@indigoai-us/hq-cloud 6.15.4 → 6.15.6

package/dist/outposts/transport.js

@@ -0,0 +1,91 @@
+/**
+ * The HTTP seam for the `/outpost/*` control plane.
+ *
+ * Every request the client makes goes through an injected {@link OutpostTransport}
+ * rather than calling `fetch` directly. That indirection is the whole reason this
+ * module is portable:
+ *
+ *   - hq-cli passes its own `vaultApiFetch`, keeping Sentry breadcrumbs, the
+ *     `hqk_` API-key path rewrite table, plan-gate decoding, and plan-limit
+ *     peeking exactly as they were before this code moved out of the CLI.
+ *   - a Next.js app (server action / route handler) passes
+ *     {@link createOutpostTransport}, which is a thin authenticated `fetch` with
+ *     no Node built-ins and no ambient state.
+ *   - a test passes a stub and asserts on the request shape.
+ *
+ * The option bag deliberately matches hq-cli's `VaultApiOptions` field-for-field
+ * so `vaultApiFetch` satisfies `OutpostTransport` structurally — no adapter, no
+ * chance of the two drifting into a subtle mismatch.
+ */
+/**
+ * The public hq-pro control plane. `HQ_VAULT_API_URL` overrides it, matching
+ * hq-cli's `DEFAULT_VAULT_API_URL` and hq-cloud's sync runner so all three
+ * surfaces resolve against the SAME plane by default — a token minted for one
+ * deployment and sent to another is simply rejected, which reads to the user as
+ * a confusing auth failure.
+ *
+ * Read lazily rather than captured at module load: a Next.js server bundle can
+ * evaluate this module before the runtime environment is populated, and a value
+ * frozen at import time would silently pin the wrong origin.
+ *
+ * The default `env` is obtained through a guarded lookup, never a bare
+ * `process.env`. An edge isolate need not define the Node `process` global, and
+ * evaluating `process.env` as a default parameter there throws
+ * `ReferenceError: process is not defined` before a request is ever made —
+ * exactly the environment this portable client is meant to support.
+ */
+function safeProcessEnv() {
+    return typeof process !== "undefined" && process.env ? process.env : {};
+}
+export function defaultOutpostApiUrl(env = safeProcessEnv()) {
+    return env.HQ_VAULT_API_URL ?? "https://hqapi.hq.computer";
+}
+/**
+ * Build a plain authenticated-`fetch` transport. This is the default wiring for
+ * any non-CLI consumer — notably a Next.js server action or route handler.
+ *
+ * Uses no Node built-ins and keeps no module-level state, so it works unchanged
+ * on the Node and edge runtimes. Never attach this to a client component: the
+ * bearer token must stay server-side.
+ *
+ * ```ts
+ * // app/outposts/actions.ts
+ * "use server";
+ * import { OutpostsClient, createOutpostTransport } from "@indigoai-us/hq-cloud/outposts";
+ *
+ * const client = new OutpostsClient({
+ *   transport: createOutpostTransport(),
+ *   token: async () => (await auth())!.idToken,
+ * });
+ *
+ * export async function listMyOutposts() {
+ *   return client.list();
+ * }
+ * ```
+ */
+export function createOutpostTransport(options = {}) {
+    return async (request) => {
+        const fetchImpl = options.fetch ?? globalThis.fetch;
+        if (typeof fetchImpl !== "function") {
+            throw new Error("No fetch implementation available — pass `fetch` to createOutpostTransport().");
+        }
+        const base = request.baseUrl ?? options.baseUrl ?? defaultOutpostApiUrl();
+        const url = new URL(request.path, base);
+        if (request.query) {
+            for (const [key, value] of Object.entries(request.query)) {
+                url.searchParams.set(key, value);
+            }
+        }
+        return fetchImpl(url.toString(), {
+            method: request.method ?? "GET",
+            headers: {
+                Authorization: `Bearer ${request.token}`,
+                "Content-Type": "application/json",
+                ...options.headers,
+            },
+            body: request.body ? JSON.stringify(request.body) : undefined,
+            signal: request.signal,
+        });
+    };
+}
+//# sourceMappingURL=transport.js.map

package/dist/outposts/transport.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"transport.js","sourceRoot":"","sources":["../../src/outposts/transport.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAkCH;;;;;;;;;;;;;;;;GAgBG;AACH,SAAS,cAAc;IACrB,OAAO,OAAO,OAAO,KAAK,WAAW,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;AAC1E,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,MAA0C,cAAc,EAAE;IAE1D,OAAO,GAAG,CAAC,gBAAgB,IAAI,2BAA2B,CAAC;AAC7D,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,sBAAsB,CACpC,UAOI,EAAE;IAEN,OAAO,KAAK,EAAE,OAAO,EAAE,EAAE;QACvB,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC;QACpD,IAAI,OAAO,SAAS,KAAK,UAAU,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CACb,+EAA+E,CAChF,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,OAAO,IAAI,oBAAoB,EAAE,CAAC;QAC1E,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACxC,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;YAClB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBACzD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACnC,CAAC;QACH,CAAC;QACD,OAAO,SAAS,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE;YAC/B,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,KAAK;YAC/B,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,OAAO,CAAC,KAAK,EAAE;gBACxC,cAAc,EAAE,kBAAkB;gBAClC,GAAG,OAAO,CAAC,OAAO;aACnB;YACD,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;YAC7D,MAAM,EAAE,OAAO,CAAC,MAAM;SACvB,CAAC,CAAC;IACL,CAAC,CAAC;AACJ,CAAC"}

package/dist/outposts/transport.test.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Unit tests for the portable transport seam.
+ *
+ * These pin the two behaviours a Next.js consumer relies on: the default
+ * transport is a plain authenticated `fetch` with an injectable implementation,
+ * and the API origin is read lazily from the environment rather than frozen at
+ * module load.
+ */
+export {};
+//# sourceMappingURL=transport.test.d.ts.map

package/dist/outposts/transport.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"transport.test.d.ts","sourceRoot":"","sources":["../../src/outposts/transport.test.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG"}

