@indigoai-us/hq-cloud 6.15.4 → 6.15.5

package/dist/outposts/cli-billing.js

@@ -0,0 +1,93 @@
+/**
+ * Terminal-facing half of the billing gate: the prose that talks to a human.
+ *
+ * Split from `./billing.ts` so a Next.js consumer can use the prices, the
+ * formatter, and the link mint without inheriting `chalk` or `process.exit`.
+ *
+ * Everything here is full prose rather than terse status output — a recurring
+ * charge and a declined card are exactly the moments where more words are the
+ * right call.
+ */
+import chalk from "chalk";
+import { formatUsd, mintPaymentLink } from "./billing.js";
+/**
+ * Gate a paid provisioning call behind an explicit, informed `--yes`.
+ *
+ * Prints the monthly charge in full and exits non-zero when the caller has not
+ * passed `--yes`. Returns normally once approved so the caller proceeds.
+ */
+export function confirmChargeOrExit(opts) {
+    const quantity = opts.quantity ?? 1;
+    const total = opts.unitCents * quantity;
+    const each = quantity > 1 ? ` (${formatUsd(opts.unitCents)} each × ${quantity})` : "";
+    const noun = quantity > 1 ? `${opts.resource}s` : opts.resource;
+    const article = /^[aeiou]/i.test(opts.resource) ? "an" : "a";
+    const subject = quantity > 1 ? `${quantity} ${noun}` : `${article} ${noun}`;
+    if (!opts.yes) {
+        console.error(chalk.yellow(`Provisioning ${subject} adds a recurring charge of ` +
+            `${formatUsd(total)}/month${each} to the payer on file. This is a ` +
+            `paid resource.\n` +
+            `Re-run with --yes to confirm you want to incur this charge.`));
+        process.exit(1);
+    }
+    console.log(chalk.dim(`Confirmed: ${formatUsd(total)}/month for ${quantity} ${noun}. Provisioning…`));
+}
+/**
+ * The provision was blocked because the payer has no card on file.
+ *
+ * Mints the card-capture link the backend pointed us at and prints a plain,
+ * shareable message so the user can add a card — or hand the link to whoever owns
+ * billing — and re-run. Returns the URL, or `null` when the server gave no `setup`
+ * action to act on. Never prints tokens or secrets.
+ */
+export async function surfaceBillingRequired(ctx, billing) {
+    if (!billing.setup) {
+        console.error(chalk.yellow("Provisioning is blocked on billing, but the server didn't return a " +
+            "payment link. Add a card in the console billing page, then re-run."));
+        return null;
+    }
+    const url = await mintPaymentLink({ ...ctx, setup: billing.setup });
+    console.log(chalk.yellow("No card on file — provisioning is blocked until one is added."));
+    console.log("Add a card here (safe to share with whoever owns billing):\n  " +
+        chalk.cyan(url));
+    console.log(chalk.dim("Once a card is added, re-run the same command."));
+    return url;
+}
+/**
+ * Status-aware surface for a 402 billing block.
+ *
+ * hq-pro's envelope carries two distinct remediations that must never be
+ * conflated (mirroring the server's own classification):
+ *
+ *   - `payment_failed` — a card EXISTS and the charge was DECLINED. The server's
+ *     `message` already carries the friendly decline copy ("Your card was
+ *     declined…", "insufficient funds", …). Telling this user "No card on file"
+ *     sends them down the wrong remediation path entirely (observed live
+ *     2026-07-20: a declined $80 Outpost proration surfaced as "no card",
+ *     triggering a hunt for a missing card that existed). The capture link still
+ *     surfaces — as the way to UPDATE the card.
+ *   - anything else (`billing_required`) — genuinely no usable card on file; the
+ *     add-a-card copy is correct.
+ */
+export async function surfaceBillingBlocked(ctx, billing, serverMessage) {
+    if (billing.status !== "payment_failed") {
+        return surfaceBillingRequired(ctx, billing);
+    }
+    console.error(chalk.yellow(serverMessage?.trim() ||
+        "Your payment failed. Try a different card or contact your bank."));
+    if (!billing.setup)
+        return null;
+    try {
+        const url = await mintPaymentLink({ ...ctx, setup: billing.setup });
+        console.log("Update or replace the card here (safe to share with whoever owns billing):\n  " +
+            chalk.cyan(url));
+        console.log(chalk.dim("Once the payment method is sorted, re-run the same command."));
+        return url;
+    }
+    catch {
+        // Link minting is best-effort on the decline path — the decline reason above
+        // is the essential part, and the console billing page also works.
+        return null;
+    }
+}
+//# sourceMappingURL=cli-billing.js.map

