@wrongstack/cli 0.284.1 → 0.286.0

package/dist/fleet-statusline.d.ts

@@ -0,0 +1,71 @@
+/**
+ * Live fleet status line for the plain (non-TUI) REPL and single-shot modes.
+ *
+ * The TUI already renders a rich per-agent 4th line; the plain terminal had
+ * nothing live while subagents ran. This reserves the bottom terminal row via
+ * a DECSTBM scroll region (`\x1b[1;{rows-1}r`) so normal streamed output keeps
+ * scrolling in the region above while a continuously-updated status line stays
+ * pinned to the bottom. It activates only when ≥1 subagent is running on a TTY,
+ * and fully restores the scroll region when the fleet goes idle or on dispose.
+ *
+ * State is fed entirely by host EventBus events (the coordinator + the
+ * multi-agent factory bridge both emit onto the host bus):
+ *   subagent.spawned / task_started / tool_executed / iteration_summary /
+ *   task_completed.
+ */
+import type { EventBus } from '@wrongstack/core';
+export interface FleetAgentState {
+    id: string;
+    name: string;
+    status: 'running' | 'done' | 'failed';
+    iterations: number;
+    toolCalls: number;
+    lastTool?: string | undefined;
+    startedAt: number;
+    endedAt?: number | undefined;
+    /** Cumulative budget auto-extensions — rendered as a "⚡N" suffix. */
+    extensions?: number | undefined;
+}
+export interface FleetStatusLineOptions {
+    events: EventBus;
+    out?: NodeJS.WriteStream | undefined;
+    /** Minimum ms between repaints. Default 150. */
+    throttleMs?: number | undefined;
+    /** Inject a clock for tests. */
+    now?: (() => number) | undefined;
+    /** App version (e.g. "0.7.0") prefixed as a `WS v…` chip on the pinned line. */
+    version?: string | undefined;
+}
+/**
+ * Pure formatter — turns the agent map into a single status string. Exposed
+ * for testing; contains no ANSI cursor movement, only color codes + the width
+ * cap. Returns '' when there is nothing worth showing.
+ */
+export declare function renderFleetLine(states: Map<string, FleetAgentState>, now: number, columns: number, version?: string | undefined): string;
+export declare class FleetStatusLine {
+    private readonly events;
+    private readonly out;
+    private readonly throttleMs;
+    private readonly now;
+    private readonly version?;
+    private readonly states;
+    private readonly unsubs;
+    private active;
+    private rows;
+    private repaintTimer;
+    private tickTimer;
+    private resizeCleanup;
+    private lastPaint;
+    private readonly onResize;
+    constructor(opts: FleetStatusLineOptions);
+    /** Subscribe to host fleet events. No terminal output until a subagent spawns. */
+    start(): void;
+    /** Unsubscribe and restore the terminal. Idempotent. */
+    stop(): void;
+    private isTty;
+    private activate;
+    private deactivate;
+    private schedulePaint;
+    private paint;
+}
+//# sourceMappingURL=fleet-statusline.d.ts.map

package/dist/fleet-statusline.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fleet-statusline.d.ts","sourceRoot":"","sources":["../src/fleet-statusline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAGjD,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,SAAS,GAAG,MAAM,GAAG,QAAQ,CAAC;IACtC,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,qEAAqE;IACrE,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACjC;AAED,MAAM,WAAW,sBAAsB;IACrC,MAAM,EAAE,QAAQ,CAAC;IACjB,GAAG,CAAC,EAAE,MAAM,CAAC,WAAW,GAAG,SAAS,CAAC;IACrC,gDAAgD;IAChD,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,gCAAgC;IAChC,GAAG,CAAC,EAAE,CAAC,MAAM,MAAM,CAAC,GAAG,SAAS,CAAC;IACjC,gFAAgF;IAChF,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC9B;AAYD;;;;GAIG;AACH,wBAAgB,eAAe,CAC7B,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,eAAe,CAAC,EACpC,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,GAC3B,MAAM,CA+DR;AAED,qBAAa,eAAe;IAC1B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAW;IAClC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAqB;IACzC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;IACnC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAqB;IAC9C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAsC;IAC7D,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAyB;IAChD,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,IAAI,CAAK;IACjB,OAAO,CAAC,YAAY,CAA8C;IAClE,OAAO,CAAC,SAAS,CAA+C;IAChE,OAAO,CAAC,aAAa,CAA6B;IAClD,OAAO,CAAC,SAAS,CAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAMvB;IAEF,YAAY,IAAI,EAAE,sBAAsB,EAMvC;IAED,kFAAkF;IAClF,KAAK,IAAI,IAAI,CAqEZ;IAED,wDAAwD;IACxD,IAAI,IAAI,IAAI,CAGX;IAED,OAAO,CAAC,KAAK;IAIb,OAAO,CAAC,QAAQ;IAchB,OAAO,CAAC,UAAU;IAuBlB,OAAO,CAAC,aAAa;IAerB,OAAO,CAAC,KAAK;CAWd"}