package/dist/outposts/transport.test.js

@@ -0,0 +1,116 @@
+/**
+ * Unit tests for the portable transport seam.
+ *
+ * These pin the two behaviours a Next.js consumer relies on: the default
+ * transport is a plain authenticated `fetch` with an injectable implementation,
+ * and the API origin is read lazily from the environment rather than frozen at
+ * module load.
+ */
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import { createOutpostTransport, defaultOutpostApiUrl, } from "./transport.js";
+describe("defaultOutpostApiUrl", () => {
+    it("falls back to the public control plane", () => {
+        expect(defaultOutpostApiUrl({})).toBe("https://hqapi.hq.computer");
+    });
+    it("honours HQ_VAULT_API_URL", () => {
+        expect(defaultOutpostApiUrl({ HQ_VAULT_API_URL: "https://hqapi.test.invalid" })).toBe("https://hqapi.test.invalid");
+    });
+    it("does not touch the Node process global when it is absent (edge runtime)", () => {
+        // An edge isolate need not define `process`. Evaluating the default param
+        // must not throw ReferenceError there — it must fall back to the public
+        // origin. Simulate by deleting the global for the duration of the call.
+        const descriptor = Object.getOwnPropertyDescriptor(globalThis, "process");
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        delete globalThis.process;
+        try {
+            expect(() => defaultOutpostApiUrl()).not.toThrow();
+            expect(defaultOutpostApiUrl()).toBe("https://hqapi.hq.computer");
+        }
+        finally {
+            if (descriptor)
+                Object.defineProperty(globalThis, "process", descriptor);
+        }
+    });
+    it("reads the environment lazily, not at import time", () => {
+        // A Next.js bundle can evaluate this module before the runtime env is
+        // populated. Freezing the value at import would pin the wrong origin.
+        const before = defaultOutpostApiUrl({});
+        const after = defaultOutpostApiUrl({
+            HQ_VAULT_API_URL: "https://later.invalid",
+        });
+        expect(before).not.toBe(after);
+    });
+});
+describe("createOutpostTransport", () => {
+    let fetchImpl;
+    beforeEach(() => {
+        fetchImpl = vi.fn(async () => new Response("{}", { status: 200 }));
+    });
+    afterEach(() => {
+        vi.restoreAllMocks();
+    });
+    it("attaches the bearer token and JSON content type", async () => {
+        const transport = createOutpostTransport({
+            baseUrl: "https://hqapi.test.invalid",
+            fetch: fetchImpl,
+        });
+        await transport({ token: "tok", path: "/outpost/list" });
+        const [url, init] = fetchImpl.mock.calls[0];
+        expect(url).toBe("https://hqapi.test.invalid/outpost/list");
+        expect(init.method).toBe("GET");
+        expect(init.headers.Authorization).toBe("Bearer tok");
+        expect(init.headers["Content-Type"]).toBe("application/json");
+    });
+    it("serializes the body and appends query params", async () => {
+        const transport = createOutpostTransport({
+            baseUrl: "https://hqapi.test.invalid",
+            fetch: fetchImpl,
+        });
+        await transport({
+            token: "tok",
+            path: "/outpost/exec",
+            method: "POST",
+            body: { mode: "submit", command: "ls" },
+            query: { outpostId: "2" },
+        });
+        const [url, init] = fetchImpl.mock.calls[0];
+        expect(String(url)).toContain("/outpost/exec?outpostId=2");
+        expect(init.method).toBe("POST");
+        expect(JSON.parse(init.body)).toEqual({ mode: "submit", command: "ls" });
+    });
+    it("merges extra headers (e.g. client identification)", async () => {
+        const transport = createOutpostTransport({
+            baseUrl: "https://hqapi.test.invalid",
+            fetch: fetchImpl,
+            headers: { "x-hq-client": "console" },
+        });
+        await transport({ token: "tok", path: "/outpost/list" });
+        const headers = fetchImpl.mock.calls[0][1].headers;
+        expect(headers["x-hq-client"]).toBe("console");
+    });
+    it("lets a per-request baseUrl override the transport default", async () => {
+        const transport = createOutpostTransport({
+            baseUrl: "https://default.invalid",
+            fetch: fetchImpl,
+        });
+        await transport({
+            token: "tok",
+            path: "/outpost/list",
+            baseUrl: "https://override.invalid",
+        });
+        expect(String(fetchImpl.mock.calls[0][0])).toContain("https://override.invalid");
+    });
+    it("throws a clear error when no fetch is available", async () => {
+        const original = globalThis.fetch;
+        // Simulate a runtime with no global fetch and no injected one.
+        globalThis.fetch = undefined;
+        try {
+            const transport = createOutpostTransport();
+            await expect(transport({ token: "tok", path: "/outpost/list" })).rejects.toThrow(/No fetch implementation/);
+        }
+        finally {
+            globalThis.fetch = original;
+        }
+    });
+});
+//# sourceMappingURL=transport.test.js.map

package/dist/outposts/transport.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"transport.test.js","sourceRoot":"","sources":["../../src/outposts/transport.test.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AACzE,OAAO,EACL,sBAAsB,EACtB,oBAAoB,GAErB,MAAM,gBAAgB,CAAC;AAExB,QAAQ,CAAC,sBAAsB,EAAE,GAAG,EAAE;IACpC,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;QAChD,MAAM,CAAC,oBAAoB,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;IACrE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0BAA0B,EAAE,GAAG,EAAE;QAClC,MAAM,CACJ,oBAAoB,CAAC,EAAE,gBAAgB,EAAE,4BAA4B,EAAE,CAAC,CACzE,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yEAAyE,EAAE,GAAG,EAAE;QACjF,0EAA0E;QAC1E,wEAAwE;QACxE,wEAAwE;QACxE,MAAM,UAAU,GAAG,MAAM,CAAC,wBAAwB,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;QAC1E,8DAA8D;QAC9D,OAAQ,UAAkB,CAAC,OAAO,CAAC;QACnC,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,EAAE,CAAC,oBAAoB,EAAE,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;YACnD,MAAM,CAAC,oBAAoB,EAAE,CAAC,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;QACnE,CAAC;gBAAS,CAAC;YACT,IAAI,UAAU;gBAAE,MAAM,CAAC,cAAc,CAAC,UAAU,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;QAC3E,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kDAAkD,EAAE,GAAG,EAAE;QAC1D,sEAAsE;QACtE,sEAAsE;QACtE,MAAM,MAAM,GAAG,oBAAoB,CAAC,EAAE,CAAC,CAAC;QACxC,MAAM,KAAK,GAAG,oBAAoB,CAAC;YACjC,gBAAgB,EAAE,uBAAuB;SAC1C,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACjC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,wBAAwB,EAAE,GAAG,EAAE;IACtC,IAAI,SAAmC,CAAC;IAExC,UAAU,CAAC,GAAG,EAAE;QACd,SAAS,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;IACrE,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC,GAAG,EAAE;QACb,EAAE,CAAC,eAAe,EAAE,CAAC;IACvB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iDAAiD,EAAE,KAAK,IAAI,EAAE;QAC/D,MAAM,SAAS,GAAG,sBAAsB,CAAC;YACvC,OAAO,EAAE,4BAA4B;YACrC,KAAK,EAAE,SAAiC;SACzC,CAAC,CAAC;QACH,MAAM,SAAS,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC,CAAC;QACzD,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC5C,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,yCAAyC,CAAC,CAAC;QAC5D,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAChC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACtD,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;IAChE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8CAA8C,EAAE,KAAK,IAAI,EAAE;QAC5D,MAAM,SAAS,GAAG,sBAAsB,CAAC;YACvC,OAAO,EAAE,4BAA4B;YACrC,KAAK,EAAE,SAAiC;SACzC,CAAC,CAAC;QACH,MAAM,SAAS,CAAC;YACd,KAAK,EAAE,KAAK;YACZ,IAAI,EAAE,eAAe;YACrB,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE;YACvC,KAAK,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE;SAC1B,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC5C,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,2BAA2B,CAAC,CAAC;QAC3D,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACjC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mDAAmD,EAAE,KAAK,IAAI,EAAE;QACjE,MAAM,SAAS,GAAG,sBAAsB,CAAC;YACvC,OAAO,EAAE,4BAA4B;YACrC,KAAK,EAAE,SAAiC;YACxC,OAAO,EAAE,EAAE,aAAa,EAAE,SAAS,EAAE;SACtC,CAAC,CAAC;QACH,MAAM,SAAS,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC,CAAC;QACzD,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;QACnD,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2DAA2D,EAAE,KAAK,IAAI,EAAE;QACzE,MAAM,SAAS,GAAG,sBAAsB,CAAC;YACvC,OAAO,EAAE,yBAAyB;YAClC,KAAK,EAAE,SAAiC;SACzC,CAAC,CAAC;QACH,MAAM,SAAS,CAAC;YACd,KAAK,EAAE,KAAK;YACZ,IAAI,EAAE,eAAe;YACrB,OAAO,EAAE,0BAA0B;SACpC,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,0BAA0B,CAAC,CAAC;IACnF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iDAAiD,EAAE,KAAK,IAAI,EAAE;QAC/D,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC;QAClC,+DAA+D;QAC9D,UAAkC,CAAC,KAAK,GAAG,SAAS,CAAC;QACtD,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,sBAAsB,EAAE,CAAC;YAC3C,MAAM,MAAM,CACV,SAAS,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC,CACnD,CAAC,OAAO,CAAC,OAAO,CAAC,yBAAyB,CAAC,CAAC;QAC/C,CAAC;gBAAS,CAAC;YACT,UAAU,CAAC,KAAK,GAAG,QAAQ,CAAC;QAC9B,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/outposts/types.d.ts

