@wrongstack/cli 0.293.0 → 0.295.0

package/dist/hq-server/preflight.d.ts

@@ -0,0 +1,22 @@
+import { type EnsureHqFirstRunAuthResult } from '@wrongstack/core/hq';
+export interface HqPreflightOptions {
+    host?: string;
+    port?: number;
+    dataDir?: string;
+    password?: string;
+    tokenTtlMs?: number;
+    requireBrowserAuth?: boolean;
+    allowInsecureOpen?: boolean;
+}
+export interface HqPreflightResult {
+    host: string;
+    port: number;
+    dataDir: string;
+    firstRunAuth: EnsureHqFirstRunAuthResult;
+}
+/** Resolves startup inputs and enforces exposure/auth policy before binding a socket. */
+export declare function prepareHqServerStart(options: HqPreflightOptions, defaults: {
+    host: string;
+    port: number;
+}): Promise<HqPreflightResult>;
+//# sourceMappingURL=preflight.d.ts.map

package/dist/hq-server/preflight.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"preflight.d.ts","sourceRoot":"","sources":["../../src/hq-server/preflight.ts"],"names":[],"mappings":"AACA,OAAO,EAA2B,KAAK,0BAA0B,EAAE,MAAM,qBAAqB,CAAC;AAG/F,MAAM,WAAW,kBAAkB;IACjC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,iBAAiB,CAAC,EAAE,OAAO,CAAC;CAC7B;AAED,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,0BAA0B,CAAC;CAC1C;AAED,yFAAyF;AACzF,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,kBAAkB,EAC3B,QAAQ,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACvC,OAAO,CAAC,iBAAiB,CAAC,CA+C5B"}

package/dist/hq-server/routes.d.ts

@@ -9,7 +9,11 @@
  */
 import type * as http from 'node:http';
 import { WebSocket } from 'ws';
-import { type HqSnapshot, createHqPersistence, createMailboxHttpRouter, GlobalMailbox, HqAlertEngine, type HqAlertRuleConfig, HqCommandAuditLog, type HqEventEnvelope, type HqRedactionPolicy, type HqToken, type HqTranscriptEntry, type MailboxHttpAccessDecision, MailboxHttpRateLimiter } from '@wrongstack/core';
+import type { TrustBoundary } from '@wrongstack/core/security';
+import { createHqPersistence } from '@wrongstack/core/hq';
+import { type HqSnapshot, HqAlertEngine, HqCommandAuditLog, type HqEventEnvelope, type HqTranscriptEntry } from '@wrongstack/core/hq';
+import { createMailboxHttpRouter } from '@wrongstack/core/coordination';
+import { GlobalMailbox, type MailboxHttpAccessDecision, MailboxHttpRateLimiter } from '@wrongstack/core/coordination';
 import * as HqServerAuth from './auth.js';
 import * as HqServerUtils from './utils.js';
 export declare const setHqSecurityHeaders: typeof HqServerAuth.setHqSecurityHeaders;
@@ -33,27 +37,14 @@ export declare const agentMessageToEntry: typeof HqServerUtils.agentMessageToEnt
 export declare const readLocalSubagentTranscript: typeof HqServerUtils.readLocalSubagentTranscript;
 export declare const lanIPv4Addresses: typeof HqServerUtils.lanIPv4Addresses;
 export declare const hqRuntimeMarkerPath: typeof HqServerUtils.hqRuntimeMarkerPath;
-import type { ConnectedClient, HqSnapshotBroadcaster, ProjectDetail, TranscriptRing } from './types.js';
+import type { ConnectedClient, HqRouterMutableAuth, HqSnapshotBroadcaster, ProjectDetail, TranscriptRing } from './types.js';
 export type { ConnectedClient, HqSnapshotBroadcaster, ProjectDetail, TranscriptRing, };
-export interface HqRouterMutableAuth {
-    operatorPolicy: HqRedactionPolicy;
-    operatorPolicyOverride: Partial<HqRedactionPolicy> | undefined;
-    browserTokens: Set<string>;
-    clientTokens: Set<string>;
-    browserTokenObjs: Map<string, {
-        id: string;
-        capabilities?: string[];
-    }>;
-    clientTokenObjs: Map<string, HqToken>;
-    passwordHash?: string | undefined;
-    cookieSecret?: string | undefined;
-    alertRules: HqAlertRuleConfig | undefined;
-}
 export interface HqRouterMailboxGateway {
     mailbox: GlobalMailbox;
     router: ReturnType<typeof createMailboxHttpRouter>;
 }
 export interface HqRouterDeps {
+    trustBoundary: TrustBoundary;
     host: string;
     listeningPort: number;
     trustedPublicOrigins: Set<string>;