package/dist/outposts/cli-billing.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli-billing.js","sourceRoot":"","sources":["../../src/outposts/cli-billing.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,SAAS,EAAE,eAAe,EAAqB,MAAM,cAAc,CAAC;AAK7E;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAKnC;IACC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC;IACpC,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,GAAG,QAAQ,CAAC;IACxC,MAAM,IAAI,GACR,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,WAAW,QAAQ,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3E,MAAM,IAAI,GAAG,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC;IAChE,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC;IAC7D,MAAM,OAAO,GAAG,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,QAAQ,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,OAAO,IAAI,IAAI,EAAE,CAAC;IAC5E,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;QACd,OAAO,CAAC,KAAK,CACX,KAAK,CAAC,MAAM,CACV,gBAAgB,OAAO,8BAA8B;YACnD,GAAG,SAAS,CAAC,KAAK,CAAC,SAAS,IAAI,mCAAmC;YACnE,kBAAkB;YAClB,6DAA6D,CAChE,CACF,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,GAAG,CACP,cAAc,SAAS,CAAC,KAAK,CAAC,cAAc,QAAQ,IAAI,IAAI,iBAAiB,CAC9E,CACF,CAAC;AACJ,CAAC;AASD;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,GAA0B,EAC1B,OAA4B;IAE5B,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACnB,OAAO,CAAC,KAAK,CACX,KAAK,CAAC,MAAM,CACV,qEAAqE;YACnE,oEAAoE,CACvE,CACF,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,eAAe,CAAC,EAAE,GAAG,GAAG,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;IACpE,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,MAAM,CAAC,+DAA+D,CAAC,CAC9E,CAAC;IACF,OAAO,CAAC,GAAG,CACT,gEAAgE;QAC9D,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAClB,CAAC;IACF,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,gDAAgD,CAAC,CAAC,CAAC;IACzE,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,GAA0B,EAC1B,OAA4B,EAC5B,aAAsB;IAEtB,IAAI,OAAO,CAAC,MAAM,KAAK,gBAAgB,EAAE,CAAC;QACxC,OAAO,sBAAsB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,CAAC,KAAK,CACX,KAAK,CAAC,MAAM,CACV,aAAa,EAAE,IAAI,EAAE;QACnB,iEAAiE,CACpE,CACF,CAAC;IACF,IAAI,CAAC,OAAO,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IAChC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,eAAe,CAAC,EAAE,GAAG,GAAG,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;QACpE,OAAO,CAAC,GAAG,CACT,gFAAgF;YAC9E,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAClB,CAAC;QACF,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,GAAG,CAAC,6DAA6D,CAAC,CACzE,CAAC;QACF,OAAO,GAAG,CAAC;IACb,CAAC;IAAC,MAAM,CAAC;QACP,6EAA6E;QAC7E,kEAAkE;QAClE,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/outposts/cli.d.ts

@@ -0,0 +1,13 @@
+/**
+ * `@indigoai-us/hq-cloud/outposts/cli` — the `hq outposts` command tree.
+ *
+ * Depends on `commander` and `chalk` and calls `process.exit`, so it is only for a
+ * host CLI. hq-cli mounts it by passing its own auth and HTTP seams; nothing else
+ * should import this.
+ */
+export { registerOutpostsCommand } from "./command.js";
+export type { OutpostsCommandDeps } from "./command.js";
+export { registerHeartbeatCommand } from "./heartbeat-command.js";
+export { confirmChargeOrExit, surfaceBillingRequired, surfaceBillingBlocked, } from "./cli-billing.js";
+export type { BillingSurfaceContext } from "./cli-billing.js";
+//# sourceMappingURL=cli.d.ts.map

package/dist/outposts/cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../../src/outposts/cli.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,uBAAuB,EAAE,MAAM,cAAc,CAAC;AACvD,YAAY,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAExD,OAAO,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAIlE,OAAO,EACL,mBAAmB,EACnB,sBAAsB,EACtB,qBAAqB,GACtB,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC"}

package/dist/outposts/cli.js

@@ -0,0 +1,13 @@
+/**
+ * `@indigoai-us/hq-cloud/outposts/cli` — the `hq outposts` command tree.
+ *
+ * Depends on `commander` and `chalk` and calls `process.exit`, so it is only for a
+ * host CLI. hq-cli mounts it by passing its own auth and HTTP seams; nothing else
+ * should import this.
+ */
+export { registerOutpostsCommand } from "./command.js";
+export { registerHeartbeatCommand } from "./heartbeat-command.js";
+// Shared billing prose. `hq agents` provisioning renders the same confirmation and
+// decline copy, so it is exported rather than kept private to the outposts tree.
+export { confirmChargeOrExit, surfaceBillingRequired, surfaceBillingBlocked, } from "./cli-billing.js";
+//# sourceMappingURL=cli.js.map

package/dist/outposts/cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../../src/outposts/cli.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,uBAAuB,EAAE,MAAM,cAAc,CAAC;AAGvD,OAAO,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAElE,mFAAmF;AACnF,iFAAiF;AACjF,OAAO,EACL,mBAAmB,EACnB,sBAAsB,EACtB,qBAAqB,GACtB,MAAM,kBAAkB,CAAC"}