@@ -0,0 +1,125 @@
+/**
+ * Wire types for the hq-pro `/outpost/*` control plane.
+ *
+ * Portable by construction: this module imports nothing. It is safe to load
+ * from a Next.js server action, a route handler, an edge function, or a CLI.
+ *
+ * Outposts are PERSONAL / caller-scoped — hq-pro keys every `/outpost/*` route
+ * on the caller's Cognito sub, so there is no company parameter anywhere in
+ * this surface. `outpostId` selects a specific box; omitting it targets the
+ * caller's primary slot.
+ */
+/** Row summary from `GET /outpost/list`. */
+export interface OutpostSummary {
+    outpostId: string;
+    state: string;
+    instanceName: string;
+    region: string;
+    agentRuntime: string;
+    platform: string;
+    createdAt: string;
+    [key: string]: unknown;
+}
+/** The agent runtime a box is provisioned with. */
+export type OutpostAgentRuntime = "claude" | "codex";
+/** Body for `POST /outpost/provision`. */
+export interface ProvisionOutpostInput {
+    /**
+     * The caller's Cognito refresh token, so the box can authenticate AS the
+     * caller. SENSITIVE — sent over HTTPS and never logged or printed.
+     */
+    refreshToken: string;
+    /** The caller's public IP for the box's SSH ingress. Server derives it otherwise. */
+    clientIp?: string;
+    /** Root disk size in GB (EC2 only). */
+    diskSizeGb?: number;
+    /** Defaults to `claude` server-side when omitted. */
+    agentRuntime?: OutpostAgentRuntime;
+}
+/**
+ * hq-pro's per-person cap envelope on a `409` provision block. Unlike every
+ * other `/outpost/*` failure this body carries NO `message`/`error` field —
+ * only the cap facts — so it has to be decoded structurally or the reason
+ * degrades to a bare `res.statusText` ("Conflict").
+ */
+export interface OutpostCappedPayload {
+    limit: number;
+    outposts: OutpostSummary[];
+}
+/** Result of a synchronous `POST /outpost/exec` — one SSM invocation. */
+export interface OutpostExecResult {
+    ok: true;
+    outpostId: string;
+    instanceId: string;
+    commandId: string;
+    /** SSM invocation status (Success | Failed | Cancelled). */
+    status: string;
+    /** Remote process exit code, or null when SSM reported none. */
+    exitCode: number | null;
+    stdout: string;
+    stderr: string;
+    /** True when SSM clipped stdout/stderr at its inline output limit. */
+    truncated: boolean;
+}
+/** Presigned input-upload details from `mode: "stage"`. */
+export interface OutpostExecStage {
+    ok: true;
+    userId: string;
+    outpostId: string;
+    key: string;
+    putUrl: string;
+    getUrl: string;
+    expiresInSeconds: number;
+}
+/** Asynchronous SSM command details from `mode: "submit"`. */
+export interface OutpostExecSubmission {
+    ok: true;
+    userId: string;
+    outpostId: string;
+    instanceId: string;
+    commandId: string;
+    outputPrefix: string;
+    /** Shell budget applied server-side (AWS-RunShellScript executionTimeout). */
+    executionTimeoutSeconds?: number;
+}
+/** Poll response from `mode: "result"`; streams arrive only when terminal. */
+export interface OutpostExecAsyncResult {
+    ok: true;
+    userId: string;
+    outpostId: string;
+    status: string;
+    done: boolean;
+    exitCode?: number | null;
+    stdout?: string;
+    stderr?: string;
+    truncated?: boolean;
+}
+/** SSH connection details vended by `POST /outpost/ssh-access`. */
+export interface OutpostSshAccess {
+    outpostId: string;
+    platform: "ec2" | "lightsail";
+    host: string;
+    port: number;
+    username: string;
+    /** PEM private key for the box. SENSITIVE — never print or log this. */
+    privateKey: string;
+}
+/**
+ * The server-supplied "how to add a card" action on a `402 billing_required`.
+ * Mirrors hq-pro `src/billing/activation-billing.ts` `BillingSetupAction` and
+ * hq-console's `src/lib/billing-setup.ts`.
+ */
+export interface BillingSetupAction {
+    payerType: "company" | "person";
+    path: "/v1/billing/checkout/org" | "/v1/billing/checkout/person";
+    method: "POST";
+    body?: {
+        companyUid?: string;
+    };
+}
+/** The `billing` envelope hq-pro attaches to a billing-blocked provision. */
+export interface BillingErrorPayload {
+    status: string;
+    setup?: BillingSetupAction;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/outposts/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/outposts/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,4CAA4C;AAC5C,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,mDAAmD;AACnD,MAAM,MAAM,mBAAmB,GAAG,QAAQ,GAAG,OAAO,CAAC;AAErD,0CAA0C;AAC1C,MAAM,WAAW,qBAAqB;IACpC;;;OAGG;IACH,YAAY,EAAE,MAAM,CAAC;IACrB,qFAAqF;IACrF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,uCAAuC;IACvC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,qDAAqD;IACrD,YAAY,CAAC,EAAE,mBAAmB,CAAC;CACpC;AAED;;;;;GAKG;AACH,MAAM,WAAW,oBAAoB;IACnC,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,cAAc,EAAE,CAAC;CAC5B;AAED,yEAAyE;AACzE,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,IAAI,CAAC;IACT,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,4DAA4D;IAC5D,MAAM,EAAE,MAAM,CAAC;IACf,gEAAgE;IAChE,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,sEAAsE;IACtE,SAAS,EAAE,OAAO,CAAC;CACpB;AAED,2DAA2D;AAC3D,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,IAAI,CAAC;IACT,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,gBAAgB,EAAE,MAAM,CAAC;CAC1B;AAED,8DAA8D;AAC9D,MAAM,WAAW,qBAAqB;IACpC,EAAE,EAAE,IAAI,CAAC;IACT,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,8EAA8E;IAC9E,uBAAuB,CAAC,EAAE,MAAM,CAAC;CAClC;AAED,8EAA8E;AAC9E,MAAM,WAAW,sBAAsB;IACrC,EAAE,EAAE,IAAI,CAAC;IACT,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,OAAO,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED,mEAAmE;AACnE,MAAM,WAAW,gBAAgB;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,KAAK,GAAG,WAAW,CAAC;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,wEAAwE;IACxE,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,SAAS,GAAG,QAAQ,CAAC;IAChC,IAAI,EAAE,0BAA0B,GAAG,6BAA6B,CAAC;IACjE,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAChC;AAED,6EAA6E;AAC7E,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,kBAAkB,CAAC;CAC5B"}

