@wrongstack/cli 0.295.1 → 0.296.3

package/dist/hq-JUYKUNJX.js

@@ -0,0 +1,547 @@
+import {
+  parseTokenTtlValue
+} from "./chunk-BGFM3PD7.js";
+import {
+  resolveAuditActor
+} from "./chunk-Q5GTM25S.js";
+import "./chunk-7OCVIDC7.js";
+
+// src/subcommands/handlers/hq.ts
+import { HQ_AUTH_FILE_VERSION, HQ_CLI_DEFAULT_HOST, mutateHqAuthFile, mintHqToken, readHqAuthFile, resolveHqDataDir, logHqAuthAudit, hqAuthContentHash, hqAuthAuditPath, hqAuthFilePath } from "@wrongstack/core/hq";
+import { HqInsecureExposureError } from "@wrongstack/core/hq";
+import { expectDefined } from "@wrongstack/core/utils";
+import * as fs from "node:fs/promises";
+function resolveDataDir(deps) {
+  const override = typeof deps.flags?.["data-dir"] === "string" ? deps.flags["data-dir"] : void 0;
+  return resolveHqDataDir(override);
+}
+var hqCmd = async (args, deps) => {
+  const sub = args[0];
+  if (!sub || sub === "serve") {
+    return startServer(deps);
+  }
+  if (sub === "token") {
+    return hqTokenCmd(args.slice(1), deps);
+  }
+  if (sub === "audit") {
+    return hqAuditCmd(args.slice(1), deps);
+  }
+  if (sub === "help" || sub === "--help") {
+    printHelp(deps);
+    return 0;
+  }
+  deps.renderer.writeError(`Unknown hq subcommand: ${sub}
+`);
+  printHelp(deps);
+  return 1;
+};
+async function startServer(deps) {
+  const { startHqServer } = await import("./hq-server-6AQ3BXZA.js");
+  const dataDir = resolveDataDir(deps);
+  const flags = deps.flags ?? {};
+  const host = typeof flags["host"] === "string" ? flags["host"] : HQ_CLI_DEFAULT_HOST;
+  const port = typeof flags["port"] === "string" ? Number.parseInt(flags["port"], 10) : 3499;
+  const strictPort = flags["strict-port"] === true;
+  const open = flags["open"] === true;
+  const password = typeof flags["password"] === "string" ? flags["password"] : process.env.WRONGSTACK_HQ_PASSWORD;
+  const allowInsecureOpen = flags["insecure-open"] === true;
+  const rawTtl = typeof flags["hq-token-ttl"] === "string" ? flags["hq-token-ttl"] : void 0;
+  let tokenTtlMs;
+  if (rawTtl !== void 0 && rawTtl.length > 0) {
+    const parsed = parseTokenTtlValue(rawTtl);
+    if (parsed.error) {
+      deps.renderer.writeError(`Invalid --hq-token-ttl: ${parsed.error}
+`);
+      return 1;
+    }
+    tokenTtlMs = parsed.value;
+  }
+  if (password !== void 0 && password.length < 8) {
+    deps.renderer.writeError("HQ password must be at least 8 characters.\n");
+    return 1;
+  }
+  let handle;
+  try {
+    handle = await startHqServer({
+      host,
+      port,
+      strictPort,
+      dataDir,
+      allowInsecureOpen,
+      ...password !== void 0 ? { password } : {},
+      ...tokenTtlMs !== void 0 ? { tokenTtlMs } : {}
+    });
+  } catch (err) {
+    if (err instanceof HqInsecureExposureError) {
+      deps.renderer.writeError(`${err.message}
+`);
+      return 1;
+    }
+    throw err;
+  }
+  if (open) {
+    try {
+      const { openBrowser } = await import("@wrongstack/webui-server");
+      openBrowser(handle.firstRunSetup?.browserUrl ?? `http://${handle.host}:${handle.port}`);
+    } catch {
+    }
+  }
+  writeStartupInfo(deps, handle);
+  await new Promise((resolve) => {
+    const shutdown = async () => {
+      try {
+        await handle.close();
+      } catch (err) {
+        deps.renderer.write(`HQ server close error: ${String(err)}
+`);
+      }
+      resolve();
+    };
+    process.on("SIGINT", shutdown);
+    process.on("SIGTERM", shutdown);
+  });
+  return 0;
+}
+function writeStartupInfo(deps, handle) {
+  deps.renderer.write(`WrongStack HQ listening on http://${handle.host}:${handle.port}
+`);
+  if (!handle.firstRunSetup) {
+    deps.renderer.write(`Client endpoint:  ws://${handle.host}:${handle.port}/ws/client
+`);
+    deps.renderer.write(`Browser endpoint: http://${handle.host}:${handle.port}
+`);
+    return;
+  }
+  deps.renderer.write(`Browser endpoint: ${handle.firstRunSetup.browserUrl}
+`);
+  deps.renderer.write(`Client endpoint:  ${handle.firstRunSetup.clientUrl}
+`);
+  deps.renderer.write(
+    handle.firstRunSetup.createdAuth ? `
+First-run HQ auth created in ${handle.firstRunSetup.dataDir}
+` : `
+HQ auth loaded from ${handle.firstRunSetup.dataDir}
+`
+  );
+  deps.renderer.write(`Start clients with:
+`);
+  deps.renderer.write(`  WRONGSTACK_HQ_URL=${handle.firstRunSetup.clientEnv.WRONGSTACK_HQ_URL}
+`);
+  if (handle.firstRunSetup.clientEnv.WRONGSTACK_HQ_TOKEN) {