package/dist/outposts/client.d.ts

@@ -0,0 +1,140 @@
+/**
+ * `OutpostsClient` — typed client for the hq-pro `/outpost/*` control plane.
+ *
+ * These are the same routes hq-console's outpost panel calls and the same ones
+ * `hq outposts` drives, so this class is the single implementation of the wire
+ * contract for every first-party surface.
+ *
+ * Portable: the only things it touches are its injected transport, its injected
+ * token source, and `setTimeout`. No Node built-ins, no filesystem, no
+ * `process.exit`, no module-level side effects — safe to import from a Next.js
+ * server action, a route handler, or an edge function.
+ *
+ * Outposts are PERSONAL / caller-scoped: hq-pro keys every route on the caller's
+ * Cognito sub, so no method takes a company. `outpostId` selects a specific box;
+ * omitting it targets the caller's primary slot.
+ *
+ * Every non-2xx throws {@link OutpostHttpError} — nothing is swallowed, and the
+ * server's `step` is preserved so callers can distinguish a retryable
+ * `teardown-incomplete` from a real failure.
+ */
+import type { OutpostRequest, OutpostTransport } from "./transport.js";
+import type { OutpostExecAsyncResult, OutpostExecResult, OutpostExecStage, OutpostExecSubmission, OutpostSshAccess, OutpostSummary, ProvisionOutpostInput } from "./types.js";
+/**
+ * A bearer token, or a function that resolves one per request.
+ *
+ * The function form is the important one: hq-cli passes `ensureCognitoToken`, so
+ * a long-lived client re-resolves a refreshed token instead of pinning the one
+ * that happened to be valid at construction. A Next.js app passes a closure over
+ * its session.
+ */
+export type OutpostTokenSource = string | (() => string | Promise<string>);
+export interface OutpostsClientOptions {
+    /** How requests reach the control plane. See `createOutpostTransport`. */
+    transport: OutpostTransport;
+    /** Bearer token, or a resolver called once per request. */
+    token: OutpostTokenSource;
+    /** Origin override passed through to the transport on every request. */
+    baseUrl?: string;
+}
+/** Tuning for {@link OutpostsClient.waitForExecResult}. */
+export interface WaitForExecOptions {
+    /** First poll delay in ms. Defaults to 500. */
+    initialPollMs?: number;
+    /** Ceiling for the exponential backoff in ms. Defaults to 5000. */
+    maxPollMs?: number;
+    /** Abort the wait. The in-flight poll rejects with the abort reason. */
+    signal?: AbortSignal;
+}
+/** The widest AWS-RunShellScript `executionTimeout`, in seconds (48h). */
+export declare const EXEC_MAX_TIMEOUT_SECONDS = 172800;
+export declare class OutpostsClient {
+    private readonly transport;
+    private readonly tokenSource;
+    private readonly baseUrl?;
+    constructor(options: OutpostsClientOptions);
+    /** Resolve the bearer token for one request. */
+    private token;
+    /**
+     * Authenticated JSON round-trip. Throws {@link OutpostHttpError} on any
+     * non-2xx, decoding hq-pro's `{ error | message, step }` envelope for the
+     * reason plus the two structural envelopes (`billing`, `capped`) that carry no
+     * message at all.
+     */
+    request<T>(options: Omit<OutpostRequest, "token" | "baseUrl">): Promise<T>;
+    /**
+     * Provision the caller's Outpost.
+     *
+     * `refreshToken` lets the box authenticate AS the caller — the same body
+     * hq-console's `provisionMyOutpost` sends. It travels over HTTPS and is never
+     * logged.
+     *
+     * No duplicate is ever created: a caller already at their per-person cap gets a
+     * `409` whose body lists their existing boxes, surfaced here as an
+     * `OutpostHttpError` carrying `capped`. hq-pro checks the cap BEFORE activation
+     * billing, so a capped call is never charged.
+     *
+     * A payer with no usable card gets a `402` carrying `billing`.
+     */
+    provision(input: ProvisionOutpostInput): Promise<Record<string, unknown>>;
+    /** Every Outpost the caller owns. */
+    list(): Promise<OutpostSummary[]>;
+    /** Live detail for one box. */
+    status(outpostId?: string): Promise<Record<string, unknown>>;
+    /** Enable (or retry) Codex on a box. */
+    enableCodex(outpostId?: string): Promise<Record<string, unknown>>;
+    /** Ask the box to mint a fresh Claude login URL. */
+    regenerateLoginUrl(outpostId?: string): Promise<Record<string, unknown>>;
+    /**
+     * Hand the box the one-time Claude sign-in code from the login URL. hq-pro
+     * stores it as the row's pending code; the box polls for it, feeds it to
+     * `claude`, and flips itself `awaiting-claude-login → ready`.
+     */
+    submitLoginCode(code: string, outpostId?: string): Promise<Record<string, unknown>>;
+    /**
+     * Permanently destroy a box and its cloud resources.
+     *
+     * Idempotent: a `409` / `step: "teardown-incomplete"` means the gateway's
+     * timeout fired while the Lambda kept working. The row is preserved — re-issue
+     * the same call to finish.
+     */
+    destroy(outpostId?: string): Promise<Record<string, unknown>>;
+    /**
+     * Run a one-shot shell command via server-brokered SSM (no SSH). Synchronous,
+     * so it is bounded by the API gateway's ~20s cap — use the submit/result pair
+     * for anything longer.
+     *
+     * A `step: "platform-unsupported"` error means the box is Lightsail and has no
+     * SSM agent; fall back to SSH via {@link sshAccess}.
+     */
+    exec(command: string, outpostId?: string): Promise<OutpostExecResult>;
+    /** Presign an input upload for an asynchronous command. */
+    stageExecInput(outpostId?: string): Promise<OutpostExecStage>;
+    /** Submit an asynchronous command; returns as soon as SSM accepts it. */
+    submitExec(command: string, outpostId?: string, timeoutSeconds?: number): Promise<OutpostExecSubmission>;
+    /**
+     * Poll an asynchronous command once. Streams arrive only once `done`.
+     *
+     * `signal` aborts the in-flight request itself — not just the caller's wait —
+     * so a slow or hung poll is cancelled rather than left pending.
+     */
+    fetchExecResult(commandId: string, outpostId?: string, signal?: AbortSignal): Promise<OutpostExecAsyncResult>;
+    /**
+     * Poll until an asynchronous command reaches a terminal state, backing off
+     * exponentially.
+     *
+     * A `429` is treated as back-pressure and retried — the command is still
+     * running, and giving up on a rate limit would strand a job that is fine. Any
+     * other error propagates.
+     */
+    waitForExecResult(commandId: string, outpostId?: string, options?: WaitForExecOptions): Promise<OutpostExecAsyncResult>;
+    /**
+     * Fetch SSH connection info + key for a box and open the caller's IP on its SSH
+     * port. The route exists to reach a Lightsail box, which has no SSM agent.
+     *
+     * The result carries a PEM private key. Treat it as a credential: never log it,
+     * never return it to a browser, and write it only to a mode-0600 file.
+     */
+    sshAccess(outpostId?: string): Promise<OutpostSshAccess>;
+}
+//# sourceMappingURL=client.d.ts.map