package/dist/hooks-wiring.d.ts

@@ -0,0 +1,26 @@
+import type { AgentExtension, HookRunner, UserInputPayload } from '@wrongstack/core';
+/** Raised by the UserPromptSubmit middleware to block a turn before it runs. */
+export declare class HookBlockedError extends Error {
+    constructor(reason: string);
+}
+interface UserInputMiddleware {
+    name: string;
+    handler: (payload: UserInputPayload, next: (v: UserInputPayload) => Promise<UserInputPayload>) => Promise<UserInputPayload>;
+}
+/**
+ * `userInput` pipeline middleware for `UserPromptSubmit` hooks. A `block`
+ * outcome throws `HookBlockedError`, which the userInput pipeline's
+ * (core-owned) error boundary rethrows — propagating to `Agent.run` so the
+ * turn ends without a model call. `additionalContext` is appended to the user
+ * message. Owner is left unset so the boundary treats it as core (rethrow).
+ */
+export declare function createUserPromptSubmitMiddleware(hookRunner: HookRunner): UserInputMiddleware;
+/**
+ * Agent extension for the `SessionStart` and `Stop` lifecycle hooks.
+ * `SessionStart` fires once on the first run of the session; its
+ * `additionalContext` is appended to `ctx.systemPrompt` as a one-time text
+ * block (persists for the session). `Stop` fires at the end of every turn.
+ */
+export declare function createLifecycleHooksExtension(hookRunner: HookRunner): AgentExtension;
+export {};
+//# sourceMappingURL=hooks-wiring.d.ts.map

package/dist/hooks-wiring.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hooks-wiring.d.ts","sourceRoot":"","sources":["../src/hooks-wiring.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,UAAU,EAAa,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAEhG,gFAAgF;AAChF,qBAAa,gBAAiB,SAAQ,KAAK;IACzC,YAAY,MAAM,EAAE,MAAM,EAGzB;CACF;AAED,UAAU,mBAAmB;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,CACP,OAAO,EAAE,gBAAgB,EACzB,IAAI,EAAE,CAAC,CAAC,EAAE,gBAAgB,KAAK,OAAO,CAAC,gBAAgB,CAAC,KACrD,OAAO,CAAC,gBAAgB,CAAC,CAAC;CAChC;AAED;;;;;;GAMG;AACH,wBAAgB,gCAAgC,CAAC,UAAU,EAAE,UAAU,GAAG,mBAAmB,CAiB5F;AAED;;;;;GAKG;AACH,wBAAgB,6BAA6B,CAAC,UAAU,EAAE,UAAU,GAAG,cAAc,CAiBpF"}

package/dist/hq-command-controller.d.ts

@@ -0,0 +1,52 @@
+/**
+ * HQ command controller — the client-side dispatch surface for Phase 4 of the
+ * HQ command center. A mutable holder (mirroring the established
+ * `interruptController` pattern in cli-main.ts) that the `onCommand` handler
+ * on the HQ publisher reads lazily, because several of its targets
+ * (`director`, the rebound `interruptLeader`) are not yet defined at HQ-connect
+ * time.
+ *
+ * The five command types route through the agent's own decision loop or the
+ * project mailbox, so they inherit existing guardrails. `run-command` (raw
+ * shell) is deliberately NOT wired here — it requires a separately-audited
+ * escalation policy (operator flag + per-token `control.execute` + allowlist)
+ * and is left as a stub that rejects until that policy exists.
+ *
+ * @module hq-command-controller
+ */
+import type { HqPublisherCommandResult } from '@wrongstack/core';
+import type { GlobalMailbox } from '@wrongstack/core';
+/**
+ * Mutable holder for the command dispatch targets. Each field is populated
+ * lazily as the corresponding subsystem comes online (director on
+ * `onDirectorReady`, interruptLeader rebound by the REPL/TUI, …). The
+ * `onCommand` handler reads these at dispatch time, not at construction.
+ */
+export interface HqCommandController {
+    /** Project mailbox used to deliver steer/broadcast messages. */
+    steerMailbox?: GlobalMailbox;
+    /** Abort the session leader's running Agent.run(). Returns true if a run was aborted. */
+    interruptLeader: () => boolean;
+    /** Terminate a specific subagent by id. Returns true if terminated. */
+    terminateAgent?: (subagentId: string) => boolean | Promise<boolean>;
+    /** Stop the entire fleet (all running/idle subagents). Returns kill count. */
+    killFleet?: () => number | Promise<number>;
+    /** Spawn a subagent of the given role. Returns the new subagentId. */
+    spawnAgent?: (role: string, task?: string, maxIterations?: number) => Promise<string>;
+    /** Derive the session-unique mailbox tag for addressing (e.g. `leader@<tag>`). */
+    sessionTag: () => string;
+    /** Whether raw shell execution is explicitly opted-in by the operator. */
+    allowRunCommand: () => boolean;
+}
+/**
+ * Build the `onCommand` handler for an HQ publisher. The handler validates
+ * the command, dispatches through the controller, and returns an ack result
+ * (or throws to produce a `failed` ack — the publisher's `handleCommandBatch`
+ * wraps it). Best-effort: a dispatch failure never breaks the host.
+ */
+export declare function createHqCommandDispatcher(controller: HqCommandController): (command: {
+    commandId: string;
+    type: string;
+    payload: unknown;
+}) => Promise<HqPublisherCommandResult>;
+//# sourceMappingURL=hq-command-controller.d.ts.map