package/dist/hq-server/routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"routes.d.ts","sourceRoot":"","sources":["../../src/hq-server/routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,OAAO,KAAK,KAAK,IAAI,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC;AAC/B,OAAO,EAEL,KAAK,UAAU,EACf,mBAAmB,EACnB,uBAAuB,EAEvB,aAAa,EACb,aAAa,EACb,KAAK,iBAAiB,EAGtB,iBAAiB,EACjB,KAAK,eAAe,EAEpB,KAAK,iBAAiB,EAEtB,KAAK,OAAO,EACZ,KAAK,iBAAiB,EAGtB,KAAK,yBAAyB,EAC9B,sBAAsB,EAQvB,MAAM,kBAAkB,CAAC;AAG1B,OAAO,KAAK,YAAY,MAAM,WAAW,CAAC;AAE1C,OAAO,KAAK,aAAa,MAAM,YAAY,CAAC;AAI5C,eAAO,MAAM,oBAAoB,0CAAoC,CAAC;AACtE,eAAO,MAAM,uBAAuB,6CAAuC,CAAC;AAC5E,eAAO,MAAM,0BAA0B,gDAA0C,CAAC;AAClF,eAAO,MAAM,WAAW,iCAA2B,CAAC;AACpD,eAAO,MAAM,kBAAkB,wCAAkC,CAAC;AAClE,eAAO,MAAM,oBAAoB,0CAAoC,CAAC;AACtE,eAAO,MAAM,wBAAwB,8CAAwC,CAAC;AAC9E,eAAO,MAAM,oBAAoB,0CAAoC,CAAC;AACtE,eAAO,MAAM,iBAAiB,uCAAiC,CAAC;AAChE,eAAO,MAAM,iBAAiB,eAAiC,CAAC;AAEhE,eAAO,MAAM,iBAAiB,wCAAkC,CAAC;AACjE,eAAO,MAAM,eAAe,sCAAgC,CAAC;AAC7D,eAAO,MAAM,gBAAgB,uCAAiC,CAAC;AAC/D,eAAO,MAAM,gBAAgB,uCAAiC,CAAC;AAC/D,eAAO,MAAM,YAAY,mCAA6B,CAAC;AACvD,eAAO,MAAM,gBAAgB,uCAAiC,CAAC;AAC/D,eAAO,MAAM,YAAY,mCAA6B,CAAC;AACvD,eAAO,MAAM,mBAAmB,0CAAoC,CAAC;AACrE,eAAO,MAAM,2BAA2B,kDAA4C,CAAC;AACrF,eAAO,MAAM,gBAAgB,uCAAiC,CAAC;AAC/D,eAAO,MAAM,mBAAmB,0CAAoC,CAAC;AAIrE,OAAO,KAAK,EACV,eAAe,EACf,qBAAqB,EACrB,aAAa,EACb,cAAc,EACf,MAAM,YAAY,CAAC;AAEpB,YAAY,EACV,eAAe,EACf,qBAAqB,EACrB,aAAa,EACb,cAAc,GACf,CAAC;AASF,MAAM,WAAW,mBAAmB;IAClC,cAAc,EAAE,iBAAiB,CAAC;IAClC,sBAAsB,EAAE,OAAO,CAAC,iBAAiB,CAAC,GAAG,SAAS,CAAC;IAC/D,aAAa,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC3B,YAAY,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC1B,gBAAgB,EAAE,GAAG,CAAC,MAAM,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAC;IACvE,eAAe,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACtC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,UAAU,EAAE,iBAAiB,GAAG,SAAS,CAAC;CAC3C;AAED,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,aAAa,CAAC;IACvB,MAAM,EAAE,UAAU,CAAC,OAAO,uBAAuB,CAAC,CAAC;CACpD;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,EAAE,MAAM,CAAC;IACtB,oBAAoB,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAClC,WAAW,EAAE,mBAAmB,CAAC;IACjC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC7C,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACzF,OAAO,EAAE,GAAG,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC;IACzC,QAAQ,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC;IACzB,QAAQ,EAAE,eAAe,EAAE,CAAC;IAC5B,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IACzC,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE,iBAAiB,EAAE,CAAC,CAAC;IAChD,eAAe,EAAE,GAAG,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAAC;IACrD,yBAAyB,EAAE,sBAAsB,CAAC;IAClD,WAAW,EAAE,aAAa,CAAC;IAC3B,QAAQ,EAAE,iBAAiB,CAAC;IAC5B,WAAW,EAAE,UAAU,CAAC,OAAO,mBAAmB,CAAC,CAAC;IACpD,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,kBAAkB,EAAE,OAAO,GAAG,SAAS,CAAC;IACxC,aAAa,EAAE,OAAO,GAAG,SAAS,CAAC;IACnC,uBAAuB,EAAE,CACvB,GAAG,EAAE,IAAI,CAAC,eAAe,EACzB,UAAU,EAAE,MAAM,KACf,yBAAyB,CAAC;IAC/B,iBAAiB,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,sBAAsB,CAAC;IAClE,uEAAuE;IACvE,aAAa,CAAC,EAAE,CAAC,MAAM,UAAU,CAAC,QAAQ,CAAC,CAAC,YAAY,CAAC,GAAG,SAAS,CAAC,GAAG,SAAS,CAAC;CACpF;AAID;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,YAAY,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,eAAe,EAAE,GAAG,EAAE,IAAI,CAAC,cAAc,KAAK,OAAO,CAAC,IAAI,CAAC,CA8NzH"}
+{"version":3,"file":"routes.d.ts","sourceRoot":"","sources":["../../src/hq-server/routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,OAAO,KAAK,KAAK,IAAI,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC;AAC/B,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,EAA6B,mBAAmB,EAAmM,MAAM,qBAAqB,CAAC;AACtR,OAAO,EAAE,KAAK,UAAU,EAAE,aAAa,EAAoE,iBAAiB,EAAE,KAAK,eAAe,EAAuF,KAAK,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAC7R,OAAO,EAAE,uBAAuB,EAAE,MAAM,+BAA+B,CAAC;AACxE,OAAO,EAAE,aAAa,EAAE,KAAK,yBAAyB,EAAE,sBAAsB,EAAqB,MAAM,+BAA+B,CAAC;AAGzI,OAAO,KAAK,YAAY,MAAM,WAAW,CAAC;AAE1C,OAAO,KAAK,aAAa,MAAM,YAAY,CAAC;AAK5C,eAAO,MAAM,oBAAoB,0CAAoC,CAAC;AACtE,eAAO,MAAM,uBAAuB,6CAAuC,CAAC;AAC5E,eAAO,MAAM,0BAA0B,gDAA0C,CAAC;AAClF,eAAO,MAAM,WAAW,iCAA2B,CAAC;AACpD,eAAO,MAAM,kBAAkB,wCAAkC,CAAC;AAClE,eAAO,MAAM,oBAAoB,0CAAoC,CAAC;AACtE,eAAO,MAAM,wBAAwB,8CAAwC,CAAC;AAC9E,eAAO,MAAM,oBAAoB,0CAAoC,CAAC;AACtE,eAAO,MAAM,iBAAiB,uCAAiC,CAAC;AAChE,eAAO,MAAM,iBAAiB,eAAiC,CAAC;AAEhE,eAAO,MAAM,iBAAiB,wCAAkC,CAAC;AACjE,eAAO,MAAM,eAAe,sCAAgC,CAAC;AAC7D,eAAO,MAAM,gBAAgB,uCAAiC,CAAC;AAC/D,eAAO,MAAM,gBAAgB,uCAAiC,CAAC;AAC/D,eAAO,MAAM,YAAY,mCAA6B,CAAC;AACvD,eAAO,MAAM,gBAAgB,uCAAiC,CAAC;AAC/D,eAAO,MAAM,YAAY,mCAA6B,CAAC;AACvD,eAAO,MAAM,mBAAmB,0CAAoC,CAAC;AACrE,eAAO,MAAM,2BAA2B,kDAA4C,CAAC;AACrF,eAAO,MAAM,gBAAgB,uCAAiC,CAAC;AAC/D,eAAO,MAAM,mBAAmB,0CAAoC,CAAC;AAIrE,OAAO,KAAK,EACV,eAAe,EACf,mBAAmB,EACnB,qBAAqB,EACrB,aAAa,EACb,cAAc,EACf,MAAM,YAAY,CAAC;AAEpB,YAAY,EACV,eAAe,EACf,qBAAqB,EACrB,aAAa,EACb,cAAc,GACf,CAAC;AASF,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,aAAa,CAAC;IACvB,MAAM,EAAE,UAAU,CAAC,OAAO,uBAAuB,CAAC,CAAC;CACpD;AAED,MAAM,WAAW,YAAY;IAC3B,aAAa,EAAE,aAAa,CAAC;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,EAAE,MAAM,CAAC;IACtB,oBAAoB,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAClC,WAAW,EAAE,mBAAmB,CAAC;IACjC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC7C,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACzF,OAAO,EAAE,GAAG,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC;IACzC,QAAQ,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC;IACzB,QAAQ,EAAE,eAAe,EAAE,CAAC;IAC5B,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IACzC,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE,iBAAiB,EAAE,CAAC,CAAC;IAChD,eAAe,EAAE,GAAG,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAAC;IACrD,yBAAyB,EAAE,sBAAsB,CAAC;IAClD,WAAW,EAAE,aAAa,CAAC;IAC3B,QAAQ,EAAE,iBAAiB,CAAC;IAC5B,WAAW,EAAE,UAAU,CAAC,OAAO,mBAAmB,CAAC,CAAC;IACpD,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,kBAAkB,EAAE,OAAO,GAAG,SAAS,CAAC;IACxC,aAAa,EAAE,OAAO,GAAG,SAAS,CAAC;IACnC,uBAAuB,EAAE,CACvB,GAAG,EAAE,IAAI,CAAC,eAAe,EACzB,UAAU,EAAE,MAAM,KACf,yBAAyB,CAAC;IAC/B,iBAAiB,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,sBAAsB,CAAC;IAClE,uEAAuE;IACvE,aAAa,CAAC,EAAE,CAAC,MAAM,UAAU,CAAC,QAAQ,CAAC,CAAC,YAAY,CAAC,GAAG,SAAS,CAAC,GAAG,SAAS,CAAC;CACpF;AAID;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,YAAY,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,eAAe,EAAE,GAAG,EAAE,IAAI,CAAC,cAAc,KAAK,OAAO,CAAC,IAAI,CAAC,CAuPzH"}