package/dist/outposts/types.js

@@ -0,0 +1,13 @@
+/**
+ * Wire types for the hq-pro `/outpost/*` control plane.
+ *
+ * Portable by construction: this module imports nothing. It is safe to load
+ * from a Next.js server action, a route handler, an edge function, or a CLI.
+ *
+ * Outposts are PERSONAL / caller-scoped — hq-pro keys every `/outpost/*` route
+ * on the caller's Cognito sub, so there is no company parameter anywhere in
+ * this surface. `outpostId` selects a specific box; omitting it targets the
+ * caller's primary slot.
+ */
+export {};
+//# sourceMappingURL=types.js.map

package/dist/outposts/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/outposts/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG"}

package/dist/personal-vault.d.ts

@@ -44,6 +44,7 @@
  * on v12–v14 roots with no `core/core.yaml`, the root `core.yaml` IS the
  * scaffold/version manifest and round-trips like any other top-level file.
  */
+import type { SyncJournal } from "./types.js";
 export declare const PERSONAL_VAULT_EXCLUDED_TOP_LEVEL: readonly string[];
 /**
  * Company slugs that are never eligible for the personal-bucket fallback,
@@ -229,4 +230,72 @@ export declare function computePersonalCompanySubdirs(hqRoot: string, teamSynced
  * Only `cmp_*` uids count (same rule as company-resolver / telemetry).
  */
 export declare function readCloudBackedSlugsFromManifest(hqRoot: string): Set<string>;
+/**
+ * Result of a {@link purgeExcludedPersonalVaultJournalEntries} pass.
+ */
+export interface PersonalVaultJournalPurge {
+    /** Vault keys removed from the journal, capped-free (full list). */
+    removed: string[];
+    /** Count of removed entries, bucketed by the reason class that caught them. */
+    byReason: Record<PersonalVaultJournalPurgeReason, number>;
+}
+export type PersonalVaultJournalPurgeReason = "ignore-filtered" | "excluded-top-level";
+/**
+ * Purge journal entries that fall OUTSIDE the current personal-vault push
+ * scope, so a stale baseline written by an older engine (before an exclusion
+ * rule existed) converges instead of being re-diffed on every push forever.
+ *
+ * WHY THIS EXISTS. The push WALK already prunes excluded trees correctly
+ * (`collectFiles`/`walkDir` in share.ts apply the same filter and never descend
+ * into `.claude/worktrees/`, `node_modules/`, etc.). But nothing ever REMOVES a
+ * journal entry that predates an exclusion rule: `computeDeletePlan` skips such
+ * an entry (either because its local file still exists — the `presentLocally`
+ * short-circuit — or because the exclusion filter rejects it) WITHOUT deleting
+ * the journal row, and `finalizeShareJournal` then writes the journal back
+ * verbatim. So entries under rules added after they were first journaled —
+ * the `.claude/worktrees/` default ignore (added 5.8.2), the `workspace/`
+ * top-level exclusion, the `.hq-conflicts/` conflict-mirror rule, the
+ * `.conflict-*` ephemeral pattern, `node_modules/` — persist indefinitely, are
+ * re-`lstat`'d every push, and keep the baseline from ever stabilising.
+ *
+ * The two exclusion mechanisms this mirrors:
+ *   1. `shouldSync` — the shared ignore filter (`createIgnoreFilter`) plus, in
+ *      personal mode, the personal-vault default exclusions. Catches
+ *      `.claude/worktrees/`, `node_modules/`, `.hq-conflicts/`, `.env`, etc.
+ *   2. The `workspace/` (and `repos/`) top-level exclusion, which lives ONLY at
+ *      the walk-root level (`PERSONAL_VAULT_EXCLUDED_TOP_LEVEL`, applied by
+ *      `computePersonalVaultPaths`) and is therefore INVISIBLE to `shouldSync`.
+ *      The synced carve-outs under `workspace/` (the continuity pointer + its
+ *      active thread, `workspace/agency/`, `workspace/.session-logs/`) are
+ *      re-included so they are never purged.
+ *
+ * DEFERS to two existing owners so it is a pure safety-net for the classes no
+ * other mechanism drains:
+ *   - `isVaultLitterArtifact` (`isLitterArtifact` here) — conflict-mirror
+ *     (`.conflict-*`) and rescue-drift (`.drift-*`) litter is REMOTELY DELETED
+ *     by `computeDeletePlan`'s litter drain when the local file is gone, which
+ *     is stronger than forgetting the row. Never purge it here — that would
+ *     preempt the remote cleanup and strand the vault object.
+ *   - `isPersonalVaultDeletionExcluded` — release scaffold (`core/`),
+ *     reindex-generated skill wrappers (`.claude/skills/<ns>:<skill>/`), and
+ *     command wrappers are recreated locally by a release / `hq reindex`, so
+ *     their journal rows are deliberately retained (a local absence is not user
+ *     intent). Keep them.
+ *
+ * `companies/` is deliberately NOT purged here even though it is in
+ * `PERSONAL_VAULT_EXCLUDED_TOP_LEVEL`: local companies legitimately journal
+ * `companies/{slug}/…` keys, and cloud companies' stale keys are drained by the
+ * separate decommission plan (`computeDecommissionPlan`) — purging them here
+ * would rob that plan of the journal rows it deletes remotely against.
+ *
+ * Disposition is option (a) of the stale-journal question: drop the row so it
+ * is no longer re-diffed. Any remote object the row pointed at is left as an
+ * inert orphan — the PULL leg already refuses these keys
+ * (`computePullPlan` in sync.ts consults the same filters), so a peer can never
+ * rematerialise them, and existing rescue/litter tooling sweeps the remote.
+ *
+ * Mutates `journal.files` in place and returns what was removed for a summary
+ * event. Pure w.r.t. the filesystem beyond the carve-out probes.
+ */
+export declare function purgeExcludedPersonalVaultJournalEntries(journal: SyncJournal, hqRoot: string, syncRoot: string, shouldSync: (absPath: string, isDir?: boolean) => boolean, isLitterArtifact: (key: string) => boolean): PersonalVaultJournalPurge;
 //# sourceMappingURL=personal-vault.d.ts.map