package/dist/hq-command-controller.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hq-command-controller.d.ts","sourceRoot":"","sources":["../src/hq-command-controller.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,kBAAkB,CAAC;AACjE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAGtD;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB;IAClC,gEAAgE;IAChE,YAAY,CAAC,EAAE,aAAa,CAAC;IAC7B,yFAAyF;IACzF,eAAe,EAAE,MAAM,OAAO,CAAC;IAC/B,uEAAuE;IACvE,cAAc,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACpE,8EAA8E;IAC9E,SAAS,CAAC,EAAE,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC3C,sEAAsE;IACtE,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,EAAE,aAAa,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACtF,kFAAkF;IAClF,UAAU,EAAE,MAAM,MAAM,CAAC;IACzB,0EAA0E;IAC1E,eAAe,EAAE,MAAM,OAAO,CAAC;CAChC;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,CACvC,UAAU,EAAE,mBAAmB,GAC9B,CAAC,OAAO,EAAE;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,KAAK,OAAO,CAAC,wBAAwB,CAAC,CAcvG"}

package/dist/hq-dashboard-html.d.ts

@@ -0,0 +1,2 @@
+export declare const HQ_HTML: string;
+//# sourceMappingURL=hq-dashboard-html.d.ts.map

package/dist/hq-dashboard-html.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hq-dashboard-html.d.ts","sourceRoot":"","sources":["../src/hq-dashboard-html.ts"],"names":[],"mappings":"AA4vEA,eAAO,MAAM,OAAO,EAAE,MAGyC,CAAC"}

package/dist/hq-publisher.d.ts

@@ -0,0 +1,16 @@
+import { type CreateHqPublisherOptions, type HqPublisher } from '@wrongstack/core';
+type CliHqPublisherOptions = Omit<CreateHqPublisherOptions, 'socketFactory'> & {
+    socketFactory?: CreateHqPublisherOptions['socketFactory'];
+};
+export interface CliHqConnection {
+    getPublisher(): HqPublisher | undefined;
+    stop(): void;
+}
+export interface CliHqConnectionOptions extends CliHqPublisherOptions {
+    onConnect?: ((publisher: HqPublisher) => void) | undefined;
+    retryIntervalMs?: number | undefined;
+}
+export declare function createCliHqPublisher(options: CliHqPublisherOptions): HqPublisher | undefined;
+export declare function startCliHqConnection(options: CliHqConnectionOptions): CliHqConnection;
+export {};
+//# sourceMappingURL=hq-publisher.d.ts.map

package/dist/hq-publisher.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hq-publisher.d.ts","sourceRoot":"","sources":["../src/hq-publisher.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,wBAAwB,EAC7B,KAAK,WAAW,EAEjB,MAAM,kBAAkB,CAAC;AAG1B,KAAK,qBAAqB,GAAG,IAAI,CAAC,wBAAwB,EAAE,eAAe,CAAC,GAAG;IAC7E,aAAa,CAAC,EAAE,wBAAwB,CAAC,eAAe,CAAC,CAAC;CAC3D,CAAC;AAEF,MAAM,WAAW,eAAe;IAC9B,YAAY,IAAI,WAAW,GAAG,SAAS,CAAC;IACxC,IAAI,IAAI,IAAI,CAAC;CACd;AAED,MAAM,WAAW,sBAAuB,SAAQ,qBAAqB;IACnE,SAAS,CAAC,EAAE,CAAC,CAAC,SAAS,EAAE,WAAW,KAAK,IAAI,CAAC,GAAG,SAAS,CAAC;IAC3D,eAAe,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACtC;AAMD,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,qBAAqB,GAAG,WAAW,GAAG,SAAS,CAK5F;AAmBD,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,sBAAsB,GAAG,eAAe,CAwCrF"}

package/dist/hq-server/auth.d.ts

@@ -0,0 +1,37 @@
+/**
+ * HQ server — authentication, cookie management, and security headers.
+ *
+ * @module hq-server/auth
+ */
+import type * as http from 'node:http';
+export declare const HQ_SESSION_COOKIE = "hq.session";
+export declare const HQ_SESSION_MAX_AGE_MS: number;
+export interface HqBrowserAuthContext {
+    kind: 'token';
+    token: string;
+    id: string;
+    capabilities?: string[];
+}
+export type HqBrowserAuthResult = HqBrowserAuthContext | 'cookie' | undefined;
+export declare function setHqSecurityHeaders(res: http.ServerResponse): void;
+export declare function hasTrustedBrowserOrigin(req: http.IncomingMessage): boolean;
+export declare function signHqSession(sessionId: string, secret: string): string;
+export declare function serializeHqSessionCookie(sessionId: string, secret: string): string;
+export declare function parseHqSessionCookie(value: string, secret: string): string | undefined;
+export declare function parseCookieHeader(cookieHeader: string | undefined): Record<string, string>;
+export declare function setHqSessionCookie(res: http.ServerResponse, value: string): void;
+export declare function clearHqSessionCookie(res: http.ServerResponse): void;
+export declare function isTokenAuth(auth: HqBrowserAuthResult): auth is HqBrowserAuthContext;
+export declare function extractBrowserToken(req: http.IncomingMessage, url: URL): string | undefined;
+export declare function authenticateBrowserRequest(req: http.IncomingMessage, url: URL, mutableAuth: {
+    browserTokens: Set<string>;
+    browserTokenObjs: Map<string, {
+        id: string;
+        capabilities?: string[];
+    }>;
+    passwordHash?: string | undefined;
+    cookieSecret?: string | undefined;
+}, sessions: Map<string, {
+    createdAt: number;
+}>): HqBrowserAuthResult;
+//# sourceMappingURL=auth.d.ts.map