+    deps.renderer.write(
+      `  WRONGSTACK_HQ_TOKEN=${handle.firstRunSetup.clientEnv.WRONGSTACK_HQ_TOKEN}
+`
+    );
+  }
+}
+async function hqTokenCmd(args, deps) {
+  const action = args[0];
+  if (action === "create") {
+    return tokenCreate(args.slice(1), deps);
+  }
+  if (action === "list" || action === "ls" || !action) {
+    return tokenList(args.slice(1), deps);
+  }
+  if (action === "revoke" || action === "rm" || action === "remove") {
+    return tokenRevoke(args.slice(1), deps);
+  }
+  deps.renderer.writeError(`Unknown hq token subcommand: ${action ?? "(none)"}
+`);
+  deps.renderer.write("Usage: wstack hq token <create|list|revoke>\n");
+  return 1;
+}
+async function hqAuditCmd(args, deps) {
+  const action = args[0];
+  if (action === "verify" || action === void 0) {
+    return hqAuditVerify(deps);
+  }
+  deps.renderer.writeError(`Unknown hq audit subcommand: ${action ?? "(none)"}
+`);
+  deps.renderer.write("Usage: wstack hq audit <verify>\n");
+  return 1;
+}
+async function hqAuditVerify(deps) {
+  const dataDir = resolveDataDir(deps);
+  const authPath = hqAuthFilePath(dataDir);
+  const auditPath = hqAuthAuditPath(dataDir);
+  deps.renderer.write(`auth file:   ${authPath}
+`);
+  deps.renderer.write(`audit log:   ${auditPath}
+`);
+  const fileExists = await fileExistsQuiet(authPath);
+  if (!fileExists) {
+    deps.renderer.write(
+      `contentHash: (unavailable \u2014 auth.json does not exist)
+`
+    );
+    deps.renderer.write(
+      `Compare historical entries in the audit log above against a known-good hash.
+`
+    );
+    return 1;
+  }
+  const authFile = await readHqAuthFile(dataDir, {
+    warn: (msg) => deps.renderer.writeWarning(`${msg}
+`)
+  });
+  const hash = hqAuthContentHash(authFile);
+  if (hash === void 0) {
+    deps.renderer.write(
+      `contentHash: (unavailable \u2014 auth.json is unreadable or malformed)
+`
+    );
+    deps.renderer.write(
+      `Compare historical entries in the audit log above against a known-good hash.
+`
+    );
+    return 1;
+  }
+  deps.renderer.write(`contentHash: ${hash}
+`);
+  deps.renderer.write("\n");
+  deps.renderer.write(
+    `Compare this value against the 'contentHash' field of entries in the audit log.
+`
+  );
+  deps.renderer.write(
+    `A match means the redacted projection of auth.json is identical to when that
+`
+  );
+  deps.renderer.write(
+    `entry was emitted (secrets may differ \u2014 only the non-secret shape is hashed).
+`
+  );
+  return 0;
+}
+async function fileExistsQuiet(filePath) {
+  try {
+    await fs.access(filePath);
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function computeAuditHashField(dataDir, warn) {
+  const persisted = await readHqAuthFile(dataDir, { warn });
+  const hash = hqAuthContentHash(persisted);
+  return hash !== void 0 ? { contentHash: hash } : {};
+}
+var TOKEN_CAPABILITIES = {
+  browser: ["control.enqueue"],
+  client: ["telemetry.publish", "control.execute"]
+};
+var DEFAULT_TOKEN_CAPABILITIES = {
+  browser: ["control.enqueue"],
+  client: ["telemetry.publish"]
+};
+function resolveTokenScope(args, deps) {
+  return deps.flags?.["client"] === true || deps.flags?.["c"] === true || args.some((a) => a === "--client" || a === "-c") ? "client" : "browser";
+}
+function tokenPositionals(args) {
+  const result = [];
+  for (let i = 0; i < args.length; i++) {
+    const arg = args[i];
+    if (!arg) continue;
+    if (arg === "--client" || arg === "-c" || arg.startsWith("--capabilities=")) continue;
+    if (arg === "--capabilities") {
+      i += 1;
+      continue;
+    }
+    if (arg === "--ttl") {
+      i += 1;
+      continue;
+    }
+    if (arg.startsWith("--ttl=")) continue;
+    if (!arg.startsWith("-")) result.push(arg);
+  }
+  return result;
+}
+function readCapabilitiesFlag(args, deps) {
+  const parsed = deps.flags?.["capabilities"];
+  if (parsed !== void 0) return parsed;
+  const inline = args.find((arg) => arg.startsWith("--capabilities="));
+  if (inline) return inline.slice("--capabilities=".length);
+  const index = args.indexOf("--capabilities");
+  return index >= 0 ? args[index + 1] ?? true : void 0;
+}
+function resolveTokenCapabilities(scope, args, deps) {
+  const raw = readCapabilitiesFlag(args, deps);
+  if (raw === void 0) return { capabilities: [...DEFAULT_TOKEN_CAPABILITIES[scope]] };
+  if (typeof raw !== "string") {