package/dist/outposts/client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/outposts/client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAGH,OAAO,KAAK,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AACvE,OAAO,KAAK,EACV,sBAAsB,EACtB,iBAAiB,EACjB,gBAAgB,EAChB,qBAAqB,EACrB,gBAAgB,EAChB,cAAc,EACd,qBAAqB,EACtB,MAAM,YAAY,CAAC;AAEpB;;;;;;;GAOG;AACH,MAAM,MAAM,kBAAkB,GAAG,MAAM,GAAG,CAAC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;AAE3E,MAAM,WAAW,qBAAqB;IACpC,0EAA0E;IAC1E,SAAS,EAAE,gBAAgB,CAAC;IAC5B,2DAA2D;IAC3D,KAAK,EAAE,kBAAkB,CAAC;IAC1B,wEAAwE;IACxE,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,2DAA2D;AAC3D,MAAM,WAAW,kBAAkB;IACjC,+CAA+C;IAC/C,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,mEAAmE;IACnE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,wEAAwE;IACxE,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAKD,0EAA0E;AAC1E,eAAO,MAAM,wBAAwB,SAAU,CAAC;AAyBhD,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAmB;IAC7C,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAqB;IACjD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAS;gBAEtB,OAAO,EAAE,qBAAqB;IAM1C,gDAAgD;YAClC,KAAK;IAMnB;;;;;OAKG;IACG,OAAO,CAAC,CAAC,EACb,OAAO,EAAE,IAAI,CAAC,cAAc,EAAE,OAAO,GAAG,SAAS,CAAC,GACjD,OAAO,CAAC,CAAC,CAAC;IA+Bb;;;;;;;;;;;;;OAaG;IACG,SAAS,CACb,KAAK,EAAE,qBAAqB,GAC3B,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAanC,qCAAqC;IAC/B,IAAI,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;IAOvC,+BAA+B;IACzB,MAAM,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAOlE,wCAAwC;IAClC,WAAW,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAQvE,oDAAoD;IAC9C,kBAAkB,CACtB,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAQnC;;;;OAIG;IACG,eAAe,CACnB,IAAI,EAAE,MAAM,EACZ,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IASnC;;;;;;OAMG;IACG,OAAO,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAUnE;;;;;;;OAOG;IACG,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAS3E,2DAA2D;IACrD,cAAc,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC;IASnE,yEAAyE;IACnE,UAAU,CACd,OAAO,EAAE,MAAM,EACf,SAAS,CAAC,EAAE,MAAM,EAClB,cAAc,CAAC,EAAE,MAAM,GACtB,OAAO,CAAC,qBAAqB,CAAC;IAajC;;;;;OAKG;IACG,eAAe,CACnB,SAAS,EAAE,MAAM,EACjB,SAAS,CAAC,EAAE,MAAM,EAClB,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,sBAAsB,CAAC;IAUlC;;;;;;;OAOG;IACG,iBAAiB,CACrB,SAAS,EAAE,MAAM,EACjB,SAAS,CAAC,EAAE,MAAM,EAClB,OAAO,GAAE,kBAAuB,GAC/B,OAAO,CAAC,sBAAsB,CAAC;IA0BlC;;;;;;OAMG;IACG,SAAS,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC;CAQ/D"}