package/dist/hq-server/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/hq-server/auth.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,KAAK,KAAK,IAAI,MAAM,WAAW,CAAC;AAIvC,eAAO,MAAM,iBAAiB,eAAe,CAAC;AAC9C,eAAO,MAAM,qBAAqB,QAA0B,CAAC;AAI7D,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,OAAO,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,EAAE,EAAE,MAAM,CAAC;IACX,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;CACzB;AAED,MAAM,MAAM,mBAAmB,GAAG,oBAAoB,GAAG,QAAQ,GAAG,SAAS,CAAC;AAI9E,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,IAAI,CAAC,cAAc,GAAG,IAAI,CASnE;AAID,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,IAAI,CAAC,eAAe,GAAG,OAAO,CAe1E;AAID,wBAAgB,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAEvE;AAED,wBAAgB,wBAAwB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAElF;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAatF;AAED,wBAAgB,iBAAiB,CAAC,YAAY,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAW1F;AAED,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,IAAI,CAAC,cAAc,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAGhF;AAED,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,IAAI,CAAC,cAAc,GAAG,IAAI,CAGnE;AAID,wBAAgB,WAAW,CAAC,IAAI,EAAE,mBAAmB,GAAG,IAAI,IAAI,oBAAoB,CAEnF;AAID,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,IAAI,CAAC,eAAe,EAAE,GAAG,EAAE,GAAG,GAAG,MAAM,GAAG,SAAS,CAU3F;AAED,wBAAgB,0BAA0B,CACxC,GAAG,EAAE,IAAI,CAAC,eAAe,EACzB,GAAG,EAAE,GAAG,EACR,WAAW,EAAE;IACX,aAAa,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC3B,gBAAgB,EAAE,GAAG,CAAC,MAAM,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAC;IACvE,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACnC,EACD,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE;IAAE,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,GAC3C,mBAAmB,CAiBrB"}

package/dist/hq-server/snapshot.d.ts

@@ -0,0 +1,14 @@
+/**
+ * HQ server — snapshot builders for browser push and HTTP API responses.
+ *
+ * @module hq-server/snapshot
+ */
+import { WebSocket } from 'ws';
+import type { HqEventEnvelope, HqPersistence, HqSnapshot } from '@wrongstack/core';
+import type { ConnectedClient, HqSnapshotBroadcaster, ProjectDetail } from './types.js';
+export declare const HQ_SNAPSHOT_BROADCAST_DEBOUNCE_MS = 250;
+export declare function buildSnapshot(clients: Map<WebSocket, ConnectedClient>): HqSnapshot;
+export declare function createSnapshotBroadcaster(clients: Map<WebSocket, ConnectedClient>, browsers: Set<WebSocket>, persistence?: HqPersistence): HqSnapshotBroadcaster;
+export declare function buildProjectDetail(clients: Map<WebSocket, ConnectedClient>, projectId: string): ProjectDetail | null;
+export declare function broadcastEvent(event: HqEventEnvelope, browsers: Set<WebSocket>): void;
+//# sourceMappingURL=snapshot.d.ts.map

package/dist/hq-server/snapshot.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"snapshot.d.ts","sourceRoot":"","sources":["../../src/hq-server/snapshot.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC;AAC/B,OAAO,KAAK,EAIV,eAAe,EAOf,aAAa,EAIb,UAAU,EACX,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,eAAe,EAAE,qBAAqB,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAKxF,eAAO,MAAM,iCAAiC,MAAM,CAAC;AAIrD,wBAAgB,aAAa,CAAC,OAAO,EAAE,GAAG,CAAC,SAAS,EAAE,eAAe,CAAC,GAAG,UAAU,CAoSlF;AAID,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,GAAG,CAAC,SAAS,EAAE,eAAe,CAAC,EACxC,QAAQ,EAAE,GAAG,CAAC,SAAS,CAAC,EACxB,WAAW,CAAC,EAAE,aAAa,GAC1B,qBAAqB,CA0CvB;AAID,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,GAAG,CAAC,SAAS,EAAE,eAAe,CAAC,EACxC,SAAS,EAAE,MAAM,GAChB,aAAa,GAAG,IAAI,CAqDtB;AAID,wBAAgB,cAAc,CAAC,KAAK,EAAE,eAAe,EAAE,QAAQ,EAAE,GAAG,CAAC,SAAS,CAAC,GAAG,IAAI,CAMrF"}