package/dist/personal-vault.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"personal-vault.d.ts","sourceRoot":"","sources":["../src/personal-vault.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AAMH,eAAO,MAAM,iCAAiC,EAAE,SAAS,MAAM,EAK9D,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,qCAAqC,EAAE,SAAS,MAAM,EAElE,CAAC;AAEF,MAAM,WAAW,oBAAoB;IACnC;;;;;;;;OAQG;IACH,eAAe,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CACvC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH;;;;;;GAMG;AACH,eAAO,MAAM,2BAA2B,4BAA4B,CAAC;AAErE;;;;;;;;;;GAUG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAU7D;AAED;;;;GAIG;AACH,wBAAgB,+BAA+B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAepE;AAED,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,MAAM,EACd,IAAI,GAAE,oBAAyB,GAC9B,MAAM,EAAE,CAwCV;AAED;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,mCAAmC,CAAC;AAEvE;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAgB,6BAA6B,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAoDtE;AAED;;;GAGG;AACH,eAAO,MAAM,eAAe,qBAAqB,CAAC;AAElD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAQ/D;AAED;;;GAGG;AACH,eAAO,MAAM,qBAAqB,4BAA4B,CAAC;AAE/D;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,2BAA2B,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAQpE;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,6BAA6B,CAC3C,MAAM,EAAE,MAAM,EACd,eAAe,GAAE,WAAW,CAAC,MAAM,CAAa,GAC/C,MAAM,EAAE,CA8BV;AAED;;;;;;;GAOG;AACH,wBAAgB,gCAAgC,CAAC,MAAM,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAmC5E"}
+{"version":3,"file":"personal-vault.d.ts","sourceRoot":"","sources":["../src/personal-vault.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AASH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAE9C,eAAO,MAAM,iCAAiC,EAAE,SAAS,MAAM,EAK9D,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,qCAAqC,EAAE,SAAS,MAAM,EAElE,CAAC;AAEF,MAAM,WAAW,oBAAoB;IACnC;;;;;;;;OAQG;IACH,eAAe,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CACvC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH;;;;;;GAMG;AACH,eAAO,MAAM,2BAA2B,4BAA4B,CAAC;AAErE;;;;;;;;;;GAUG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAU7D;AAED;;;;GAIG;AACH,wBAAgB,+BAA+B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAepE;AAED,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,MAAM,EACd,IAAI,GAAE,oBAAyB,GAC9B,MAAM,EAAE,CAwCV;AAED;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,mCAAmC,CAAC;AAEvE;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAgB,6BAA6B,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAoDtE;AAED;;;GAGG;AACH,eAAO,MAAM,eAAe,qBAAqB,CAAC;AAElD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAQ/D;AAED;;;GAGG;AACH,eAAO,MAAM,qBAAqB,4BAA4B,CAAC;AAE/D;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,2BAA2B,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAQpE;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,6BAA6B,CAC3C,MAAM,EAAE,MAAM,EACd,eAAe,GAAE,WAAW,CAAC,MAAM,CAAa,GAC/C,MAAM,EAAE,CA8BV;AAED;;;;;;;GAOG;AACH,wBAAgB,gCAAgC,CAAC,MAAM,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAmC5E;AAqCD;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACxC,oEAAoE;IACpE,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,+EAA+E;IAC/E,QAAQ,EAAE,MAAM,CAAC,+BAA+B,EAAE,MAAM,CAAC,CAAC;CAC3D;AAED,MAAM,MAAM,+BAA+B,GACvC,iBAAiB,GACjB,oBAAoB,CAAC;AAEzB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwDG;AACH,wBAAgB,wCAAwC,CACtD,OAAO,EAAE,WAAW,EACpB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO,KAAK,OAAO,EACzD,gBAAgB,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,GACzC,yBAAyB,CA+C3B"}

package/dist/personal-vault.js

@@ -47,6 +47,7 @@
 import * as fs from "fs";
 import * as path from "path";
 import { isGeneratedCommandWrapperPath } from "./personal-vault-exclusions.js";
+import { localPathForVaultKey, vaultKeyForLocalPath, } from "./local-path-codec.js";
 export const PERSONAL_VAULT_EXCLUDED_TOP_LEVEL = [
     ".git",
     "companies",
@@ -471,4 +472,103 @@ function companyHasCloudTrueMarker(subdir) {
     }
     return /^cloud:\s*true\b/m.test(text);
 }
+/**
+ * Purge journal entries that fall OUTSIDE the current personal-vault push
+ * scope, so a stale baseline written by an older engine (before an exclusion
+ * rule existed) converges instead of being re-diffed on every push forever.
+ *
+ * WHY THIS EXISTS. The push WALK already prunes excluded trees correctly
+ * (`collectFiles`/`walkDir` in share.ts apply the same filter and never descend
+ * into `.claude/worktrees/`, `node_modules/`, etc.). But nothing ever REMOVES a
+ * journal entry that predates an exclusion rule: `computeDeletePlan` skips such
+ * an entry (either because its local file still exists — the `presentLocally`
+ * short-circuit — or because the exclusion filter rejects it) WITHOUT deleting
+ * the journal row, and `finalizeShareJournal` then writes the journal back
+ * verbatim. So entries under rules added after they were first journaled —
+ * the `.claude/worktrees/` default ignore (added 5.8.2), the `workspace/`
+ * top-level exclusion, the `.hq-conflicts/` conflict-mirror rule, the
+ * `.conflict-*` ephemeral pattern, `node_modules/` — persist indefinitely, are
+ * re-`lstat`'d every push, and keep the baseline from ever stabilising.
+ *
+ * The two exclusion mechanisms this mirrors:
+ *   1. `shouldSync` — the shared ignore filter (`createIgnoreFilter`) plus, in
+ *      personal mode, the personal-vault default exclusions. Catches
+ *      `.claude/worktrees/`, `node_modules/`, `.hq-conflicts/`, `.env`, etc.
+ *   2. The `workspace/` (and `repos/`) top-level exclusion, which lives ONLY at
+ *      the walk-root level (`PERSONAL_VAULT_EXCLUDED_TOP_LEVEL`, applied by
+ *      `computePersonalVaultPaths`) and is therefore INVISIBLE to `shouldSync`.
+ *      The synced carve-outs under `workspace/` (the continuity pointer + its
+ *      active thread, `workspace/agency/`, `workspace/.session-logs/`) are
+ *      re-included so they are never purged.
+ *
+ * DEFERS to two existing owners so it is a pure safety-net for the classes no
+ * other mechanism drains:
+ *   - `isVaultLitterArtifact` (`isLitterArtifact` here) — conflict-mirror
+ *     (`.conflict-*`) and rescue-drift (`.drift-*`) litter is REMOTELY DELETED
+ *     by `computeDeletePlan`'s litter drain when the local file is gone, which
+ *     is stronger than forgetting the row. Never purge it here — that would
+ *     preempt the remote cleanup and strand the vault object.
+ *   - `isPersonalVaultDeletionExcluded` — release scaffold (`core/`),
+ *     reindex-generated skill wrappers (`.claude/skills/<ns>:<skill>/`), and
+ *     command wrappers are recreated locally by a release / `hq reindex`, so
+ *     their journal rows are deliberately retained (a local absence is not user
+ *     intent). Keep them.
+ *
+ * `companies/` is deliberately NOT purged here even though it is in
+ * `PERSONAL_VAULT_EXCLUDED_TOP_LEVEL`: local companies legitimately journal
+ * `companies/{slug}/…` keys, and cloud companies' stale keys are drained by the
+ * separate decommission plan (`computeDecommissionPlan`) — purging them here
+ * would rob that plan of the journal rows it deletes remotely against.
+ *
+ * Disposition is option (a) of the stale-journal question: drop the row so it
+ * is no longer re-diffed. Any remote object the row pointed at is left as an
+ * inert orphan — the PULL leg already refuses these keys
+ * (`computePullPlan` in sync.ts consults the same filters), so a peer can never
+ * rematerialise them, and existing rescue/litter tooling sweeps the remote.
+ *
+ * Mutates `journal.files` in place and returns what was removed for a summary
+ * event. Pure w.r.t. the filesystem beyond the carve-out probes.
+ */
+export function purgeExcludedPersonalVaultJournalEntries(journal, hqRoot, syncRoot, shouldSync, isLitterArtifact) {
+    // Precompute the synced carve-out roots under the otherwise-excluded
+    // `workspace/` once (not per journal entry). These are exactly the paths
+    // `computePersonalVaultPaths` pierces the top-level exclusion for.
+    const workspaceCarveKeys = [
+        ...computeContinuityPointerPaths(hqRoot),
+        ...computeAgencySyncPaths(hqRoot),
+        ...computeSessionLogsSyncPaths(hqRoot),
+    ].map((abs) => vaultKeyForLocalPath(syncRoot, abs));
+    const isSyncedWorkspaceCarveKey = (key) => workspaceCarveKeys.some((root) => key === root || key.startsWith(`${root}/`));
+    const byReason = {
+        "ignore-filtered": 0,
+        "excluded-top-level": 0,
+    };
+    const removed = [];
+    for (const key of Object.keys(journal.files)) {
+        // Defer to the two existing owners (see the doc-comment): litter is
+        // remotely drained, and release/reindex mirrors are deliberately retained.
+        if (isLitterArtifact(key) || isPersonalVaultDeletionExcluded(key))
+            continue;
+        const absPath = localPathForVaultKey(syncRoot, key);
+        const topLevel = key.split("/")[0];
+        let reason = null;
+        if (!shouldSync(absPath, false) && !shouldSync(absPath, true)) {
+            // shouldSync catches every ignore-filter / personal-vault-default class,
+            // including `.git/`, root `/repos/`, `.claude/worktrees/`, `node_modules/`,
+            // and `.hq-conflicts/`.
+            reason = "ignore-filtered";
+        }
+        else if (topLevel === "workspace" && !isSyncedWorkspaceCarveKey(key)) {
+            // `workspace/` is excluded only at the walk-root level, so shouldSync did
+            // not see it. Purge everything under it except the synced carve-outs.
+            reason = "excluded-top-level";
+        }
+        if (reason !== null) {
+            delete journal.files[key];
+            removed.push(key);
+            byReason[reason]++;
+        }
+    }
+    return { removed, byReason };
+}
 //# sourceMappingURL=personal-vault.js.map