package/dist/outposts/client.js

@@ -0,0 +1,271 @@
+/**
+ * `OutpostsClient` — typed client for the hq-pro `/outpost/*` control plane.
+ *
+ * These are the same routes hq-console's outpost panel calls and the same ones
+ * `hq outposts` drives, so this class is the single implementation of the wire
+ * contract for every first-party surface.
+ *
+ * Portable: the only things it touches are its injected transport, its injected
+ * token source, and `setTimeout`. No Node built-ins, no filesystem, no
+ * `process.exit`, no module-level side effects — safe to import from a Next.js
+ * server action, a route handler, or an edge function.
+ *
+ * Outposts are PERSONAL / caller-scoped: hq-pro keys every route on the caller's
+ * Cognito sub, so no method takes a company. `outpostId` selects a specific box;
+ * omitting it targets the caller's primary slot.
+ *
+ * Every non-2xx throws {@link OutpostHttpError} — nothing is swallowed, and the
+ * server's `step` is preserved so callers can distinguish a retryable
+ * `teardown-incomplete` from a real failure.
+ */
+import { OutpostHttpError, parseBillingPayload, parseCappedPayload } from "./errors.js";
+const EXEC_RESULT_INITIAL_POLL_MS = 500;
+const EXEC_RESULT_MAX_POLL_MS = 5_000;
+/** The widest AWS-RunShellScript `executionTimeout`, in seconds (48h). */
+export const EXEC_MAX_TIMEOUT_SECONDS = 172_800;
+function sleep(ms, signal) {
+    return new Promise((resolve, reject) => {
+        if (signal?.aborted) {
+            reject(signal.reason ?? new Error("Aborted"));
+            return;
+        }
+        const timer = setTimeout(() => {
+            signal?.removeEventListener("abort", onAbort);
+            resolve();
+        }, ms);
+        // Do NOT unref this timer. The backoff IS the work while `waitForExecResult`
+        // polls: an unresolved promise alone does not keep Node's event loop alive,
+        // so unref-ing here lets `hq outposts exec --async` / `exec-result --wait`
+        // exit before the next poll ever fires — printing nothing for a command that
+        // is still running.
+        function onAbort() {
+            clearTimeout(timer);
+            reject(signal?.reason ?? new Error("Aborted"));
+        }
+        signal?.addEventListener("abort", onAbort, { once: true });
+    });
+}
+export class OutpostsClient {
+    transport;
+    tokenSource;
+    baseUrl;
+    constructor(options) {
+        this.transport = options.transport;
+        this.tokenSource = options.token;
+        this.baseUrl = options.baseUrl;
+    }
+    /** Resolve the bearer token for one request. */
+    async token() {
+        return typeof this.tokenSource === "function"
+            ? this.tokenSource()
+            : this.tokenSource;
+    }
+    /**
+     * Authenticated JSON round-trip. Throws {@link OutpostHttpError} on any
+     * non-2xx, decoding hq-pro's `{ error | message, step }` envelope for the
+     * reason plus the two structural envelopes (`billing`, `capped`) that carry no
+     * message at all.
+     */
+    async request(options) {
+        const res = await this.transport({
+            ...options,
+            token: await this.token(),
+            ...(this.baseUrl ? { baseUrl: this.baseUrl } : {}),
+        });
+        if (!res.ok) {
+            const body = (await res.json().catch(() => ({})));
+            const message = typeof body.message === "string"
+                ? body.message
+                : typeof body.error === "string"
+                    ? body.error
+                    : res.statusText;
+            throw new OutpostHttpError(res.status, message, body.step, parseBillingPayload(body), parseCappedPayload(body));
+        }
+        return (await res.json());
+    }
+    // -- Lifecycle ------------------------------------------------------------
+    /**
+     * Provision the caller's Outpost.
+     *
+     * `refreshToken` lets the box authenticate AS the caller — the same body
+     * hq-console's `provisionMyOutpost` sends. It travels over HTTPS and is never
+     * logged.
+     *
+     * No duplicate is ever created: a caller already at their per-person cap gets a
+     * `409` whose body lists their existing boxes, surfaced here as an
+     * `OutpostHttpError` carrying `capped`. hq-pro checks the cap BEFORE activation
+     * billing, so a capped call is never charged.
+     *
+     * A payer with no usable card gets a `402` carrying `billing`.
+     */
+    async provision(input) {
+        return this.request({
+            path: "/outpost/provision",
+            method: "POST",
+            body: {
+                refreshToken: input.refreshToken,
+                ...(input.clientIp ? { clientIp: input.clientIp } : {}),
+                ...(input.diskSizeGb ? { diskSizeGb: input.diskSizeGb } : {}),
+                ...(input.agentRuntime ? { agentRuntime: input.agentRuntime } : {}),
+            },
+        });
+    }
+    /** Every Outpost the caller owns. */
+    async list() {
+        const data = await this.request({
+            path: "/outpost/list",
+        });
+        return data.outposts ?? [];
+    }
+    /** Live detail for one box. */
+    async status(outpostId) {
+        return this.request({
+            path: "/outpost/status",
+            query: outpostId ? { outpostId } : undefined,
+        });
+    }
+    /** Enable (or retry) Codex on a box. */
+    async enableCodex(outpostId) {
+        return this.request({
+            path: "/outpost/codex/enable",