package/dist/hq-server/snapshot.d.ts

@@ -3,10 +3,18 @@
  *
  * @module hq-server/snapshot
  */
-import type { HqCommandAuditEntry, HqEventEnvelope, HqPersistence, HqSnapshot } from '@wrongstack/core';
+import type { HqCommandAuditEntry, HqEventEnvelope, HqPersistence, HqSnapshot } from '@wrongstack/core/hq';
 import { WebSocket } from 'ws';
 import type { ConnectedClient, HqSnapshotBroadcaster, ProjectDetail } from './types.js';
 export declare const HQ_SNAPSHOT_BROADCAST_DEBOUNCE_MS = 100;
+/**
+ * Minimum spacing between disk checkpoints of snapshot.json. Browser broadcasts
+ * stay at the 100ms debounce, but the on-disk checkpoint (only used to re-seed a
+ * restarted HQ) does not need to be rewritten at broadcast rate. Throttling it
+ * stops an idle HQ — running behind active local TUIs/REPLs with nobody viewing
+ * the dashboard — from doing a full rebuild + atomic disk write at up to 10 Hz.
+ */
+export declare const HQ_SNAPSHOT_PERSIST_MIN_INTERVAL_MS = 3000;
 export declare function buildSnapshot(clients: Map<WebSocket, ConnectedClient>, options?: {
     tokenStats?: HqSnapshot['totals']['tokenStats'];
 }): HqSnapshot;