+    return { error: "--capabilities requires a comma-separated value." };
+  }
+  const capabilities = [...new Set(raw.split(",").map((item) => item.trim()).filter(Boolean))];
+  const allowed = new Set(TOKEN_CAPABILITIES[scope]);
+  const invalid = capabilities.filter((capability) => !allowed.has(capability));
+  if (invalid.length > 0) {
+    return {
+      error: `Invalid ${scope} token capabilities: ${invalid.join(", ")}. Allowed: ${[...allowed].join(", ")}.`
+    };
+  }
+  return { capabilities };
+}
+async function tokenCreate(args, deps) {
+  const scope = resolveTokenScope(args, deps);
+  const resolvedCapabilities = resolveTokenCapabilities(scope, args, deps);
+  if (resolvedCapabilities.error) {
+    deps.renderer.writeError(`${resolvedCapabilities.error}
+`);
+    return 1;
+  }
+  const ttlMs = resolveTokenTtl(args, deps);
+  if (ttlMs?.error) {
+    deps.renderer.writeError(`${ttlMs.error}
+`);
+    return 1;
+  }
+  const pos = tokenPositionals(args);
+  const label = pos[0];
+  const dataDir = resolveDataDir(deps);
+  const tokenField = scope === "client" ? "clientTokens" : "browserTokens";
+  try {
+    const next = await mutateHqAuthFile(
+      dataDir,
+      (current) => {
+        const tokens = current[tokenField] ?? [];
+        const newToken = {
+          ...mintHqToken({ label, ttlMs: ttlMs?.value }),
+          capabilities: resolvedCapabilities.capabilities
+        };
+        return {
+          ...current,
+          [tokenField]: [...tokens, newToken]
+        };
+      },
+      { warn: (msg) => deps.renderer.writeWarning(`${msg}
+`) }
+    );
+    const list = next[tokenField] ?? [];
+    const token = expectDefined(list[list.length - 1]);
+    const hashField = await computeAuditHashField(
+      dataDir,
+      (msg) => deps.renderer.writeWarning(`${msg}
+`)
+    );
+    logHqAuthAudit(
+      dataDir,
+      {
+        kind: "create",
+        scope,
+        tokenId: token.id,
+        ...token.label ? { label: token.label } : {},
+        ...token.capabilities ? { capabilities: token.capabilities } : {},
+        ...token.expiresAt ? { expiresAt: token.expiresAt } : {},
+        actor: resolveAuditActor(),
+        ...hashField
+      },
+      {
+        onError: (err) => deps.renderer.writeWarning(`(audit write failed: ${err.message})
+`)
+      }
+    );
+    const endpoint = scope === "client" ? "/ws/client" : "/ws/browser";
+    deps.renderer.write(`Created ${scope} token.
+`);
+    deps.renderer.write(`  id:         ${token.id}
+`);
+    if (token.label) deps.renderer.write(`  label:      ${token.label}
+`);
+    deps.renderer.write(`  capabilities: ${(token.capabilities ?? []).join(", ") || "(none)"}
+`);
+    deps.renderer.write(`  token:      ${token.token}
+`);
+    deps.renderer.write(`  createdAt:  ${token.createdAt}
+`);
+    if (token.expiresAt) deps.renderer.write(`  expiresAt:  ${token.expiresAt}
+`);
+    deps.renderer.write(`
+`);
+    deps.renderer.write(`Connect with: ws://localhost:3499${endpoint}?token=${token.token}
+`);
+    deps.renderer.write(`(Copy the token now \u2014 it will not be shown again in full.)
+`);
+    return 0;
+  } catch (err) {
+    deps.renderer.writeError(`Failed to write auth.json: ${err.message}
+`);
+    return 1;
+  }
+}
+function resolveTokenTtl(args, deps) {
+  const flagValue = deps.flags?.["ttl"];
+  if (typeof flagValue === "string" && flagValue.length > 0) {
+    return parseTokenTtlValue(flagValue);
+  }
+  const inline = args.find((a) => a?.startsWith("--ttl="));
+  if (inline) {
+    return parseTokenTtlValue(inline.slice("--ttl=".length));
+  }
+  const idx = args.indexOf("--ttl");
+  if (idx >= 0) {
+    const raw = args[idx + 1];
+    if (raw === void 0 || raw.startsWith("-")) {
+      return { error: "--ttl requires a value (e.g. --ttl 1h, --ttl 7d, --ttl 3600s)" };
+    }
+    return parseTokenTtlValue(raw);
+  }
+  return {};
+}
+async function tokenList(args, deps) {
+  const scope = resolveTokenScope(args, deps);
+  const dataDir = resolveDataDir(deps);
+  const tokenField = scope === "client" ? "clientTokens" : "browserTokens";
+  const authFile = await readHqAuthFile(dataDir, {
+    warn: (msg) => deps.renderer.writeWarning(`${msg}
+`)
+  });
+  const tokens = authFile[tokenField] ?? [];
+  if (tokens.length === 0) {
+    deps.renderer.write(`No ${scope} tokens issued. ${scope === "browser" ? "Browsers" : "Clients"} are in OPEN MODE.