package/dist/personal-vault.js.map

@@ -1 +1 @@
-{"version":3,"file":"personal-vault.js","sourceRoot":"","sources":["../src/personal-vault.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AAEH,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,6BAA6B,EAAE,MAAM,gCAAgC,CAAC;AAE/E,MAAM,CAAC,MAAM,iCAAiC,GAAsB;IAClE,MAAM;IACN,WAAW;IACX,OAAO;IACP,WAAW;CACZ,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,qCAAqC,GAAsB;IACtE,WAAW;CACZ,CAAC;AAeF;;;;;;;;;;;;;;;;;;GAkBG;AACH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,yBAAyB,CAAC;AAErE;;;;;;;;;;GAUG;AACH,MAAM,UAAU,wBAAwB,CAAC,GAAW;IAClD,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACxE,OAAO,CACL,KAAK,CAAC,MAAM,IAAI,CAAC;QACjB,KAAK,CAAC,CAAC,CAAC,KAAK,MAAM;QACnB,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,WAAW;YACvB,KAAK,CAAC,CAAC,CAAC,KAAK,UAAU;YACvB,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS;YACtB,KAAK,CAAC,CAAC,CAAC,KAAK,UAAU,CAAC,CAC3B,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,+BAA+B,CAAC,GAAW;IACzD,MAAM,UAAU,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IAClE,OAAO,CACL,UAAU,KAAK,MAAM;QACrB,UAAU,CAAC,UAAU,CAAC,OAAO,CAAC;QAC9B,UAAU,KAAK,gBAAgB;QAC/B,UAAU,CAAC,UAAU,CAAC,iBAAiB,CAAC;QACxC,sEAAsE;QACtE,2EAA2E;QAC3E,0EAA0E;QAC1E,wEAAwE;QACxE,0EAA0E;QAC1E,2DAA2D;QAC3D,6BAA6B,CAAC,UAAU,CAAC,CAC1C,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,yBAAyB,CACvC,MAAc,EACd,OAA6B,EAAE;IAE/B,IAAI,OAAiB,CAAC;IACtB,IAAI,CAAC;QACH,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,QAAQ,GAAG,OAAO;SACrB,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,iCAAiC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;SACnE,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC;IAC1C,sEAAsE;IACtE,sEAAsE;IACtE,uEAAuE;IACvE,oEAAoE;IACpE,0EAA0E;IAC1E,2DAA2D;IAC3D,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,2BAA2B,CAAC,CAAC;IACpE,IAAI,CAAC;QACH,IAAI,EAAE,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;YACvC,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,wEAAwE;IAC1E,CAAC;IACD,MAAM,cAAc,GAAG,6BAA6B,CAClD,MAAM,EACN,IAAI,CAAC,eAAe,CACrB,CAAC;IACF,MAAM,UAAU,GAAG,6BAA6B,CAAC,MAAM,CAAC,CAAC;IACzD,MAAM,MAAM,GAAG,sBAAsB,CAAC,MAAM,CAAC,CAAC;IAC9C,MAAM,WAAW,GAAG,2BAA2B,CAAC,MAAM,CAAC,CAAC;IACxD,OAAO;QACL,GAAG,QAAQ;QACX,GAAG,QAAQ;QACX,GAAG,cAAc;QACjB,GAAG,UAAU;QACb,GAAG,MAAM;QACT,GAAG,WAAW;KACf,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,gCAAgC,CAAC;AAEvE;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,UAAU,6BAA6B,CAAC,MAAc;IAC1D,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC;IAC7D,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC;IAE1D,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,MAAM,EAAE;YAAE,OAAO,GAAG,CAAC;QACnD,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,qEAAqE;QACrE,OAAO,GAAG,CAAC;IACb,CAAC;IACD,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAEtB,uEAAuE;IACvE,yEAAyE;IACzE,uDAAuD;IACvD,IAAI,UAAmB,CAAC;IACxB,IAAI,CAAC;QACH,UAAU,GAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAA+B,EAAE,WAAW,CAAC;IAC3E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,CAAC;IACb,CAAC;IACD,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,GAAG,CAAC;IAE1E,4EAA4E;IAC5E,wEAAwE;IACxE,yEAAyE;IACzE,mEAAmE;IACnE,IAAI,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,GAAG,CAAC;IAC5C,MAAM,eAAe,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IACjD,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IACnD,MAAM,aAAa,GAAG,CAAC,CAAS,EAAW,EAAE,CAC3C,CAAC,KAAK,eAAe,IAAI,CAAC,CAAC,UAAU,CAAC,eAAe,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;IACpE,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC;QAAE,OAAO,GAAG,CAAC;IAC1C,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAClD,MAAM,mBAAmB,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC;QAC1E,MAAM,WAAW,GAAG,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QACvD,IAAI,WAAW,KAAK,mBAAmB;YAAE,OAAO,GAAG,CAAC;QACpD,MAAM,iBAAiB,GAAG,CAAC,CAAS,EAAW,EAAE,CAC/C,CAAC,KAAK,WAAW,IAAI,CAAC,CAAC,UAAU,CAAC,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;QAC5D,MAAM,IAAI,GAAG,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC/C,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC;YAAE,OAAO,GAAG,CAAC;QACzC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE;YAAE,OAAO,GAAG,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,sEAAsE;QACtE,OAAO,GAAG,CAAC;IACb,CAAC;IACD,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACpB,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,kBAAkB,CAAC;AAElD;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,sBAAsB,CAAC,MAAc;IACnD,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;IAC3D,IAAI,CAAC;QACH,IAAI,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE;YAAE,OAAO,CAAC,SAAS,CAAC,CAAC;IAC/D,CAAC;IAAC,MAAM,CAAC;QACP,0DAA0D;IAC5D,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,yBAAyB,CAAC;AAE/D;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,2BAA2B,CAAC,MAAc;IACxD,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,EAAE,eAAe,CAAC,CAAC;IACvE,IAAI,CAAC;QACH,IAAI,EAAE,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,WAAW,EAAE;YAAE,OAAO,CAAC,cAAc,CAAC,CAAC;IACzE,CAAC;IAAC,MAAM,CAAC;QACP,mEAAmE;IACrE,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,UAAU,6BAA6B,CAC3C,MAAc,EACd,kBAAuC,IAAI,GAAG,EAAE;IAEhD,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IACrD,IAAI,KAAe,CAAC;IACpB,IAAI,CAAC;QACH,KAAK,GAAG,EAAE,CAAC,WAAW,CAAC,aAAa,CAAC,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,oEAAoE;IACpE,uEAAuE;IACvE,0EAA0E;IAC1E,kEAAkE;IAClE,MAAM,kBAAkB,GAAG,gCAAgC,CAAC,MAAM,CAAC,CAAC;IACpE,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,qCAAqC,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,SAAS;QACnE,IAAI,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,SAAS;QACxC,IAAI,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,SAAS;QAC3C,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;QAC9C,IAAI,KAAK,GAAG,KAAK,CAAC;QAClB,IAAI,CAAC;YACH,KAAK,GAAG,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC;QAC5C,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,IAAI,CAAC,KAAK;YAAE,SAAS;QACrB,IAAI,yBAAyB,CAAC,MAAM,CAAC;YAAE,SAAS;QAChD,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACxB,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,gCAAgC,CAAC,MAAc;IAC7D,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,EAAE,eAAe,CAAC,CAAC;IACrE,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,EAAE,CAAC,YAAY,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;IAC/C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,GAAG,EAAE,CAAC;IACnB,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,IAAI,WAAW,GAAkB,IAAI,CAAC;IACtC,IAAI,WAAW,GAAG,KAAK,CAAC;IACxB,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACvC,oEAAoE;QACpE,IAAI,+BAA+B,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/C,WAAW,GAAG,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACnD,WAAW,GAAG,IAAI,CAAC;YACnB,SAAS;QACX,CAAC;QACD,IAAI,CAAC,WAAW;YAAE,SAAS;QAC3B,kDAAkD;QAClD,MAAM,SAAS,GAAG,+CAA+C,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7E,IAAI,SAAS,EAAE,CAAC;YACd,WAAW,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;YAC3B,SAAS;QACX,CAAC;QACD,IACE,WAAW;YACX,wCAAwC,CAAC,IAAI,CAAC,IAAI,CAAC,EACnD,CAAC;YACD,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YACrB,oEAAoE;YACpE,qCAAqC;QACvC,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,SAAS,yBAAyB,CAAC,MAAc;IAC/C,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IACnD,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACxC,CAAC"}
+{"version":3,"file":"personal-vault.js","sourceRoot":"","sources":["../src/personal-vault.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AAEH,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,6BAA6B,EAAE,MAAM,gCAAgC,CAAC;AAC/E,OAAO,EACL,oBAAoB,EACpB,oBAAoB,GACrB,MAAM,uBAAuB,CAAC;AAG/B,MAAM,CAAC,MAAM,iCAAiC,GAAsB;IAClE,MAAM;IACN,WAAW;IACX,OAAO;IACP,WAAW;CACZ,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,qCAAqC,GAAsB;IACtE,WAAW;CACZ,CAAC;AAeF;;;;;;;;;;;;;;;;;;GAkBG;AACH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,yBAAyB,CAAC;AAErE;;;;;;;;;;GAUG;AACH,MAAM,UAAU,wBAAwB,CAAC,GAAW;IAClD,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACxE,OAAO,CACL,KAAK,CAAC,MAAM,IAAI,CAAC;QACjB,KAAK,CAAC,CAAC,CAAC,KAAK,MAAM;QACnB,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,WAAW;YACvB,KAAK,CAAC,CAAC,CAAC,KAAK,UAAU;YACvB,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS;YACtB,KAAK,CAAC,CAAC,CAAC,KAAK,UAAU,CAAC,CAC3B,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,+BAA+B,CAAC,GAAW;IACzD,MAAM,UAAU,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IAClE,OAAO,CACL,UAAU,KAAK,MAAM;QACrB,UAAU,CAAC,UAAU,CAAC,OAAO,CAAC;QAC9B,UAAU,KAAK,gBAAgB;QAC/B,UAAU,CAAC,UAAU,CAAC,iBAAiB,CAAC;QACxC,sEAAsE;QACtE,2EAA2E;QAC3E,0EAA0E;QAC1E,wEAAwE;QACxE,0EAA0E;QAC1E,2DAA2D;QAC3D,6BAA6B,CAAC,UAAU,CAAC,CAC1C,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,yBAAyB,CACvC,MAAc,EACd,OAA6B,EAAE;IAE/B,IAAI,OAAiB,CAAC;IACtB,IAAI,CAAC;QACH,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,QAAQ,GAAG,OAAO;SACrB,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,iCAAiC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;SACnE,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC;IAC1C,sEAAsE;IACtE,sEAAsE;IACtE,uEAAuE;IACvE,oEAAoE;IACpE,0EAA0E;IAC1E,2DAA2D;IAC3D,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,2BAA2B,CAAC,CAAC;IACpE,IAAI,CAAC;QACH,IAAI,EAAE,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;YACvC,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,wEAAwE;IAC1E,CAAC;IACD,MAAM,cAAc,GAAG,6BAA6B,CAClD,MAAM,EACN,IAAI,CAAC,eAAe,CACrB,CAAC;IACF,MAAM,UAAU,GAAG,6BAA6B,CAAC,MAAM,CAAC,CAAC;IACzD,MAAM,MAAM,GAAG,sBAAsB,CAAC,MAAM,CAAC,CAAC;IAC9C,MAAM,WAAW,GAAG,2BAA2B,CAAC,MAAM,CAAC,CAAC;IACxD,OAAO;QACL,GAAG,QAAQ;QACX,GAAG,QAAQ;QACX,GAAG,cAAc;QACjB,GAAG,UAAU;QACb,GAAG,MAAM;QACT,GAAG,WAAW;KACf,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,gCAAgC,CAAC;AAEvE;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,UAAU,6BAA6B,CAAC,MAAc;IAC1D,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC;IAC7D,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC;IAE1D,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,MAAM,EAAE;YAAE,OAAO,GAAG,CAAC;QACnD,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,qEAAqE;QACrE,OAAO,GAAG,CAAC;IACb,CAAC;IACD,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAEtB,uEAAuE;IACvE,yEAAyE;IACzE,uDAAuD;IACvD,IAAI,UAAmB,CAAC;IACxB,IAAI,CAAC;QACH,UAAU,GAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAA+B,EAAE,WAAW,CAAC;IAC3E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,CAAC;IACb,CAAC;IACD,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,GAAG,CAAC;IAE1E,4EAA4E;IAC5E,wEAAwE;IACxE,yEAAyE;IACzE,mEAAmE;IACnE,IAAI,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,GAAG,CAAC;IAC5C,MAAM,eAAe,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IACjD,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IACnD,MAAM,aAAa,GAAG,CAAC,CAAS,EAAW,EAAE,CAC3C,CAAC,KAAK,eAAe,IAAI,CAAC,CAAC,UAAU,CAAC,eAAe,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;IACpE,