package/dist/hq-server/snapshot.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"snapshot.d.ts","sourceRoot":"","sources":["../../src/hq-server/snapshot.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAIV,mBAAmB,EACnB,eAAe,EAOf,aAAa,EAIb,UAAU,EACX,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC;AAC/B,OAAO,KAAK,EAAE,eAAe,EAAE,qBAAqB,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAKxF,eAAO,MAAM,iCAAiC,MAAM,CAAC;AAIrD,wBAAgB,aAAa,CAC3B,OAAO,EAAE,GAAG,CAAC,SAAS,EAAE,eAAe,CAAC,EACxC,OAAO,CAAC,EAAE;IAAE,UAAU,CAAC,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,YAAY,CAAC,CAAA;CAAE,GAC5D,UAAU,CAySZ;AAID,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,GAAG,CAAC,SAAS,EAAE,eAAe,CAAC,EACxC,QAAQ,EAAE,GAAG,CAAC,SAAS,CAAC,EACxB,WAAW,CAAC,EAAE,aAAa,GAC1B,qBAAqB,CAgDvB;AAID,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,GAAG,CAAC,SAAS,EAAE,eAAe,CAAC,EACxC,SAAS,EAAE,MAAM,GAChB,aAAa,GAAG,IAAI,CAqDtB;AAID,wBAAgB,cAAc,CAAC,KAAK,EAAE,eAAe,EAAE,QAAQ,EAAE,GAAG,CAAC,SAAS,CAAC,GAAG,IAAI,CAMrF;AAED,8EAA8E;AAC9E,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,mBAAmB,EAC5B,QAAQ,EAAE,GAAG,CAAC,SAAS,CAAC,GACvB,IAAI,CAKN"}
+{"version":3,"file":"snapshot.d.ts","sourceRoot":"","sources":["../../src/hq-server/snapshot.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAwD,mBAAmB,EAAE,eAAe,EAA0H,aAAa,EAA+D,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACtV,OAAO,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC;AAC/B,OAAO,KAAK,EAAE,eAAe,EAAE,qBAAqB,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAKxF,eAAO,MAAM,iCAAiC,MAAM,CAAC;AACrD;;;;;;GAMG;AACH,eAAO,MAAM,mCAAmC,OAAQ,CAAC;AAIzD,wBAAgB,aAAa,CAC3B,OAAO,EAAE,GAAG,CAAC,SAAS,EAAE,eAAe,CAAC,EACxC,OAAO,CAAC,EAAE;IAAE,UAAU,CAAC,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,YAAY,CAAC,CAAA;CAAE,GAC5D,UAAU,CAySZ;AAID,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,GAAG,CAAC,SAAS,EAAE,eAAe,CAAC,EACxC,QAAQ,EAAE,GAAG,CAAC,SAAS,CAAC,EACxB,WAAW,CAAC,EAAE,aAAa,GAC1B,qBAAqB,CA+DvB;AAID,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,GAAG,CAAC,SAAS,EAAE,eAAe,CAAC,EACxC,SAAS,EAAE,MAAM,GAChB,aAAa,GAAG,IAAI,CAqDtB;AAID,wBAAgB,cAAc,CAAC,KAAK,EAAE,eAAe,EAAE,QAAQ,EAAE,GAAG,CAAC,SAAS,CAAC,GAAG,IAAI,CAMrF;AAED,8EAA8E;AAC9E,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,mBAAmB,EAC5B,QAAQ,EAAE,GAAG,CAAC,SAAS,CAAC,GACvB,IAAI,CAKN"}

package/dist/hq-server/trust-boundary.d.ts

@@ -0,0 +1,15 @@
+import type { HqCommand } from '@wrongstack/core/hq';
+import { type TrustBoundary } from '@wrongstack/core/security';
+import type { ConnectedClient } from './types.js';
+export declare function authorizeHqCommand(input: {
+    boundary: TrustBoundary;
+    command: HqCommand;
+    commandId: string;
+    enqueuedBy: string;
+    authMethod: 'session' | 'bearer-token';
+    target: ConnectedClient;
+}): Promise<{
+    allowed: boolean;
+    reason: string;
+}>;
+//# sourceMappingURL=trust-boundary.d.ts.map

package/dist/hq-server/trust-boundary.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"trust-boundary.d.ts","sourceRoot":"","sources":["../../src/hq-server/trust-boundary.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAA0B,KAAK,aAAa,EAA6B,MAAM,2BAA2B,CAAC;AAClH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAElD,wBAAsB,kBAAkB,CAAC,KAAK,EAAE;IAC9C,QAAQ,EAAE,aAAa,CAAC;IACxB,OAAO,EAAE,SAAS,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,SAAS,GAAG,cAAc,CAAC;IACvC,MAAM,EAAE,eAAe,CAAC;CACzB,GAAG,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CA6ChD"}

package/dist/hq-server/types.d.ts

@@ -4,8 +4,8 @@
  * @module hq-server/types
  */
 import type { WebSocket } from 'ws';
-import type { HqClientCapability, HqClientRecord, HqEventEnvelope, HqFleetSnapshotPayload, HqMailboxSnapshotPayload, HqMcpServerHealth, HqPersistence, HqProjectIdentity, HqProjectRecord, HqQueuedCommand, HqRedactionPolicy, HqSessionSnapshotPayload, HqToken, HqTranscriptEntry } from '@wrongstack/core';
-import type { HqBrowserMessage } from '@wrongstack/core';
+import type { HqClientCapability, HqAlertRuleConfig, HqClientRecord, HqEventEnvelope, HqFleetSnapshotPayload, HqMailboxSnapshotPayload, HqMcpServerHealth, HqPersistence, HqProjectIdentity, HqProjectRecord, HqQueuedCommand, HqRedactionPolicy, HqSessionSnapshotPayload, HqToken, HqTranscriptEntry } from '@wrongstack/core/hq';
+import type { HqBrowserMessage } from '@wrongstack/core/hq';
 export type { HqClientCapability, HqClientRecord, HqEventEnvelope, HqFleetSnapshotPayload, HqMailboxSnapshotPayload, HqMcpServerHealth, HqPersistence, HqProjectIdentity, HqProjectRecord, HqQueuedCommand, HqRedactionPolicy, HqSessionSnapshotPayload, HqToken, HqTranscriptEntry, HqBrowserMessage, };
 export interface TrackedSessionSnapshot {
     payload: HqSessionSnapshotPayload;
@@ -49,6 +49,20 @@ export interface ConnectedClient {
     /** Pending outbound commands (Phase 3 — control plane). */
     commandQueue: HqQueuedCommand[];
 }
+export interface HqRouterMutableAuth {
+    operatorPolicy: HqRedactionPolicy;
+    operatorPolicyOverride: Partial<HqRedactionPolicy> | undefined;
+    browserTokens: Set<string>;
+    clientTokens: Set<string>;
+    browserTokenObjs: Map<string, {
+        id: string;
+        capabilities?: string[];
+    }>;
+    clientTokenObjs: Map<string, HqToken>;
+    passwordHash?: string | undefined;
+    cookieSecret?: string | undefined;
+    alertRules: HqAlertRuleConfig | undefined;
+}
 export interface TranscriptRing {
     entries: HqTranscriptEntry[];
     machineId?: string;