+`);
+    deps.renderer.write(`Run \`wstack hq token create ${scope === "client" ? "--client " : ""}[label]\` to enter TOKEN MODE.
+`);
+    return 0;
+  }
+  deps.renderer.write(`${scope === "client" ? "Client" : "Browser"} tokens (${tokens.length}) \u2014 TOKEN MODE:
+`);
+  deps.renderer.write("\n");
+  for (const t of tokens) {
+    const masked = `${t.token.slice(0, 6)}\u2026${t.token.slice(-4)} (${t.token.length} chars)`;
+    const capabilities = t.capabilities === void 0 ? "legacy-unscoped" : t.capabilities.join(",") || "none";
+    const expires = t.expiresAt ?? "(never)";
+    deps.renderer.write(`  ${t.id}  ${masked}  ${t.createdAt}  expires ${expires}${t.label ? `  "${t.label}"` : ""}  [${capabilities}]${t.lastUsedAt ? `  lastUsed ${t.lastUsedAt}` : ""}
+`);
+  }
+  deps.renderer.write("\n");
+  deps.renderer.write(`${scope === "client" ? "Clients" : "Browsers"} must append ?token=<full-token> to /ws/${scope}.
+`);
+  return 0;
+}
+async function tokenRevoke(args, deps) {
+  const scope = resolveTokenScope(args, deps);
+  const pos = tokenPositionals(args);
+  const idPrefix = pos[0];
+  if (!idPrefix) {
+    deps.renderer.writeError(`Usage: wstack hq token revoke ${scope === "client" ? "--client " : ""}<id-prefix>
+`);
+    return 1;
+  }
+  const dataDir = resolveDataDir(deps);
+  const tokenField = scope === "client" ? "clientTokens" : "browserTokens";
+  let revoked;
+  try {
+    await mutateHqAuthFile(
+      dataDir,
+      (current) => {
+        const tokens = current[tokenField] ?? [];
+        const matches = tokens.filter((t) => t.id.startsWith(idPrefix));
+        if (matches.length === 0) {
+          revoked = void 0;
+          return current;
+        }
+        if (matches.length > 1) {
+          revoked = matches[0];
+          return current;
+        }
+        revoked = matches[0];
+        return {
+          ...current,
+          [tokenField]: tokens.filter((t) => t.id !== revoked.id)
+        };
+      },
+      { warn: (msg) => deps.renderer.writeWarning(`${msg}
+`) }
+    );
+  } catch (err) {
+    deps.renderer.writeError(`Failed to write auth.json: ${err.message}
+`);
+    return 1;
+  }
+  if (!revoked) {
+    deps.renderer.writeError(`No ${scope} token found matching id-prefix "${idPrefix}".
+`);
+    return 1;
+  }
+  deps.renderer.write(`Revoked ${scope} token ${revoked.id}${revoked.label ? ` ("${revoked.label}")` : ""}.
+`);
+  const hashField = await computeAuditHashField(
+    dataDir,
+    (msg) => deps.renderer.writeWarning(`${msg}
+`)
+  );
+  logHqAuthAudit(
+    dataDir,
+    {
+      kind: "revoke",
+      scope,
+      tokenId: revoked.id,
+      ...revoked.label ? { label: revoked.label } : {},
+      ...revoked.capabilities ? { capabilities: revoked.capabilities } : {},
+      actor: resolveAuditActor(),
+      ...hashField
+    },
+    {
+      onError: (err) => deps.renderer.writeWarning(`(audit write failed: ${err.message})
+`)
+    }
+  );
+  return 0;
+}
+function printHelp(deps) {
+  deps.renderer.write(`Usage: wstack hq <serve | token | audit>
+`);
+  deps.renderer.write("\n");
+  deps.renderer.write(`  wstack hq                      Start the HQ command center server.
+`);
+  deps.renderer.write(`  wstack hq serve                Same as above (explicit form).
+`);
+  deps.renderer.write(`  wstack hq token create [label] [--ttl <dur>] Mint a browser token, enter token mode.
+`);
+  deps.renderer.write(`  wstack hq token create --client [label] [--ttl <dur>]  Mint a client token (/ws/client).
+`);
+  deps.renderer.write(`  wstack hq token list           List issued browser tokens.
+`);
+  deps.renderer.write(`  wstack hq token list --client   List issued client tokens.