package/dist/hq-server/types.d.ts

@@ -0,0 +1,67 @@
+/**
+ * Shared types for the HQ server modules.
+ *
+ * @module hq-server/types
+ */
+import type { WebSocket } from 'ws';
+import type { HqClientCapability, HqClientRecord, HqEventEnvelope, HqFleetSnapshotPayload, HqMailboxSnapshotPayload, HqMcpServerHealth, HqPersistence, HqProjectIdentity, HqProjectRecord, HqQueuedCommand, HqRedactionPolicy, HqSessionSnapshotPayload, HqToken, HqTranscriptEntry } from '@wrongstack/core';
+import type { HqBrowserMessage } from '@wrongstack/core';
+export type { HqClientCapability, HqClientRecord, HqEventEnvelope, HqFleetSnapshotPayload, HqMailboxSnapshotPayload, HqMcpServerHealth, HqPersistence, HqProjectIdentity, HqProjectRecord, HqQueuedCommand, HqRedactionPolicy, HqSessionSnapshotPayload, HqToken, HqTranscriptEntry, HqBrowserMessage, };
+export interface TrackedSessionSnapshot {
+    payload: HqSessionSnapshotPayload;
+    /** Epoch ms of the last `session.snapshot` refresh — freshness authority for the cleanup timer. */
+    receivedAt: number;
+}
+export interface TrackedFleetSnapshot {
+    payload: HqFleetSnapshotPayload;
+    /** Owning session, when the publisher supplied one. */
+    sessionId?: string;
+    receivedAt: number;
+}
+export interface ConnectedClient {
+    ws: WebSocket;
+    clientId: string;
+    projectId: string;
+    project: HqProjectIdentity;
+    kind: string;
+    connectedAt: string;
+    lastSeenAt: string;
+    hostname?: string;
+    pid?: number;
+    version?: string;
+    capabilities: readonly string[];
+    /** Auth token used for this socket; absent only in explicit open mode. */
+    authToken?: HqToken;
+    /** Client-declared privacy policy; operator overrides are clamped dynamically. */
+    declaredRedactionPolicy: HqRedactionPolicy;
+    /** Highest accepted event sequence for replay/duplicate protection. */
+    lastEventSeq: number;
+    /** Per-client mailbox snapshots, keyed by projectId:mailboxId. */
+    mailboxes: Map<string, HqMailboxSnapshotPayload>;
+    /** Stable machine identifier — used for machine-level aggregation. */
+    machineId?: string;
+    /** Per-client session snapshots (the spine of the fleet tree). */
+    sessions: Map<string, TrackedSessionSnapshot>;
+    /** Per-client coordinator fleet snapshots, keyed by runId and owned by a session when known. */
+    fleets: Map<string, TrackedFleetSnapshot>;
+    /** Per-session MCP health snapshots, keyed by sessionId. */
+    mcpSnapshots: Map<string, HqMcpServerHealth[]>;
+    /** Pending outbound commands (Phase 3 — control plane). */
+    commandQueue: HqQueuedCommand[];
+}
+export interface TranscriptRing {
+    entries: HqTranscriptEntry[];
+    machineId?: string;
+}
+export interface HqSnapshotBroadcaster {
+    currentSerialized(): string;
+    broadcast(): void;
+    close(): void;
+}
+export interface ProjectDetail {
+    generatedAt: string;
+    project: HqProjectRecord;
+    clients: readonly HqClientRecord[];
+    mailboxes: readonly HqMailboxSnapshotPayload[];
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/hq-server/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/hq-server/types.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC;AACpC,OAAO,KAAK,EACV,kBAAkB,EAClB,cAAc,EACd,eAAe,EACf,sBAAsB,EACtB,wBAAwB,EACxB,iBAAiB,EACjB,aAAa,EACb,iBAAiB,EACjB,eAAe,EACf,eAAe,EACf,iBAAiB,EACjB,wBAAwB,EACxB,OAAO,EACP,iBAAiB,EAClB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAEzD,YAAY,EACV,kBAAkB,EAClB,cAAc,EACd,eAAe,EACf,sBAAsB,EACtB,wBAAwB,EACxB,iBAAiB,EACjB,aAAa,EACb,iBAAiB,EACjB,eAAe,EACf,eAAe,EACf,iBAAiB,EACjB,wBAAwB,EACxB,OAAO,EACP,iBAAiB,EACjB,gBAAgB,GACjB,CAAC;AAIF,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,wBAAwB,CAAC;IAClC,mGAAmG;IACnG,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,sBAAsB,CAAC;IAChC,uDAAuD;IACvD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,SAAS,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,iBAAiB,CAAC;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IAChC,0EAA0E;IAC1E,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,kFAAkF;IAClF,uBAAuB,EAAE,iBAAiB,CAAC;IAC3C,uEAAuE;IACvE,YAAY,EAAE,MAAM,CAAC;IACrB,kEAAkE;IAClE,SAAS,EAAE,GAAG,CAAC,MAAM,EAAE,wBAAwB,CAAC,CAAC;IACjD,sEAAsE;IACtE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,kEAAkE;IAClE,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAAC;IAC9C,gGAAgG;IAChG,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;IAC1C,4DAA4D;IAC5D,YAAY,EAAE,GAAG,CAAC,MAAM,EAAE,iBAAiB,EAAE,CAAC,CAAC;IAC/C,2DAA2D;IAC3D,YAAY,EAAE,eAAe,EAAE,CAAC;CACjC;AAID,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,iBAAiB,EAAE,CAAC;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAID,MAAM,WAAW,qBAAqB;IACpC,iBAAiB,IAAI,MAAM,CAAC;IAC5B,SAAS,IAAI,IAAI,CAAC;IAClB,KAAK,IAAI,IAAI,CAAC;CACf;AAID,MAAM,WAAW,aAAa;IAC5B,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,eAAe,CAAC;IACzB,OAAO,EAAE,SAAS,cAAc,EAAE,CAAC;IACnC,SAAS,EAAE,SAAS,wBAAwB,EAAE,CAAC;CAChD"}

