        }
+        catch {
+            cliVersion = "unknown";
+        }
+    }
+    const now = options.now ? options.now() : new Date();
+    const processes = options.codex?.skipAppServer ? "codex" : await processListAsync();
+    const root = ledger.root;
+    let state = root ? readTailState(root) : undefined;
+    for (const group of groups.values()) {
+        const label = group.labels.find((item) => item !== "default") ?? group.labels[0] ?? "default";
+        const sessionsDir = path.join(group.home, "sessions");
+        try {
+            const tailed = tailCodexSessions({
+                sessionsDir,
+                state,
+                cliVersion,
+                now,
+                recentDays: 2,
+                accountId: `home:${path.resolve(group.home)}`,
+                accountLabel: label,
+                accountLabels: group.labels,
+                accountHome: group.home,
+            });
+            ingestCodexResult(tailed, ledger);
+            state = tailed.state;
+            if (root)
+                writeTailState(root, state);
+        }
+        catch {
+            // One home's tail must not stop the others.
+        }
+        if (options.codex?.skipAppServer)
+            continue;
+        const lastWrite = latestCodexSessionWriteAt(sessionsDir);
+        if (!shouldReadAppServer({
+            lastSessionWriteAt: lastWrite,
+            codexProcessRunning: isCodexProcessRunning(processes),
+            now: now.getTime(),
+        }))
+            continue;
+        try {
+            const result = await readCodexAppServer({
+                cliVersion,
+                now,
+                home: group.home,
+                accountId: `home:${path.resolve(group.home)}`,
+                accountLabel: label,
+                accountLabels: group.labels,
+                accountHome: group.home,
+                spawn: options.codex?.spawn,
+                timeoutMs: 20_000,
+            });
+            ingestCodexResult(result, ledger);
+        }
+        catch {
+            // A refused or busy app-server is not a credential read.
+        }
+    }
+}
+const TAIL_STATE_FILE = "codex-tail-state.json";
+function readTailState(root) {
+    try {
+        const parsed = JSON.parse(fs.readFileSync(path.join(root, TAIL_STATE_FILE), "utf8"));
+        if (!parsed || typeof parsed !== "object" || !parsed.files)
+            return undefined;
+        return parsed;
+    }
+    catch {
+        return undefined;
+    }
+}
+function writeTailState(root, state) {
+    const dest = path.join(root, TAIL_STATE_FILE);
+    const tmp = `${dest}.${process.pid}.tmp`;
+    fs.mkdirSync(root, { recursive: true, mode: 0o700 });
+    fs.writeFileSync(tmp, `${JSON.stringify(state)}\n`, { mode: 0o600 });
+    fs.renameSync(tmp, dest);
+    fs.chmodSync(dest, 0o600);
+}
+function processListAsync() {
+    return new Promise((resolve) => {
+        execFile("ps", ["-ax", "-o", "command="], { timeout: 5_000, encoding: "utf8" }, (error, stdout) => {
+            if (error)
+                resolve("");
+            else
+                resolve(typeof stdout === "string" ? stdout : "");
+        });
+    });
+}
+//# sourceMappingURL=collect.js.map

package/dist/lib/capacity/collectors/claude-oauth.d.ts

@@ -0,0 +1,145 @@
+/**
+ * Claude OAuth usage collector (US-005).
+ *
+ * Reads the Claude Code credential read-only (macOS Keychain item
+ * `Claude Code-credentials`, plus `Claude Code-credentials-<hash>` seats,
+ * or the credentials JSON under ~/.claude/ on Linux). GETs
+ * https://api.anthropic.com/api/oauth/usage with the oauth-2025-04-20 beta
+ * header. This module does not refresh the token, write the Keychain or
+ * ~/.claude, call an OAuth token endpoint, or invoke the claude CLI except
+ * `claude --version` when the caller does not pass cliVersion.
+ *
+ * The legacy shape (seven_day_opus populated, no limits[]) is drift.
+ * observedAt is the response time. One collect appends every account's
+ * readings and failures in one rebuild.