+`);
+  deps.renderer.write(`  wstack hq token revoke <id>    Revoke a browser token (id prefix match).
+`);
+  deps.renderer.write(`  wstack hq token revoke --client <id>  Revoke a client token.
+`);
+  deps.renderer.write(`  wstack hq audit verify         Re-derive auth.json contentHash for forensic comparison.
+`);
+  deps.renderer.write("\n");
+  deps.renderer.write(`Flags (apply to all subcommands):
+`);
+  deps.renderer.write(`  --data-dir <path>   Override HQ data directory (default ~/.wrongstack/hq).
+`);
+  deps.renderer.write(`  --host <ip>         Bind host (default 0.0.0.0; use 127.0.0.1 for local-only).
+`);
+  deps.renderer.write(`  --tunnel            Publish a temporary *.trycloudflare.com URL (requires cloudflared).
+`);
+  deps.renderer.write(`  --password <value>  Set or rotate the browser login password.
+`);
+  deps.renderer.write(`  --insecure-open     Allow a non-loopback bind with no token/password set.
+`);
+  deps.renderer.write(`  --port <n>          Bind port (default 3499).
+`);
+  deps.renderer.write(`  --strict-port       Fail if port is in use.
+`);
+  deps.renderer.write(`  --hq-token-ttl <dur>  Stamp an expiresAt on first-run tokens (e.g. 1h, 7d, 3600s).
+`);
+  deps.renderer.write(`  --open              Open the dashboard in the default browser.
+`);
+  deps.renderer.write(`  --client, -c        Operate on client tokens instead of browser tokens.
+`);
+  deps.renderer.write(`  --capabilities <csv>  Token grants (browser: control.enqueue; client: telemetry.publish,control.execute).
+`);
+  deps.renderer.write(`  --ttl <duration>    Stamp an expiresAt on the token (e.g. --ttl 1h, --ttl 7d, --ttl 3600s).
+`);
+  deps.renderer.write("\n");
+  deps.renderer.write(`auth.json schema version: ${HQ_AUTH_FILE_VERSION}.
+`);
+}
+export {
+  hqCmd,
+  resolveAuditActor
+};
+//# sourceMappingURL=hq-JUYKUNJX.js.map

package/dist/hq-JUYKUNJX.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../src/subcommands/handlers/hq.ts"],
+  "sourcesContent": ["/**\n * `wstack hq` subcommand group \u2014 HQ command center lifecycle + browser\n * token management.\n *\n * Subcommand tree:\n *   wstack hq                      \u2192 start HQ server (alias for `wstack --hq`)\n *   wstack hq serve                \u2192 start HQ server (explicit form)\n *   wstack hq token create [label] [--ttl <duration>] \u2192 mint a browser token, write auth.json\n *   wstack hq token create --client [label] [--ttl <duration>] \u2192 mint a client token (/ws/client)\n *   wstack hq token list           \u2192 list issued browser tokens\n *   wstack hq token list --client   \u2192 list issued client tokens\n *   wstack hq token revoke <id>    \u2192 revoke a browser token (prefix match)\n *   wstack hq token revoke --client <id> \u2192 revoke a client token\n *\n * All subcommands accept `--data-dir <path>` to override the HQ data\n * directory (default `~/.wrongstack/hq`, honors `WRONGSTACK_HOME` /\n * `WRONGSTACK_HQ_DATA_DIR`).\n *\n * @module subcommands/handlers/hq\n */\nimport { HQ_AUTH_FILE_VERSION, HQ_CLI_DEFAULT_HOST, mutateHqAuthFile, mintHqToken, readHqAuthFile, resolveHqDataDir, logHqAuthAudit, hqAuthContentHash, hqAuthAuditPath, hqAuthFilePath } from '@wrongstack/core/hq';\nimport { HqInsecureExposureError, type HqToken } from '@wrongstack/core/hq';\nimport { expectDefined } from '@wrongstack/core/utils';\nimport type { HqServerHandle } from '../../hq-server.js';\nimport { resolveAuditActor } from '../../hq-server/audit-actor.js';\nimport type { SubcommandDeps, SubcommandHandler } from '../index.js';\nimport * as fs from 'node:fs/promises';\n\nexport { resolveAuditActor } from '../../hq-server/audit-actor.js';\n\n/**\n * Build a free-form actor string for the auth audit log. Combines the OS\n * username (best-effort) with the hostname so an operator reviewing the\n * log can see \"who minted this token\" without parsing environment\n * variables. Never includes the token string.\n *\n * Shared by the `wstack hq token` create/revoke handlers and by\n * `startHqServer`'s first-run bootstrap so every audit entry point\n * produces the same actor shape.\n */\nfunction resolveDataDir(deps: SubcommandDeps): string {\n  const override = typeof deps.flags?.['data-dir'] === 'string' ? deps.flags['data-dir'] : undefined;\n  return resolveHqDataDir(override);\n}\n\nexport const hqCmd: SubcommandHandler = async (args, deps) => {\n  const sub = args[0];\n\n  // `wstack hq` and `wstack hq serve` start the server.