+            method: "POST",
+            query: outpostId ? { outpostId } : undefined,
+        });
+    }
+    /** Ask the box to mint a fresh Claude login URL. */
+    async regenerateLoginUrl(outpostId) {
+        return this.request({
+            path: "/outpost/regenerate-login-url",
+            method: "POST",
+            query: outpostId ? { outpostId } : undefined,
+        });
+    }
+    /**
+     * Hand the box the one-time Claude sign-in code from the login URL. hq-pro
+     * stores it as the row's pending code; the box polls for it, feeds it to
+     * `claude`, and flips itself `awaiting-claude-login → ready`.
+     */
+    async submitLoginCode(code, outpostId) {
+        return this.request({
+            path: "/outpost/login-code",
+            method: "POST",
+            body: { code },
+            query: outpostId ? { outpostId } : undefined,
+        });
+    }
+    /**
+     * Permanently destroy a box and its cloud resources.
+     *
+     * Idempotent: a `409` / `step: "teardown-incomplete"` means the gateway's
+     * timeout fired while the Lambda kept working. The row is preserved — re-issue
+     * the same call to finish.
+     */
+    async destroy(outpostId) {
+        return this.request({
+            path: "/outpost/destroy",
+            method: "POST",
+            query: outpostId ? { outpostId } : undefined,
+        });
+    }
+    // -- Exec -----------------------------------------------------------------
+    /**
+     * Run a one-shot shell command via server-brokered SSM (no SSH). Synchronous,
+     * so it is bounded by the API gateway's ~20s cap — use the submit/result pair
+     * for anything longer.
+     *
+     * A `step: "platform-unsupported"` error means the box is Lightsail and has no
+     * SSM agent; fall back to SSH via {@link sshAccess}.
+     */
+    async exec(command, outpostId) {
+        return this.request({
+            path: "/outpost/exec",
+            method: "POST",
+            body: { command },
+            query: outpostId ? { outpostId } : undefined,
+        });
+    }
+    /** Presign an input upload for an asynchronous command. */
+    async stageExecInput(outpostId) {
+        return this.request({
+            path: "/outpost/exec",
+            method: "POST",
+            body: { mode: "stage" },
+            query: outpostId ? { outpostId } : undefined,
+        });
+    }
+    /** Submit an asynchronous command; returns as soon as SSM accepts it. */
+    async submitExec(command, outpostId, timeoutSeconds) {
+        return this.request({
+            path: "/outpost/exec",
+            method: "POST",
+            body: {
+                mode: "submit",
+                command,
+                ...(timeoutSeconds !== undefined ? { timeoutSeconds } : {}),
+            },
+            query: outpostId ? { outpostId } : undefined,
+        });
+    }
+    /**
+     * Poll an asynchronous command once. Streams arrive only once `done`.
+     *
+     * `signal` aborts the in-flight request itself — not just the caller's wait —
+     * so a slow or hung poll is cancelled rather than left pending.
+     */
+    async fetchExecResult(commandId, outpostId, signal) {
+        return this.request({
+            path: "/outpost/exec",
+            method: "POST",
+            body: { mode: "result", commandId },
+            query: outpostId ? { outpostId } : undefined,
+            ...(signal ? { signal } : {}),
+        });
+    }
+    /**
+     * Poll until an asynchronous command reaches a terminal state, backing off
+     * exponentially.
+     *
+     * A `429` is treated as back-pressure and retried — the command is still
+     * running, and giving up on a rate limit would strand a job that is fine. Any
+     * other error propagates.
+     */
+    async waitForExecResult(commandId, outpostId, options = {}) {
+        const maxPollMs = options.maxPollMs ?? EXEC_RESULT_MAX_POLL_MS;
+        let delayMs = options.initialPollMs ?? EXEC_RESULT_INITIAL_POLL_MS;
+        for (;;) {
+            // Abort BEFORE issuing another poll — a signal that fired during the last
+            // backoff must not start a fresh request.
+            if (options.signal?.aborted) {
+                throw options.signal.reason ?? new Error("Aborted");
+            }
+            try {
+                const result = await this.fetchExecResult(commandId, outpostId, options.signal);
+                if (result.done)
+                    return result;
+            }
+            catch (err) {
+                if (!(err instanceof OutpostHttpError) || err.status !== 429)
+                    throw err;
+            }
+            await sleep(delayMs, options.signal);
+            delayMs = Math.min(delayMs * 2, maxPollMs);
+        }
+    }
+    // -- SSH ------------------------------------------------------------------
+    /**
+     * Fetch SSH connection info + key for a box and open the caller's IP on its SSH
+     * port. The route exists to reach a Lightsail box, which has no SSM agent.
+     *
+     * The result carries a PEM private key. Treat it as a credential: never log it,
+     * never return it to a browser, and write it only to a mode-0600 file.
+     */
+    async sshAccess(outpostId) {
+        return this.request({
+            path: "/outpost/ssh-access",
+            method: "POST",
+            body: {},
+            query: outpostId ? { outpostId } : undefined,
+        });
+    }
+}
+//# sourceMappingURL=client.js.map