package/dist/hq-server/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/hq-server/types.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC;AACpC,OAAO,KAAK,EACV,kBAAkB,EAClB,cAAc,EACd,eAAe,EACf,sBAAsB,EACtB,wBAAwB,EACxB,iBAAiB,EACjB,aAAa,EACb,iBAAiB,EACjB,eAAe,EACf,eAAe,EACf,iBAAiB,EACjB,wBAAwB,EACxB,OAAO,EACP,iBAAiB,EAClB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAEzD,YAAY,EACV,kBAAkB,EAClB,cAAc,EACd,eAAe,EACf,sBAAsB,EACtB,wBAAwB,EACxB,iBAAiB,EACjB,aAAa,EACb,iBAAiB,EACjB,eAAe,EACf,eAAe,EACf,iBAAiB,EACjB,wBAAwB,EACxB,OAAO,EACP,iBAAiB,EACjB,gBAAgB,GACjB,CAAC;AAIF,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,wBAAwB,CAAC;IAClC,mGAAmG;IACnG,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,sBAAsB,CAAC;IAChC,uDAAuD;IACvD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,SAAS,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,iBAAiB,CAAC;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IAChC,0EAA0E;IAC1E,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,kFAAkF;IAClF,uBAAuB,EAAE,iBAAiB,CAAC;IAC3C,uEAAuE;IACvE,YAAY,EAAE,MAAM,CAAC;IACrB,kEAAkE;IAClE,SAAS,EAAE,GAAG,CAAC,MAAM,EAAE,wBAAwB,CAAC,CAAC;IACjD,sEAAsE;IACtE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,kEAAkE;IAClE,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAAC;IAC9C,gGAAgG;IAChG,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;IAC1C,4DAA4D;IAC5D,YAAY,EAAE,GAAG,CAAC,MAAM,EAAE,iBAAiB,EAAE,CAAC,CAAC;IAC/C,2DAA2D;IAC3D,YAAY,EAAE,eAAe,EAAE,CAAC;CACjC;AAID,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,iBAAiB,EAAE,CAAC;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAID,MAAM,WAAW,qBAAqB;IACpC,iBAAiB,IAAI,MAAM,CAAC;IAC5B,SAAS,IAAI,IAAI,CAAC;IAClB,KAAK,IAAI,IAAI,CAAC;CACf;AAID,MAAM,WAAW,aAAa;IAC5B,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,eAAe,CAAC;IACzB,OAAO,EAAE,SAAS,cAAc,EAAE,CAAC;IACnC,SAAS,EAAE,SAAS,wBAAwB,EAAE,CAAC;CAChD"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/hq-server/types.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC;AACpC,OAAO,KAAK,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,cAAc,EAAE,eAAe,EAAE,sBAAsB,EAAE,wBAAwB,EAAE,iBAAiB,EAAE,aAAa,EAAE,iBAAiB,EAAE,eAAe,EAAE,eAAe,EAAE,iBAAiB,EAAE,wBAAwB,EAAE,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACpU,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAE5D,YAAY,EACV,kBAAkB,EAClB,cAAc,EACd,eAAe,EACf,sBAAsB,EACtB,wBAAwB,EACxB,iBAAiB,EACjB,aAAa,EACb,iBAAiB,EACjB,eAAe,EACf,eAAe,EACf,iBAAiB,EACjB,wBAAwB,EACxB,OAAO,EACP,iBAAiB,EACjB,gBAAgB,GACjB,CAAC;AAIF,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,wBAAwB,CAAC;IAClC,mGAAmG;IACnG,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,sBAAsB,CAAC;IAChC,uDAAuD;IACvD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,SAAS,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,iBAAiB,CAAC;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IAChC,0EAA0E;IAC1E,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,kFAAkF;IAClF,uBAAuB,EAAE,iBAAiB,CAAC;IAC3C,uEAAuE;IACvE,YAAY,EAAE,MAAM,CAAC;IACrB,kEAAkE;IAClE,SAAS,EAAE,GAAG,CAAC,MAAM,EAAE,wBAAwB,CAAC,CAAC;IACjD,sEAAsE;IACtE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,kEAAkE;IAClE,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAAC;IAC9C,gGAAgG;IAChG,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;IAC1C,4DAA4D;IAC5D,YAAY,EAAE,GAAG,CAAC,MAAM,EAAE,iBAAiB,EAAE,CAAC,CAAC;IAC/C,2DAA2D;IAC3D,YAAY,EAAE,eAAe,EAAE,CAAC;CACjC;AAED,MAAM,WAAW,mBAAmB;IAClC,cAAc,EAAE,iBAAiB,CAAC;IAClC,sBAAsB,EAAE,OAAO,CAAC,iBAAiB,CAAC,GAAG,SAAS,CAAC;IAC/D,aAAa,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC3B,YAAY,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC1B,gBAAgB,EAAE,GAAG,CAAC,MAAM,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAC;IACvE,eAAe,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACtC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,UAAU,EAAE,iBAAiB,GAAG,SAAS,CAAC;CAC3C;AAID,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,iBAAiB,EAAE,CAAC;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAID,MAAM,WAAW,qBAAqB;IACpC,iBAAiB,IAAI,MAAM,CAAC;IAC5B,SAAS,IAAI,IAAI,CAAC;IAClB,KAAK,IAAI,IAAI,CAAC;CACf;AAID,MAAM,WAAW,aAAa;IAC5B,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,eAAe,CAAC;IACzB,OAAO,EAAE,SAAS,cAAc,EAAE,CAAC;IACnC,SAAS,EAAE,SAAS,wBAAwB,EAAE,CAAC;CAChD"}