\n  if (!sub || sub === 'serve') {\n    return startServer(deps);\n  }\n\n  if (sub === 'token') {\n    return hqTokenCmd(args.slice(1), deps);\n  }\n\n  if (sub === 'audit') {\n    return hqAuditCmd(args.slice(1), deps);\n  }\n\n  if (sub === 'help' || sub === '--help') {\n    printHelp(deps);\n    return 0;\n  }\n\n  deps.renderer.writeError(`Unknown hq subcommand: ${sub}\\n`);\n  printHelp(deps);\n  return 1;\n};\n\nasync function startServer(deps: SubcommandDeps): Promise<number> {\n  const { startHqServer } = await import('../../hq-server.js');\n  const dataDir = resolveDataDir(deps);\n  const flags = deps.flags ?? {};\n  const host = typeof flags['host'] === 'string' ? flags['host'] : HQ_CLI_DEFAULT_HOST;\n  const port = typeof flags['port'] === 'string' ? Number.parseInt(flags['port'], 10) : 3499;\n  const strictPort = flags['strict-port'] === true;\n  const open = flags['open'] === true;\n  const password =\n    typeof flags['password'] === 'string' ? flags['password'] : process.env.WRONGSTACK_HQ_PASSWORD;\n  const allowInsecureOpen = flags['insecure-open'] === true;\n  const rawTtl = typeof flags['hq-token-ttl'] === 'string' ? flags['hq-token-ttl'] : undefined;\n  let tokenTtlMs: number | undefined;\n  if (rawTtl !== undefined && rawTtl.length > 0) {\n    const parsed = parseTtlValue(rawTtl);\n    if (parsed.error) {\n      deps.renderer.writeError(`Invalid --hq-token-ttl: ${parsed.error}\\n`);\n      return 1;\n    }\n    tokenTtlMs = parsed.value;\n  }\n\n  if (password !== undefined && password.length < 8) {\n    deps.renderer.writeError('HQ password must be at least 8 characters.\\n');\n    return 1;\n  }\n\n  let handle: HqServerHandle;\n  try {\n    handle = await startHqServer({\n      host,\n      port,\n      strictPort,\n      dataDir,\n      allowInsecureOpen,\n      ...(password !== undefined ? { password } : {}),\n      ...(tokenTtlMs !== undefined ? { tokenTtlMs } : {}),\n    });\n  } catch (err) {\n    // A refusal is operator-actionable guidance, not a crash \u2014 print the\n    // remedies rather than a stack trace.\n    if (err instanceof HqInsecureExposureError) {\n      deps.renderer.writeError(`${err.message}\\n`);\n      return 1;\n    }\n    throw err;\n  }\n\n  if (open) {\n    try {\n      const { openBrowser } = await import('@wrongstack/webui-server');\n      openBrowser(handle.firstRunSetup?.browserUrl ?? `http://${handle.host}:${handle.port}`);\n    } catch {\n      // best-effort\n    }\n  }\n\n  writeStartupInfo(deps, handle);\n\n  // Keep the process alive until SIGINT/SIGTERM\n  await new Promise<void>((resolve) => {\n    const shutdown = async () => {\n      try {\n        await handle.close();\n      } catch (err) {\n        deps.renderer.write(`HQ server close error: ${String(err)}\\n`);\n      }\n      resolve();\n    };\n    process.on('SIGINT', shutdown);\n    process.on('SIGTERM', shutdown);\n  });\n  return 0;\n}\n\nfunction writeStartupInfo(deps: SubcommandDeps, handle: HqServerHandle): void {\n  deps.renderer.write(`WrongStack HQ listening on http://${handle.host}:${handle.port}\\n`);\n  if (!handle.firstRunSetup) {\n    deps.renderer.write(`Client endpoint:  ws://${handle.host}:${handle.port}/ws/client\\n`);\n    deps.renderer.write(`Browser endpoint: http://${handle.host}:${handle.port}\\n`);\n    return;\n  }\n\n  deps.renderer.write(`Browser endpoint: ${handle.firstRunSetup.browserUrl}\\n`);\n  deps.renderer.write(`Client endpoint:  ${handle.firstRunSetup.clientUrl}\\n`);\n  deps.renderer.write(\n    handle.firstRunSetup.createdAuth\n      ? `\\nFirst-run HQ auth created in ${handle.firstRunSetup.dataDir}\\n`\n      : `\\nHQ auth loaded from ${handle.firstRunSetup.dataDir}\\n`,\n  );\n  deps.renderer.write(`Start clients with:\\n`);\n  deps.renderer.write(`  WRONGSTACK_HQ_URL=${handle.firstRunSetup.clientEnv.WRONGSTACK_HQ_URL}\\n`);\n  if (handle.firstRunSetup.clientEnv.WRONGSTACK_HQ_TOKEN) {\n    deps.renderer.write(\n      `  WRONGSTACK_HQ_TOKEN=${handle.firstRunSetup.clientEnv.WRONGSTACK_HQ_TOKEN}\\n`,\n    );\n  }\n}\n\nasync function hqTokenCmd(args: string[], deps: SubcommandDeps): Promise<number> {\n  const action = args[0];\n\n  if (action === 'create') {\n    return tokenCreate(args.slice(1), deps);\n  }\n  if (action === 'list' || action === 