package/dist/outposts/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../../src/outposts/client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAyCxF,MAAM,2BAA2B,GAAG,GAAG,CAAC;AACxC,MAAM,uBAAuB,GAAG,KAAK,CAAC;AAEtC,0EAA0E;AAC1E,MAAM,CAAC,MAAM,wBAAwB,GAAG,OAAO,CAAC;AAEhD,SAAS,KAAK,CAAC,EAAU,EAAE,MAAoB;IAC7C,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,IAAI,MAAM,EAAE,OAAO,EAAE,CAAC;YACpB,MAAM,CAAC,MAAM,CAAC,MAAM,IAAI,IAAI,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC;YAC9C,OAAO;QACT,CAAC;QACD,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC9C,OAAO,EAAE,CAAC;QACZ,CAAC,EAAE,EAAE,CAAC,CAAC;QACP,6EAA6E;QAC7E,4EAA4E;QAC5E,2EAA2E;QAC3E,6EAA6E;QAC7E,oBAAoB;QACpB,SAAS,OAAO;YACd,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,MAAM,CAAC,MAAM,EAAE,MAAM,IAAI,IAAI,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC;QACjD,CAAC;QACD,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7D,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,OAAO,cAAc;IACR,SAAS,CAAmB;IAC5B,WAAW,CAAqB;IAChC,OAAO,CAAU;IAElC,YAAY,OAA8B;QACxC,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;QACnC,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,KAAK,CAAC;QACjC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IACjC,CAAC;IAED,gDAAgD;IACxC,KAAK,CAAC,KAAK;QACjB,OAAO,OAAO,IAAI,CAAC,WAAW,KAAK,UAAU;YAC3C,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE;YACpB,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC;IACvB,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,OAAO,CACX,OAAkD;QAElD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC;YAC/B,GAAG,OAAO;YACV,KAAK,EAAE,MAAM,IAAI,CAAC,KAAK,EAAE;YACzB,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACnD,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAI/C,CAAC;YACF,MAAM,OAAO,GACX,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ;gBAC9B,CAAC,CAAC,IAAI,CAAC,OAAO;gBACd,CAAC,CAAC,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ;oBAC9B,CAAC,CAAC,IAAI,CAAC,KAAK;oBACZ,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC;YACvB,MAAM,IAAI,gBAAgB,CACxB,GAAG,CAAC,MAAM,EACV,OAAO,EACP,IAAI,CAAC,IAAI,EACT,mBAAmB,CAAC,IAAI,CAAC,EACzB,kBAAkB,CAAC,IAAI,CAAC,CACzB,CAAC;QACJ,CAAC;QACD,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAM,CAAC;IACjC,CAAC;IAED,4EAA4E;IAE5E;;;;;;;;;;;;;OAaG;IACH,KAAK,CAAC,SAAS,CACb,KAA4B;QAE5B,OAAO,IAAI,CAAC,OAAO,CAAC;YAClB,IAAI,EAAE,oBAAoB;YAC1B,MAAM,EAAE,MAAM;YACd,IAAI,EAAE;gBACJ,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACvD,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC7D,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACpE;SACF,CAAC,CAAC;IACL,CAAC;IAED,qCAAqC;IACrC,KAAK,CAAC,IAAI;QACR,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAkC;YAC/D,IAAI,EAAE,eAAe;SACtB,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC;IAC7B,CAAC;IAED,+BAA+B;IAC/B,KAAK,CAAC,MAAM,CAAC,SAAkB;QAC7B,OAAO,IAAI,CAAC,OAAO,CAAC;YAClB,IAAI,EAAE,iBAAiB;YACvB,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,SAAS;SAC7C,CAAC,CAAC;IACL,CAAC;IAED,wCAAwC;IACxC,KAAK,CAAC,WAAW,CAAC,SAAkB;QAClC,OAAO,IAAI,CAAC,OAAO,CAAC;YAClB,IAAI,EAAE,uBAAuB;YAC7B,MAAM,EAAE,MAAM;YACd,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,SAAS;SAC7C,CAAC,CAAC;IACL,CAAC;IAED,oDAAoD;IACpD,KAAK,CAAC,kBAAkB,CACtB,SAAkB;QAElB,OAAO,IAAI,CAAC,OAAO,CAAC;YAClB,IAAI,EAAE,+BAA+B;YACrC,MAAM,EAAE,MAAM;YACd,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,SAAS;SAC7C,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,eAAe,CACnB,IAAY,EACZ,SAAkB;QAElB,OAAO,IAAI