package/dist/hq-server/utils.d.ts

@@ -4,7 +4,7 @@
  * @module hq-server/utils
  */
 import type * as http from 'node:http';
-import type { HqEventEnvelope, HqPersistence, HqTranscriptEntry } from '@wrongstack/core';
+import type { HqEventEnvelope, HqPersistence, HqTranscriptEntry } from '@wrongstack/core/hq';
 export declare const TRANSCRIPT_RING_MAX = 4000;
 export declare const MAX_TRANSCRIPT_SESSIONS = 400;
 export declare const MAX_AGENT_RINGS = 800;

package/dist/hq-server/utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../../src/hq-server/utils.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,KAAK,KAAK,IAAI,MAAM,WAAW,CAAC;AAGvC,OAAO,KAAK,EAAE,eAAe,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAK1F,eAAO,MAAM,mBAAmB,OAAO,CAAC;AACxC,eAAO,MAAM,uBAAuB,MAAM,CAAC;AAC3C,eAAO,MAAM,eAAe,MAAM,CAAC;AAInC;;;GAGG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI,CAMxE;AAID;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAEjF;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,iBAAiB,CAmBjF;AAED;;;;;;;GAOG;AACH,wBAAsB,2BAA2B,CAC/C,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,iBAAiB,EAAE,GAAG,IAAI,CAAC,CA4BrC;AAID,2DAA2D;AAC3D,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAM9D;AAED,qFAAqF;AACrF,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEhD;AAMD,gFAAgF;AAChF,wBAAgB,eAAe,CAAC,GAAG,EAAE,IAAI,CAAC,eAAe,EAAE,QAAQ,SAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CAuBhG;AAED,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,IAAI,CAAC,cAAc,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI,CAI/E;AAID,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAI/E;AAED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAInF;AAID,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAE3D;AAID,uFAAuF;AACvF,wBAAgB,gBAAgB,IAAI,MAAM,EAAE,CAa3C;AAID,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAIvF;AAID;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,EAAE,SAAS,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAGhG;AAID;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,WAAW,EAAE,aAAa,EAAE,KAAK,EAAE,eAAe,GAAG,IAAI,CA+B/F;AAID;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,CAerD"}
+{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../../src/hq-server/utils.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,KAAK,KAAK,IAAI,MAAM,WAAW,CAAC;AAGvC,OAAO,KAAK,EAAE,eAAe,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAK7F,eAAO,MAAM,mBAAmB,OAAO,CAAC;AACxC,eAAO,MAAM,uBAAuB,MAAM,CAAC;AAC3C,eAAO,MAAM,eAAe,MAAM,CAAC;AAInC;;;GAGG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI,CAMxE;AAID;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAEjF;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,iBAAiB,CAmBjF;AAED;;;;;;;GAOG;AACH,wBAAsB,2BAA2B,CAC/C,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,iBAAiB,EAAE,GAAG,IAAI,CAAC,CA2BrC;AAID,2DAA2D;AAC3D,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAM9D;AAED,qFAAqF;AACrF,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEhD;AAMD,gFAAgF;AAChF,wBAAgB,eAAe,CAAC,GAAG,EAAE,IAAI,CAAC,eAAe,EAAE,QAAQ,SAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CAuBhG;AAED,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,IAAI,CAAC,cAAc,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI,CAI/E;AAID,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAI/E;AAED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAInF;AAID,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAE3D;AAID,uFAAuF;AACvF,wBAAgB,gBAAgB,IAAI,MAAM,EAAE,CAa3C;AAID,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAIvF;AAID;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,EAAE,SAAS,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAGhG;AAID;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,WAAW,EAAE,aAAa,EAAE,KAAK,EAAE,eAAe,GAAG,IAAI,CA+B/F;AAID;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,CAerD"}

package/dist/hq-server/ws.d.ts

@@ -4,7 +4,7 @@
  * @module hq-server/ws
  */
 import { WebSocket } from 'ws';
-import { type HqCommandAuditLog, type HqEventEnvelope, type HqPersistence, type HqRedactionPolicy, type HqToken, type HqTranscriptEntry } from '@wrongstack/core';
+import { type HqCommandAuditLog, type HqEventEnvelope, type HqPersistence, type HqRedactionPolicy, type HqToken, type HqTranscriptEntry } from '@wrongstack/core/hq';
 import type { ConnectedClient, HqSnapshotBroadcaster, TranscriptRing } from './types.js';
 export declare function handleBrowser(ws: WebSocket, snapshotBroadcaster: HqSnapshotBroadcaster, browsers: Set<WebSocket>): void;
 export declare function handleClient(ws: WebSocket, clients: Map<WebSocket, ConnectedClient>, browsers: Set<WebSocket>, eventLog: HqEventEnvelope[], auth: {