package/dist/hq-server/utils.d.ts

@@ -0,0 +1,63 @@
+/**
+ * HQ server — general utility functions.
+ *
+ * @module hq-server/utils
+ */
+import type * as http from 'node:http';
+import type { HqEventEnvelope, HqPersistence, HqTranscriptEntry } from '@wrongstack/core';
+export declare const TRANSCRIPT_RING_MAX = 4000;
+export declare const MAX_TRANSCRIPT_SESSIONS = 400;
+export declare const MAX_AGENT_RINGS = 800;
+/**
+ * Evict oldest entries from a Map until its size ≤ max.
+ * Maps are insertion-ordered, so iterating keys() gives the oldest first.
+ */
+export declare function evictOldest(map: Map<string, unknown>, max: number): void;
+/**
+ * Ring key for one subagent's transcript. Scoped by session so same-named
+ * agents in different sessions (every leader is id 'leader') stay separate.
+ * Falls back to the bare subId when no session id is known (legacy clients).
+ */
+export declare function agentRingKey(sessionId: string | undefined, subId: string): string;
+/**
+ * Convert an `agent.message` payload record into a `HqTranscriptEntry` that
+ * is compact and viewable in the HQ session timeline. Mirrors the mapping the
+ * TUI-side buffered-transcript writer applies so the HQ stream looks
+ * identically to the live stream (thinking→thinking, system/status→system).
+ */
+export declare function agentMessageToEntry(p: Record<string, unknown>): HqTranscriptEntry;
+/**
+ * Read one local subagent's FULL conversation from disk. The agent monitor
+ * writes every timeline entry to
+ *   <projectSessions>/<sessionId>/subagents/transcripts/<subId>/transcript.jsonl
+ * so for sessions on THIS machine we can serve the complete history — not
+ * just the ≤4000-entry live ring. Returns null when the session isn't local
+ * or the file is absent (caller falls back to the ring).
+ */
+export declare function readLocalSubagentTranscript(sessionId: string, subagentId: string): Promise<HqTranscriptEntry[] | null>;
+/** Safe URL-decoding — returns null on malformed input. */
+export declare function decodePathSegment(value: string): string | null;
+/** Normalize display host — "0.0.0.0" prints as "127.0.0.1" for user-facing URLs. */
+export declare function displayHost(host: string): string;
+/** Read the full body of an HTTP request as a UTF-8 string (capped at 1 MB). */
+export declare function readRequestBody(req: http.IncomingMessage, maxBytes?: number): Promise<string>;
+export declare function writeInvalidBody(res: http.ServerResponse, error: unknown): void;
+export declare function buildHttpUrl(host: string, port: number, token?: string): string;
+export declare function buildClientWsUrl(host: string, port: number, token?: string): string;
+export declare function hqRuntimeMarkerPath(dataDir: string): string;
+/** Non-internal IPv4 addresses, so we can print URLs reachable from other machines. */
+export declare function lanIPv4Addresses(): string[];
+export declare function truncateHqSummary(value: unknown, maxLength: number): string | undefined;
+/**
+ * Stable per-machine key. Prefers hostname so the same physical computer maps
+ * to one machine even when clients report different per-process machineIds
+ * (older builds hashed `hostname:pid`). Falls back to machineId.
+ */
+export declare function hqMachineKey(hostname: string | undefined, machineId: string | undefined): string;
+/**
+ * Fold a cost/tool signal from an event envelope into the timeseries store.
+ * Recognizes `session.usage` (cost/tokens) and `tool.completed` (tool call).
+ * Best-effort, never throws.
+ */
+export declare function recordTimeseriesSignal(persistence: HqPersistence, event: HqEventEnvelope): void;
+//# sourceMappingURL=utils.d.ts.map

package/dist/hq-server/utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../../src/hq-server/utils.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,KAAK,KAAK,IAAI,MAAM,WAAW,CAAC;AAGvC,OAAO,KAAK,EAAE,eAAe,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAK1F,eAAO,MAAM,mBAAmB,OAAO,CAAC;AACxC,eAAO,MAAM,uBAAuB,MAAM,CAAC;AAC3C,eAAO,MAAM,eAAe,MAAM,CAAC;AAInC;;;GAGG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI,CAMxE;AAID;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAEjF;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,iBAAiB,CAmBjF;AAED;;;;;;;GAOG;AACH,wBAAsB,2BAA2B,CAC/C,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,iBAAiB,EAAE,GAAG,IAAI,CAAC,CA4BrC;AAID,2DAA2D;AAC3D,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAM9D;AAED,qFAAqF;AACrF,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEhD;AAMD,gFAAgF;AAChF,wBAAgB,eAAe,CAAC,GAAG,EAAE,IAAI,CAAC,eAAe,EAAE,QAAQ,SAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CAuBhG;AAED,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,IAAI,CAAC,cAAc,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI,CAI/E;AAID,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAI/E;AAED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAInF;AAID,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAE3D;AAID,uFAAuF;AACvF,wBAAgB,gBAAgB,IAAI,MAAM,EAAE,CAa3C;AAID,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAIvF;AAID;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,EAAE,SAAS,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAGhG;AAID;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,WAAW,EAAE,aAAa,EAAE,KAAK,EAAE,eAAe,GAAG,IAAI,CAmB/F"}