'ls' || !action) {\n    return tokenList(args.slice(1), deps);\n  }\n  if (action === 'revoke' || action === 'rm' || action === 'remove') {\n    return tokenRevoke(args.slice(1), deps);\n  }\n\n  deps.renderer.writeError(`Unknown hq token subcommand: ${action ?? '(none)'}\\n`);\n  deps.renderer.write('Usage: wstack hq token <create|list|revoke>\\n');\n  return 1;\n}\n\n/**\n * `wstack hq audit verify` \u2014 re-derive the contentHash from the current\n * on-disk `auth.json` and print it so an operator can compare against a\n * `contentHash` field in an audit entry. This closes the forensic\n * tie-back loop without requiring the operator to write a script: copy\n * the hash from the audit log, run this command, eyeball (or `diff`)\n * the two values.\n *\n * Prints:\n *   - the resolved `auth.json` path (so the operator knows which file\n *     was hashed)\n *   - the SHA-256 contentHash, or `(unavailable)` if the file is\n *     missing/unreadable\n *   - the `auth-audit.jsonl` path (so the operator knows where to look\n *     for entries to compare against)\n *\n * Exit codes:\n *   0 \u2014 hash computed and printed\n *   1 \u2014 `auth.json` missing or unreadable (hash unavailable); the\n *       audit-log path is still printed so the operator can inspect\n *       historical entries\n */\nasync function hqAuditCmd(args: string[], deps: SubcommandDeps): Promise<number> {\n  const action = args[0];\n\n  if (action === 'verify' || action === undefined) {\n    return hqAuditVerify(deps);\n  }\n\n  deps.renderer.writeError(`Unknown hq audit subcommand: ${action ?? '(none)'}\\n`);\n  deps.renderer.write('Usage: wstack hq audit <verify>\\n');\n  return 1;\n}\n\nasync function hqAuditVerify(deps: SubcommandDeps): Promise<number> {\n  const dataDir = resolveDataDir(deps);\n  const authPath = hqAuthFilePath(dataDir);\n  const auditPath = hqAuthAuditPath(dataDir);\n\n  deps.renderer.write(`auth file:   ${authPath}\\n`);\n  deps.renderer.write(`audit log:   ${auditPath}\\n`);\n\n  // readHqAuthFile returns a synthetic default when auth.json is missing\n  // (it doesn't throw), so hqAuthContentHash would still produce a hash\n  // over that default \u2014 which is misleading: no audit entry corresponds\n  // to a file that isn't on disk. Check existence directly so the\n  // operator gets an honest \"unavailable\" when there's nothing to hash.\n  const fileExists = await fileExistsQuiet(authPath);\n  if (!fileExists) {\n    deps.renderer.write(\n      `contentHash: (unavailable \u2014 auth.json does not exist)\\n`,\n    );\n    deps.renderer.write(\n      `Compare historical entries in the audit log above against a known-good hash.\\n`,\n    );\n    return 1;\n  }\n\n  const authFile = await readHqAuthFile(dataDir, {\n    warn: (msg) => deps.renderer.writeWarning(`${msg}\\n`),\n  });\n\n  const hash = hqAuthContentHash(authFile);\n  if (hash === undefined) {\n    deps.renderer.write(\n      `contentHash: (unavailable \u2014 auth.json is unreadable or malformed)\\n`,\n    );\n    deps.renderer.write(\n      `Compare historical entries in the audit log above against a known-good hash.\\n`,\n    );\n    return 1;\n  }\n\n  deps.renderer.write(`contentHash: ${hash}\\n`);\n  deps.renderer.write('\\n');\n  deps.renderer.write(\n    `Compare this value against the 'contentHash' field of entries in the audit log.\\n`,\n  );\n  deps.renderer.write(\n    `A match means the redacted projection of auth.json is identical to when that\\n`,\n  );\n  deps.renderer.write(\n    `entry was emitted (secrets may differ \u2014 only the non-secret shape is hashed).\\n`,\n  );\n  return 0;\n}\n\nasync function fileExistsQuiet(filePath: string): Promise<boolean> {\n  try {\n    await fs.access(filePath);\n    return true;\n  } catch {\n    return false;\n  }\n}\n\n/**\n * Re-read the persisted `auth.json` and return a conditional\n * `contentHash` field for embedding in an audit entry. This closes the\n * forensic tie-back loop: an operator reviewing `auth-audit.jsonl` can\n * compare the `contentHash` against the current on-disk file via\n * `wstack hq audit verify`.\n *\n * Re-reads rather than hashing the in-memory post-mutation snapshot\n * because `writeHqAuthFile` re-stamps `updatedAt` on the persisted\n * payload \u2014 hashing the in-memory `next` would diverge from what\n * `verify` computes. Matches the pattern established by the `first-run`\n * and `expired-prune` emitters in `auth-store.ts` / `hq-server.ts`.