package/dist/hq-server/ws.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ws.d.ts","sourceRoot":"","sources":["../../src/hq-server/ws.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC;AAC/B,OAAO,EASL,KAAK,iBAAiB,EACtB,KAAK,eAAe,EAKpB,KAAK,aAAa,EAElB,KAAK,iBAAiB,EAGtB,KAAK,OAAO,EAEZ,KAAK,iBAAiB,EAEvB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,eAAe,EAAE,qBAAqB,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAmBzF,wBAAgB,aAAa,CAC3B,EAAE,EAAE,SAAS,EACb,mBAAmB,EAAE,qBAAqB,EAC1C,QAAQ,EAAE,GAAG,CAAC,SAAS,CAAC,GACvB,IAAI,CAsBN;AAID,wBAAgB,YAAY,CAC1B,EAAE,EAAE,SAAS,EACb,OAAO,EAAE,GAAG,CAAC,SAAS,EAAE,eAAe,CAAC,EACxC,QAAQ,EAAE,GAAG,CAAC,SAAS,CAAC,EACxB,QAAQ,EAAE,eAAe,EAAE,EAC3B,IAAI,EAAE;IACJ,KAAK,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC5B,iBAAiB,EAAE,MAAM,OAAO,CAAC,iBAAiB,CAAC,GAAG,SAAS,CAAC;CACjE,EACD,mBAAmB,EAAE,qBAAqB,EAC1C,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,EACxC,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE,iBAAiB,EAAE,CAAC,EAC/C,WAAW,CAAC,EAAE,aAAa,EAC3B,QAAQ,CAAC,EAAE,iBAAiB,GAC3B,IAAI,CAqaN"}
+{"version":3,"file":"ws.d.ts","sourceRoot":"","sources":["../../src/hq-server/ws.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC;AAE/B,OAAO,EAAE,KAAK,iBAAiB,EAAE,KAAK,eAAe,EAAyJ,KAAK,aAAa,EAAwB,KAAK,iBAAiB,EAA6D,KAAK,OAAO,EAAkC,KAAK,iBAAiB,EAAyB,MAAM,qBAAqB,CAAC;AACpc,OAAO,KAAK,EAAE,eAAe,EAAE,qBAAqB,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAmBzF,wBAAgB,aAAa,CAC3B,EAAE,EAAE,SAAS,EACb,mBAAmB,EAAE,qBAAqB,EAC1C,QAAQ,EAAE,GAAG,CAAC,SAAS,CAAC,GACvB,IAAI,CAsBN;AAID,wBAAgB,YAAY,CAC1B,EAAE,EAAE,SAAS,EACb,OAAO,EAAE,GAAG,CAAC,SAAS,EAAE,eAAe,CAAC,EACxC,QAAQ,EAAE,GAAG,CAAC,SAAS,CAAC,EACxB,QAAQ,EAAE,eAAe,EAAE,EAC3B,IAAI,EAAE;IACJ,KAAK,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC5B,iBAAiB,EAAE,MAAM,OAAO,CAAC,iBAAiB,CAAC,GAAG,SAAS,CAAC;CACjE,EACD,mBAAmB,EAAE,qBAAqB,EAC1C,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,EACxC,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE,iBAAiB,EAAE,CAAC,EAC/C,WAAW,CAAC,EAAE,aAAa,EAC3B,QAAQ,CAAC,EAAE,iBAAiB,GAC3B,IAAI,CAwcN"}

package/dist/hq-server.d.ts

@@ -5,21 +5,14 @@
  *   /ws/client  — TUI/REPL/WebUI clients publish telemetry
  *   /ws/browser — HQ browser connects and receives snapshot + events
  *
- * Phase 1 is read-only: the HQ browser observes what clients publish. No
- * control commands are sent to clients from the browser yet.
- *
- * Mailbox aggregation: every `mailbox.snapshot` envelope from a client is
- * stored per-(client, mailbox) and merged into the global HqSnapshot on
- * each browser poll / broadcast. Mailbox events still flow through as
- * transient events; snapshots give us the authoritative rollups.
- *
  * @module hq-server
  */
-import { HQ_HTML } from './hq-dashboard-html.js';
+import { type TrustBoundary } from '@wrongstack/core/security';
+import { HQ_HTML } from './hq-recovery-html.js';
 import { readLocalSubagentTranscript, agentRingKey, agentMessageToEntry, decodePathSegment, sanitizeApiError } from './hq-server/routes.js';
 import type { ConnectedClient, TranscriptRing } from './hq-server/types.js';
 export type { ConnectedClient, TranscriptRing };
-export { HqInsecureExposureError } from '@wrongstack/core';
+export { HqInsecureExposureError } from '@wrongstack/core/hq';
 export { HQ_HTML };
 export declare const DEFAULT_HOST = "127.0.0.1";
 export declare const DEFAULT_PORT = 3499;
@@ -31,6 +24,8 @@ export declare const BROWSER_HEARTBEAT_INTERVAL_MS = 15000;
 export declare const SESSION_SNAPSHOT_TTL_MS = 30000;
 export { readLocalSubagentTranscript, decodePathSegment, sanitizeApiError, agentRingKey, agentMessageToEntry, };
 export interface HqServerOptions {
+    /** Policy authority for control-plane command enqueue decisions. */
+    trustBoundary?: TrustBoundary | undefined;
     host?: string;
     port?: number;
     strictPort?: boolean;