package/dist/hq-server/ws.d.ts

@@ -0,0 +1,14 @@
+/**
+ * HQ server — WebSocket handlers for browser and client connections.
+ *
+ * @module hq-server/ws
+ */
+import { WebSocket } from 'ws';
+import { type HqCommandAuditLog, type HqEventEnvelope, type HqPersistence, type HqRedactionPolicy, type HqToken, type HqTranscriptEntry } from '@wrongstack/core';
+import type { ConnectedClient, HqSnapshotBroadcaster, TranscriptRing } from './types.js';
+export declare function handleBrowser(ws: WebSocket, snapshotBroadcaster: HqSnapshotBroadcaster, browsers: Set<WebSocket>): void;
+export declare function handleClient(ws: WebSocket, clients: Map<WebSocket, ConnectedClient>, browsers: Set<WebSocket>, eventLog: HqEventEnvelope[], auth: {
+    token?: HqToken | undefined;
+    getOperatorPolicy: () => Partial<HqRedactionPolicy> | undefined;
+}, snapshotBroadcaster: HqSnapshotBroadcaster, transcripts: Map<string, TranscriptRing>, agentMessages: Map<string, HqTranscriptEntry[]>, persistence?: HqPersistence, auditLog?: HqCommandAuditLog): void;
+//# sourceMappingURL=ws.d.ts.map

package/dist/hq-server/ws.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ws.d.ts","sourceRoot":"","sources":["../../src/hq-server/ws.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC;AAC/B,OAAO,EASL,KAAK,iBAAiB,EACtB,KAAK,eAAe,EAKpB,KAAK,aAAa,EAElB,KAAK,iBAAiB,EAGtB,KAAK,OAAO,EAEZ,KAAK,iBAAiB,EAEvB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,eAAe,EAAE,qBAAqB,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAmBzF,wBAAgB,aAAa,CAC3B,EAAE,EAAE,SAAS,EACb,mBAAmB,EAAE,qBAAqB,EAC1C,QAAQ,EAAE,GAAG,CAAC,SAAS,CAAC,GACvB,IAAI,CAsBN;AAID,wBAAgB,YAAY,CAC1B,EAAE,EAAE,SAAS,EACb,OAAO,EAAE,GAAG,CAAC,SAAS,EAAE,eAAe,CAAC,EACxC,QAAQ,EAAE,GAAG,CAAC,SAAS,CAAC,EACxB,QAAQ,EAAE,eAAe,EAAE,EAC3B,IAAI,EAAE;IACJ,KAAK,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC5B,iBAAiB,EAAE,MAAM,OAAO,CAAC,iBAAiB,CAAC,GAAG,SAAS,CAAC;CACjE,EACD,mBAAmB,EAAE,qBAAqB,EAC1C,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,EACxC,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE,iBAAiB,EAAE,CAAC,EAC/C,WAAW,CAAC,EAAE,aAAa,EAC3B,QAAQ,CAAC,EAAE,iBAAiB,GAC3B,IAAI,CAiaN"}

package/dist/hq-server.d.ts

@@ -0,0 +1,60 @@
+import { type HqTranscriptEntry } from '@wrongstack/core';
+import { HQ_HTML } from './hq-dashboard-html.js';
+export interface HqServerOptions {
+    host?: string;
+    port?: number;
+    strictPort?: boolean;
+    /**
+     * When true, the server binds exactly to `port` and fails with an error
+     * if that port is already in use — no port scanning. Use this when the
+     * user explicitly selected a port and we should not silently pick another.
+     */
+    exactPort?: boolean;
+    /**
+     * HQ data directory. When omitted, the server resolves one via
+     * `resolveHqDataDir()` (honoring `WRONGSTACK_HQ_DATA_DIR` then falling
+     * back to `~/.wrongstack/hq`). The directory holds `auth.json` and, in
+     * later phases, the persistent event log and snapshot cache.
+     */
+    dataDir?: string;
+    /** Browser liveness frame interval. Primarily exposed for deterministic integration tests. */
+    browserHeartbeatIntervalMs?: number;
+    /** Connected-client inactivity timeout. Primarily exposed for deterministic integration tests. */
+    clientTtlMs?: number;
+    /** Stale-client scan interval. Primarily exposed for deterministic integration tests. */
+    clientCleanupIntervalMs?: number;
+    /** Session-snapshot freshness timeout. Primarily exposed for deterministic integration tests. */
+    sessionSnapshotTtlMs?: number;
+    /** Optional browser password login. When provided on first-run, the auth file stores a scrypt hash. */
+    password?: string;
+}
+export interface HqStartupConnectionInfo {
+    dataDir: string;
+    browserUrl: string;
+    clientUrl: string;
+    clientEnv: {
+        WRONGSTACK_HQ_URL: string;
+        WRONGSTACK_HQ_TOKEN?: string;
+    };
+    createdAuth: boolean;
+}
+export type HqFirstRunSetup = HqStartupConnectionInfo;
+export interface HqServerHandle {
+    host: string;
+    port: number;
+    firstRunSetup?: HqFirstRunSetup;
+    close(): Promise<void>;
+}
+/**
+ * Read one local subagent's FULL conversation from disk. The agent monitor
+ * writes every timeline entry to
+ *   <projectSessions>/<sessionId>/subagents/transcripts/<subId>/transcript.jsonl
+ * so for sessions on THIS machine we can serve the complete history — not
+ * just the ≤4000-entry live ring. Returns null when the session isn't local
+ * or the file is absent (caller falls back to the ring).
+ */
+export declare function readLocalSubagentTranscript(sessionId: string, subagentId: string): Promise<HqTranscriptEntry[] | null>;
+export declare const DEFAULT_PORT = 3499;
+export { HQ_HTML };
+export declare function startHqServer(options?: HqServerOptions): Promise<HqServerHandle>;
+//# sourceMappingURL=hq-server.d.ts.map