,CAAC,OAAO,CAAC;YAClB,IAAI,EAAE,qBAAqB;YAC3B,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,EAAE,IAAI,EAAE;YACd,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,SAAS;SAC7C,CAAC,CAAC;IACL,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,OAAO,CAAC,SAAkB;QAC9B,OAAO,IAAI,CAAC,OAAO,CAAC;YAClB,IAAI,EAAE,kBAAkB;YACxB,MAAM,EAAE,MAAM;YACd,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,SAAS;SAC7C,CAAC,CAAC;IACL,CAAC;IAED,4EAA4E;IAE5E;;;;;;;OAOG;IACH,KAAK,CAAC,IAAI,CAAC,OAAe,EAAE,SAAkB;QAC5C,OAAO,IAAI,CAAC,OAAO,CAAC;YAClB,IAAI,EAAE,eAAe;YACrB,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,EAAE,OAAO,EAAE;YACjB,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,SAAS;SAC7C,CAAC,CAAC;IACL,CAAC;IAED,2DAA2D;IAC3D,KAAK,CAAC,cAAc,CAAC,SAAkB;QACrC,OAAO,IAAI,CAAC,OAAO,CAAC;YAClB,IAAI,EAAE,eAAe;YACrB,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;YACvB,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,SAAS;SAC7C,CAAC,CAAC;IACL,CAAC;IAED,yEAAyE;IACzE,KAAK,CAAC,UAAU,CACd,OAAe,EACf,SAAkB,EAClB,cAAuB;QAEvB,OAAO,IAAI,CAAC,OAAO,CAAC;YAClB,IAAI,EAAE,eAAe;YACrB,MAAM,EAAE,MAAM;YACd,IAAI,EAAE;gBACJ,IAAI,EAAE,QAAQ;gBACd,OAAO;gBACP,GAAG,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC5D;YACD,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,SAAS;SAC7C,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,eAAe,CACnB,SAAiB,EACjB,SAAkB,EAClB,MAAoB;QAEpB,OAAO,IAAI,CAAC,OAAO,CAAC;YAClB,IAAI,EAAE,eAAe;YACrB,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE;YACnC,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,SAAS;YAC5C,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9B,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,iBAAiB,CACrB,SAAiB,EACjB,SAAkB,EAClB,UAA8B,EAAE;QAEhC,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,uBAAuB,CAAC;QAC/D,IAAI,OAAO,GAAG,OAAO,CAAC,aAAa,IAAI,2BAA2B,CAAC;QACnE,SAAS,CAAC;YACR,0EAA0E;YAC1E,0CAA0C;YAC1C,IAAI,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;gBAC5B,MAAM,OAAO,CAAC,MAAM,CAAC,MAAM,IAAI,IAAI,KAAK,CAAC,SAAS,CAAC,CAAC;YACtD,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,eAAe,CACvC,SAAS,EACT,SAAS,EACT,OAAO,CAAC,MAAM,CACf,CAAC;gBACF,IAAI,MAAM,CAAC,IAAI;oBAAE,OAAO,MAAM,CAAC;YACjC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,CAAC,CAAC,GAAG,YAAY,gBAAgB,CAAC,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;oBAAE,MAAM,GAAG,CAAC;YAC1E,CAAC;YACD,MAAM,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;YACrC,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,GAAG,CAAC,EAAE,SAAS,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC;IAED,4EAA4E;IAE5E;;;;;;OAMG;IACH,KAAK,CAAC,SAAS,CAAC,SAAkB;QAChC,OAAO,IAAI,CAAC,OAAO,CAAC;YAClB,IAAI,EAAE,qBAAqB;YAC3B,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,EAAE;YACR,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,SAAS;SAC7C,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/outposts/client.test.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Unit tests for OutpostsClient against a stub transport.
+ *
+ * The command-tree tests cover the wire shapes end-to-end; these focus on the
+ * client's own logic: error decoding for all three envelopes, the token-source
+ * resolution contract, and the exec-result polling/backoff.
+ */
+export {};
+//# sourceMappingURL=client.test.d.ts.map

package/dist/outposts/client.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.test.d.ts","sourceRoot":"","sources":["../../src/outposts/client.test.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG"}