+ */
+import { type LedgerOptions, type NowView, type ParserFailureEvent, type ReadingInput } from "../ledger.js";
+export declare const CLAUDE_OAUTH_PARSER_VERSION = "claude-oauth-usage.1";
+export declare const CLAUDE_OAUTH_PROVIDER = "claude";
+export declare const CLAUDE_OAUTH_SOURCE: "oauth-usage";
+export declare const CLAUDE_OAUTH_URL = "https://api.anthropic.com/api/oauth/usage";
+export declare const CLAUDE_OAUTH_PROFILE_URL = "https://api.anthropic.com/api/oauth/profile";
+export declare const CLAUDE_OAUTH_BETA = "oauth-2025-04-20";
+export declare const CLAUDE_ORG_CACHE_MS: number;
+export declare const CLAUDE_ORG_CACHE_FILE = "claude-org-cache.json";
+export declare const CLAUDE_OAUTH_POLL_MS: number;
+/** Freshness is shorter than the 5 minute tick so the next tick is not skipped. */
+export declare const CLAUDE_OAUTH_FRESH_MS: number;
+export declare const CLAUDE_OAUTH_KEYCHAIN_BACKOFF_MS: number;
+export declare const CLAUDE_OAUTH_FETCH_TIMEOUT_MS = 10000;
+export declare const CLAUDE_OAUTH_SECURITY_TIMEOUT_MS = 5000;
+export declare const CLAUDE_OAUTH_POLL_FILE = "claude-oauth-last-call.json";
+export declare const CLAUDE_KEYCHAIN_SERVICE = "Claude Code-credentials";
+export interface ClaudeOAuthFetchInit {
+    method: "GET";
+    headers: Record<string, string>;
+    redirect: "manual";
+    signal?: AbortSignal;
+}
+export type ClaudeOAuthFetch = (url: string, init: ClaudeOAuthFetchInit) => Promise<{
+    status: number;
+    text: () => Promise<string>;
+    headers?: {
+        get(name: string): string | null;
+    };
+}>;
+export interface SecurityExecResult {
+    status: number | null;
+    stdout: string;
+    stderr: string;
+    timedOut: boolean;
+}
+export type SecurityExec = (args: readonly string[], timeoutMs: number) => SecurityExecResult;
+export type ClaudeKeychainStatus = "no-prompt" | "prompt" | "timeout" | "error";
+export interface ClaudeCredentialAccount {
+    token: string;
+    /** Already hashed. Raw org ids and keychain account names are not accepted here. */
+    accountId: string;
+    expiresAt?: number | null;
+    scopes?: readonly string[] | null;
+    planType?: string | null;
+}
+export interface ReadClaudeCredentialsResult {
+    keychain: ClaudeKeychainStatus;
+    accounts: ClaudeCredentialAccount[];
+}
+export type ReadClaudeCredentials = () => ReadClaudeCredentialsResult;
+export interface ClaudeOAuthCollectResult {
+    readings: ReadingInput[];
+    failures: ParserFailureEvent[];
+    view: NowView | null;
+    skipped?: "disabled" | "rate-limit" | "keychain-backoff";
+    keychain: ClaudeKeychainStatus;
+    httpStatus: number | null;
+    accountIds: string[];
+}
+export interface CollectClaudeOAuthOptions {
+    /** Linux credentials JSON. When set, the Keychain is not read. */
+    credentialsPath?: string;
+    /** Replaces Keychain and credentials-file discovery. */
+    readCredentials?: ReadClaudeCredentials;
+    /** Replaces `security`. Used by the default Keychain reader. */
+    securityExec?: SecurityExec;
+    endpoint?: string;
+    cliVersion?: string;
+    readVersion?: () => string;
+    now?: () => Date;
+    fetchImpl?: ClaudeOAuthFetch;
+    ledger?: LedgerOptions;
+    platform?: NodeJS.Platform;
+    /** Keychain account attribute used when discovery is not available. */
+    keychainAccount?: string;
+    /**
+     * When set, read each home instead of the unscoped keychain dump.
+     * One entry per label. Homes that resolve to the same path are one read.
+     */
+    accounts?: readonly {
+        label: string;
+        home: string;
+    }[];
+    /** One-shot collect reads while the resident collector stays disabled. */
+    allowDisabled?: boolean;
+}
+interface MapOptions {
+    observedAt: string;
+    cliVersion: string;
+    accountId: string;
+    planType: string | null;
+    accountLabel?: string;
+    accountLabels?: string[];
+    organization?: string | null;
+    accountHome?: string;
+}
+export declare function claudeOAuthPollPath(root: string): string;
+export declare function defaultClaudeCredentialsPath(home?: string): string;
+/**
+ * Claude Code's keychain service for a config dir.
+ * The default home uses `Claude Code-credentials`. Any other resolved
+ * path uses that name plus the first 8 hex chars of SHA-256(utf8 path).
+ */
+export declare function claudeKeychainServiceName(configDir: string, defaultConfigDir?: string): string;
+export declare function parseClaudeCliVersion(text: string): string | null;
+/** Map a usage JSON body. Does not read credentials or call the network. */
+export declare function mapClaudeOAuthUsage(body: unknown, options: MapOptions): {
+    readings: ReadingInput[];
+    failures: ParserFailureEvent[];
+};
+export declare function collectClaudeOAuth(options?: CollectClaudeOAuthOptions): Promise<ClaudeOAuthCollectResult>;
+/**
+ * Ledger account id → hashed profile account id. Rows with no captured
+ * identity are omitted. The raw uuid is never returned.
+ */
+export declare function claudeIdentityKeys(root: string): ReadonlyMap<string, string>;
+/**
+ * Claude names an individual plan's organization "<email>'s Organization".
+ * The ledger never stores an email, so such a name becomes the email's
+ * domain (for example "getindigo.ai"), or "Personal" for a consumer mail
+ * domain. Any other name containing "@" is dropped.
+ */
+export declare function displayOrganization(name: string): string | null;
+export declare function claudeSeatAccountId(seat: string, orgId: string | null): string;
+export declare function readInstalledClaudeVersion(readVersion?: () => string): string;
+/** Async `claude --version` for the daemon. The sync reader stays for one-shot callers. */
+export declare function readInstalledClaudeVersionAsync(): Promise<string>;
+export {};
+//# sourceMappingURL=claude-oauth.d.ts.map