package/dist/hq-server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"hq-server.d.ts","sourceRoot":"","sources":["../src/hq-server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAqCH,OAAO,EAAE,OAAO,EAAE,MAAM,wBAAwB,CAAC;AAIjD,OAAO,EAaL,2BAA2B,EAC3B,YAAY,EACZ,mBAAmB,EACnB,iBAAiB,EACjB,gBAAgB,EACjB,MAAM,uBAAuB,CAAC;AAQ/B,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC5E,YAAY,EAAE,eAAe,EAAE,cAAc,EAAE,CAAC;AAEhD,OAAO,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAI3D,OAAO,EAAE,OAAO,EAAE,CAAC;AACnB,eAAO,MAAM,YAAY,cAAc,CAAC;AACxC,eAAO,MAAM,YAAY,OAAO,CAAC;AACjC,eAAO,MAAM,aAAa,OAAO,CAAC;AAClC,eAAO,MAAM,wBAAwB,KAAK,CAAC;AAC3C,eAAO,MAAM,aAAa,QAAS,CAAC;AACpC,eAAO,MAAM,0BAA0B,QAAS,CAAC;AACjD,eAAO,MAAM,6BAA6B,QAAS,CAAC;AACpD,eAAO,MAAM,uBAAuB,QAAS,CAAC;AAE9C,OAAO,EACL,2BAA2B,EAC3B,iBAAiB,EACjB,gBAAgB,EAChB,YAAY,EACZ,mBAAmB,GACpB,CAAC;AAIF,MAAM,WAAW,eAAe;IAC9B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,0BAA0B,CAAC,EAAE,MAAM,CAAC;IACpC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B;;;;;;;;;OASG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE;QACT,iBAAiB,EAAE,MAAM,CAAC;QAC1B,mBAAmB,CAAC,EAAE,MAAM,CAAC;KAC9B,CAAC;IACF,WAAW,EAAE,OAAO,CAAC;IACrB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,YAAY,EAAE,OAAO,CAAC;CACvB;AAED,MAAM,MAAM,eAAe,GAAG,uBAAuB,CAAC;AAEtD,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,CAAC,EAAE,eAAe,CAAC;IAChC,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACxC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAID,wBAAsB,aAAa,CAAC,OAAO,GAAE,eAAoB,GAAG,OAAO,CAAC,cAAc,CAAC,CAqD1F"}
+{"version":3,"file":"hq-server.d.ts","sourceRoot":"","sources":["../src/hq-server.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAQH,OAAO,EAAoC,KAAK,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAKjG,OAAO,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AAIhD,OAAO,EAYL,2BAA2B,EAC3B,YAAY,EACZ,mBAAmB,EACnB,iBAAiB,EACjB,gBAAgB,EACjB,MAAM,uBAAuB,CAAC;AAS/B,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC5E,YAAY,EAAE,eAAe,EAAE,cAAc,EAAE,CAAC;AAEhD,OAAO,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AAI9D,OAAO,EAAE,OAAO,EAAE,CAAC;AACnB,eAAO,MAAM,YAAY,cAAc,CAAC;AACxC,eAAO,MAAM,YAAY,OAAO,CAAC;AACjC,eAAO,MAAM,aAAa,OAAO,CAAC;AAClC,eAAO,MAAM,wBAAwB,KAAK,CAAC;AAC3C,eAAO,MAAM,aAAa,QAAS,CAAC;AACpC,eAAO,MAAM,0BAA0B,QAAS,CAAC;AACjD,eAAO,MAAM,6BAA6B,QAAS,CAAC;AACpD,eAAO,MAAM,uBAAuB,QAAS,CAAC;AAE9C,OAAO,EACL,2BAA2B,EAC3B,iBAAiB,EACjB,gBAAgB,EAChB,YAAY,EACZ,mBAAmB,GACpB,CAAC;AAIF,MAAM,WAAW,eAAe;IAC9B,oEAAoE;IACpE,aAAa,CAAC,EAAE,aAAa,GAAG,SAAS,CAAC;IAC1C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,0BAA0B,CAAC,EAAE,MAAM,CAAC;IACpC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B;;;;;;;;;OASG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE;QACT,iBAAiB,EAAE,MAAM,CAAC;QAC1B,mBAAmB,CAAC,EAAE,MAAM,CAAC;KAC9B,CAAC;IACF,WAAW,EAAE,OAAO,CAAC;IACrB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,YAAY,EAAE,OAAO,CAAC;CACvB;AAED,MAAM,MAAM,eAAe,GAAG,uBAAuB,CAAC;AAEtD,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,CAAC,EAAE,eAAe,CAAC;IAChC,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACxC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAID,wBAAsB,aAAa,CAAC,OAAO,GAAE,eAAoB,GAAG,OAAO,CAAC,cAAc,CAAC,CAM1F"}

package/dist/hq-static-serve.d.ts

@@ -1,8 +1,8 @@
 /**
  * HQ static-serve — resolve and serve the built `@wrongstack/webui-hq/dist`
  * dashboard. Mirrors the pattern in `webui-server/static-serve.ts` but for
- * the HQ app. Falls back to the inline `HQ_HTML` when the dist is unbuilt so
- * HQ is always functional.
+ * the HQ app. Missing assets are reported to the caller, which serves a small
+ * diagnostic shell instead of maintaining a second dashboard implementation.
  *
  * @module hq-static-serve
  */
@@ -19,8 +19,8 @@ export interface ServeStaticResult {
 /**
  * Serve a static file from the HQ dist for an HTTP request. Handles the SPA
  * fallback (unknown routes → index.html). Returns `{handled:false}` when the
- * dist is not available (caller should serve the inline fallback) or the
+ * dist is not available (caller should serve the diagnostic shell) or the
  * path doesn't match a static asset.
  */
-export declare function serveHqStatic(_req: http.IncomingMessage, res: http.ServerResponse, urlPath: string, distDir: string): ServeStaticResult;
+export declare function serveHqStatic(_req: http.IncomingMessage, res: http.ServerResponse, urlPath: string, distDir: string): Promise<ServeStaticResult>;
 //# sourceMappingURL=hq-static-serve.d.ts.map

package/dist/hq-static-serve.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"hq-static-serve.d.ts","sourceRoot":"","sources":["../src/hq-static-serve.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,KAAK,KAAK,IAAI,MAAM,WAAW,CAAC;AAsBvC;;;;GAIG;AACH,wBAAgB,gBAAgB,IAAI,MAAM,GAAG,IAAI,CAyChD;AAQD,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,OAAO,CAAC;CAClB;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAC3B,IAAI,EAAE,IAAI,CAAC,eAAe,EAC1B,GAAG,EAAE,IAAI,CAAC,cAAc,EACxB,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,GACd,iBAAiB,CA2BnB"}
+{"version":3,"file":"hq-static-serve.d.ts","sourceRoot":"","sources":["../src/hq-static-serve.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,KAAK,KAAK,IAAI,MAAM,WAAW,CAAC;AAsBvC;;;;GAIG;AACH,wBAAgB,gBAAgB,IAAI,MAAM,GAAG,IAAI,CAyChD;AAQD,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,OAAO,CAAC;CAClB;AAkBD;;;;;GAKG;AACH,wBAAsB,aAAa,CACjC,IAAI,EAAE,IAAI,CAAC,eAAe,EAC1B,GAAG,EAAE,IAAI,CAAC,cAAc,EACxB,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,iBAAiB,CAAC,CA8C5B"}