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC;QAAE,OAAO,GAAG,CAAC;IAC1C,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAClD,MAAM,mBAAmB,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC;QAC1E,MAAM,WAAW,GAAG,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QACvD,IAAI,WAAW,KAAK,mBAAmB;YAAE,OAAO,GAAG,CAAC;QACpD,MAAM,iBAAiB,GAAG,CAAC,CAAS,EAAW,EAAE,CAC/C,CAAC,KAAK,WAAW,IAAI,CAAC,CAAC,UAAU,CAAC,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;QAC5D,MAAM,IAAI,GAAG,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC/C,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC;YAAE,OAAO,GAAG,CAAC;QACzC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE;YAAE,OAAO,GAAG,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,sEAAsE;QACtE,OAAO,GAAG,CAAC;IACb,CAAC;IACD,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACpB,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,kBAAkB,CAAC;AAElD;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,sBAAsB,CAAC,MAAc;IACnD,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;IAC3D,IAAI,CAAC;QACH,IAAI,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE;YAAE,OAAO,CAAC,SAAS,CAAC,CAAC;IAC/D,CAAC;IAAC,MAAM,CAAC;QACP,0DAA0D;IAC5D,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,yBAAyB,CAAC;AAE/D;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,2BAA2B,CAAC,MAAc;IACxD,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,EAAE,eAAe,CAAC,CAAC;IACvE,IAAI,CAAC;QACH,IAAI,EAAE,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,WAAW,EAAE;YAAE,OAAO,CAAC,cAAc,CAAC,CAAC;IACzE,CAAC;IAAC,MAAM,CAAC;QACP,mEAAmE;IACrE,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,UAAU,6BAA6B,CAC3C,MAAc,EACd,kBAAuC,IAAI,GAAG,EAAE;IAEhD,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IACrD,IAAI,KAAe,CAAC;IACpB,IAAI,CAAC;QACH,KAAK,GAAG,EAAE,CAAC,WAAW,CAAC,aAAa,CAAC,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,oEAAoE;IACpE,uEAAuE;IACvE,0EAA0E;IAC1E,kEAAkE;IAClE,MAAM,kBAAkB,GAAG,gCAAgC,CAAC,MAAM,CAAC,CAAC;IACpE,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,qCAAqC,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,SAAS;QACnE,IAAI,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,SAAS;QACxC,IAAI,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,SAAS;QAC3C,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;QAC9C,IAAI,KAAK,GAAG,KAAK,CAAC;QAClB,IAAI,CAAC;YACH,KAAK,GAAG,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC;QAC5C,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,IAAI,CAAC,KAAK;YAAE,SAAS;QACrB,IAAI,yBAAyB,CAAC,MAAM,CAAC;YAAE,SAAS;QAChD,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACxB,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,gCAAgC,CAAC,MAAc;IAC7D,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,EAAE,eAAe,CAAC,CAAC;IACrE,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,EAAE,CAAC,YAAY,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;IAC/C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,GAAG,EAAE,CAAC;IACnB,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,IAAI,WAAW,GAAkB,IAAI,CAAC;IACtC,IAAI,WAAW,GAAG,KAAK,CAAC;IACxB,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACvC,oEAAoE;QACpE,IAAI,+BAA+B,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/C,WAAW,GAAG,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACnD,WAAW,GAAG,IAAI,CAAC;YACnB,SAAS;QACX,CAAC;QACD,IAAI,CAAC,WAAW;YAAE,SAAS;QAC3B,kDAAkD;QAClD,MAAM,SAAS,GAAG,+CAA+C,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7E,IAAI,SAAS,EAAE,CAAC;YACd,WAAW,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;YAC3B,SAAS;QACX,CAAC;QACD,IACE,WAAW;YACX,wCAAwC,CAAC,IAAI,CAAC,IAAI,CAAC,EACnD,CAAC;YACD,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YACrB,oEAAoE;YACpE,qCAAqC;QACvC,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,SAAS,yBAAyB,CAAC,MAAc;IAC/C,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IACnD,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACxC,CAAC;AAgBD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwDG;AACH,MAAM,UAAU,wCAAwC,CACtD,OAAoB,EACpB,MAAc,EACd,QAAgB,EAChB,UAAyD,EACzD,gBAA0C;IAE1C,qEAAqE;IACrE,yEAAyE;IACzE,mEAAmE;IACnE,MAAM,kBAAkB,GAAG;QACzB,GAAG,6BAA6B,CAAC,MAAM,CAAC;QACxC,GAAG,sBAAsB,CAAC,MAAM,CAAC;QACjC,GAAG,2BAA2B,CAAC,MAAM,CAAC;KACvC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,oBAAoB,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC;IAEpD,MAAM,yBAAyB,GAAG,CAAC,GAAW,EAAW,EAAE,CACzD,kBAAkB,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,KAAK,IAAI,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC;IAEhF,MAAM,QAAQ,GAAoD;QAChE,iBAAiB,EAAE,CAAC;QACpB,oBAAoB,EAAE,CAAC;KACxB,CAAC;IACF,MAAM,OAAO,GAAa,EAAE,CAAC;IAE7B,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC7C,oEAAoE;QACpE,2EAA2E;QAC3E,IAAI,gBAAgB,CAAC,GAAG,CAAC,IAAI,+BAA+B,CAAC,GAAG,CAAC;YAAE,SAAS;QAE5E,MAAM,OAAO,GAAG,oBAAoB,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QACpD,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAEnC,IAAI,MAAM,GAA2C,IAAI,CAAC;QAC1D,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC;YAC9D,yEAAyE;YACzE,4EAA4E;YAC5E,wBAAwB;YACxB,MAAM,GAAG,iBAAiB,CAAC;QAC7B,CAAC;aAAM,IAAI,QAAQ,KAAK,WAAW,IAAI,CAAC,yBAAyB,CAAC,GAAG,CAAC,EAAE,CAAC;YACvE,0EAA0E;YAC1E,sEAAsE;YACtE,MAAM,GAAG,oBAAoB,CAAC;QAChC,CAAC;QAED,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,OAAO,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC1B,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAClB,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACrB,CAAC;IACH,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;AAC/B,CAAC"}