package/dist/hq-server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hq-server.d.ts","sourceRoot":"","sources":["../src/hq-server.ts"],"names":[],"mappings":"AAsBA,OAAO,EAYL,KAAK,iBAAiB,EAevB,MAAM,kBAAkB,CAAC;AAY1B,OAAO,EAAE,OAAO,EAAE,MAAM,wBAAwB,CAAC;AAGjD,MAAM,WAAW,eAAe;IAC9B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB;;;;OAIG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,8FAA8F;IAC9F,0BAA0B,CAAC,EAAE,MAAM,CAAC;IACpC,kGAAkG;IAClG,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,yFAAyF;IACzF,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,iGAAiG;IACjG,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,uGAAuG;IACvG,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE;QACT,iBAAiB,EAAE,MAAM,CAAC;QAC1B,mBAAmB,CAAC,EAAE,MAAM,CAAC;KAC9B,CAAC;IACF,WAAW,EAAE,OAAO,CAAC;CACtB;AAED,MAAM,MAAM,eAAe,GAAG,uBAAuB,CAAC;AAEtD,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,CAAC,EAAE,eAAe,CAAC;IAChC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAoHD;;;;;;;GAOG;AACH,wBAAsB,2BAA2B,CAC/C,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,iBAAiB,EAAE,GAAG,IAAI,CAAC,CA4BrC;AAGD,eAAO,MAAM,YAAY,OAAO,CAAC;AAsHjC,OAAO,EAAE,OAAO,EAAE,CAAC;AAsJnB,wBAAsB,aAAa,CAAC,OAAO,GAAE,eAAoB,GAAG,OAAO,CAAC,cAAc,CAAC,CAa1F"}

package/dist/hq-static-serve.d.ts

@@ -0,0 +1,26 @@
+/**
+ * HQ static-serve — resolve and serve the built `@wrongstack/webui-hq/dist`
+ * dashboard. Mirrors the pattern in `webui-server/static-serve.ts` but for
+ * the HQ app. Falls back to the inline `HQ_HTML` when the dist is unbuilt so
+ * HQ is always functional.
+ *
+ * @module hq-static-serve
+ */
+import type * as http from 'node:http';
+/**
+ * Resolve the HQ dashboard dist directory. Returns the absolute path to
+ * `@wrongstack/webui-hq/dist`, or `null` when the package/dist is not
+ * present (e.g. unbuilt). Result is cached for the process lifetime.
+ */
+export declare function resolveHqDistDir(): string | null;
+export interface ServeStaticResult {
+    handled: boolean;
+}
+/**
+ * Serve a static file from the HQ dist for an HTTP request. Handles the SPA
+ * fallback (unknown routes → index.html). Returns `{handled:false}` when the
+ * dist is not available (caller should serve the inline fallback) or the
+ * path doesn't match a static asset.
+ */
+export declare function serveHqStatic(_req: http.IncomingMessage, res: http.ServerResponse, urlPath: string, distDir: string): ServeStaticResult;
+//# sourceMappingURL=hq-static-serve.d.ts.map

package/dist/hq-static-serve.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hq-static-serve.d.ts","sourceRoot":"","sources":["../src/hq-static-serve.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,KAAK,KAAK,IAAI,MAAM,WAAW,CAAC;AAsBvC;;;;GAIG;AACH,wBAAgB,gBAAgB,IAAI,MAAM,GAAG,IAAI,CAyChD;AAQD,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,OAAO,CAAC;CAClB;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAC3B,IAAI,EAAE,IAAI,CAAC,eAAe,EAC1B,GAAG,EAAE,IAAI,CAAC,cAAc,EACxB,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,GACd,iBAAiB,CA2BnB"}

package/dist/index.d.ts

@@ -1,5 +1,3 @@
-declare const CLI_VERSION: string;
-
-declare function main(argv: string[]): Promise<number>;
-
-export { CLI_VERSION, main };
+export { main } from './cli-main.js';
+export { CLI_VERSION } from './version.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AACrC,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC"}