\n *\n * Returns `{}` (no `contentHash` key) when the file is unreadable, so\n * the audit entry still records the event without a tie-back \u2014 the\n * absence itself is meaningful. Conditional spread preserves\n * `exactOptionalPropertyTypes`.\n */\nasync function computeAuditHashField(\n  dataDir: string,\n  warn: (msg: string) => void,\n): Promise<{ contentHash?: string }> {\n  const persisted = await readHqAuthFile(dataDir, { warn });\n  const hash = hqAuthContentHash(persisted);\n  return hash !== undefined ? { contentHash: hash } : {};\n}\n\n/**\n * Token scope: `browser` (validated on `/ws/browser`) or `client`\n * (validated on `/ws/client`). Defaults to `browser` for backward\n * compatibility with Phase 3.\n */\ntype TokenScope = 'browser' | 'client';\n\nconst TOKEN_CAPABILITIES: Record<TokenScope, readonly string[]> = {\n  browser: ['control.enqueue'],\n  client: ['telemetry.publish', 'control.execute'],\n};\n\nconst DEFAULT_TOKEN_CAPABILITIES: Record<TokenScope, readonly string[]> = {\n  browser: ['control.enqueue'],\n  client: ['telemetry.publish'],\n};\n\n/** Detect `--client` / `-c`, including flags already consumed by parseArgs(). */\nfunction resolveTokenScope(args: string[], deps: SubcommandDeps): TokenScope {\n  return deps.flags?.['client'] === true ||\n    deps.flags?.['c'] === true ||\n    args.some((a) => a === '--client' || a === '-c')\n    ? 'client'\n    : 'browser';\n}\n\n/** Strip token flags and their values from direct-handler args. */\nfunction tokenPositionals(args: string[]): string[] {\n  const result: string[] = [];\n  for (let i = 0; i < args.length; i++) {\n    const arg = args[i];\n    if (!arg) continue;\n    if (arg === '--client' || arg === '-c' || arg.startsWith('--capabilities=')) continue;\n    if (arg === '--capabilities') {\n      i += 1;\n      continue;\n    }\n    // Skip --ttl and its value (both bare `--ttl 1h` and inline `--ttl=1h`).\n    if (arg === '--ttl') {\n      i += 1;\n      continue;\n    }\n    if (arg.startsWith('--ttl=')) continue;\n    if (!arg.startsWith('-')) result.push(arg);\n  }\n  return result;\n}\n\nfunction readCapabilitiesFlag(args: string[], deps: SubcommandDeps): string | boolean | undefined {\n  const parsed = deps.flags?.['capabilities'];\n  if (parsed !== undefined) return parsed;\n  const inline = args.find((arg) => arg.startsWith('--capabilities='));\n  if (inline) return inline.slice('--capabilities='.length);\n  const index = args.indexOf('--capabilities');\n  return index >= 0 ? args[index + 1] ?? true : undefined;\n}\n\nfunction resolveTokenCapabilities(\n  scope: TokenScope,\n  args: string[],\n  deps: SubcommandDeps,\n): { capabilities?: string[]; error?: string } {\n  const raw = readCapabilitiesFlag(args, deps);\n  if (raw === undefined) return { capabilities: [...DEFAULT_TOKEN_CAPABILITIES[scope]] };\n  if (typeof raw !== 'string') {\n    return { error: '--capabilities requires a comma-separated value.' };\n  }\n\n  const capabilities = [...new Set(raw.split(',').map((item) => item.trim()).filter(Boolean))];\n  const allowed = new Set(TOKEN_CAPABILITIES[scope]);\n  const invalid = capabilities.filter((capability) => !allowed.has(capability));\n  if (invalid.length > 0) {\n    return {\n      error: `Invalid ${scope} token capabilities: ${invalid.join(', ')}. Allowed: ${[...allowed].join(', ')}.`,\n    };\n  }\n  return { capabilities };\n}\n\nasync function tokenCreate(args: string[], deps: SubcommandDeps): Promise<number> {\n  const scope = resolveTokenScope(args, deps);\n  const resolvedCapabilities = resolveTokenCapabilities(scope, args, deps);\n  if (resolvedCapabilities.error) {\n    deps.renderer.writeError(`${resolvedCapabilities.error}\\n`);\n    return 1;\n  }\n  const ttlMs = resolveTokenTtl(args, deps);\n  if (ttlMs?.error) {\n    deps.renderer.writeError(`${ttlMs.error}\\n`);\n    return 1;\n  }\n  const pos = tokenPositionals(args);\n  const label = pos[0]; // first positional is the label\n  const dataDir = resolveDataDir(deps);\n  const tokenField = scope === 'client' ? 'clientTokens' : 'browserTokens';\n\n  try {\n    const next = await mutateHqAuthFile(\n      dataDir,\n      (current) => {\n        const tokens = current[tokenField] ?? [];\n        const newToken = {\n          ...mintHqToken({ label, ttlMs: ttlMs?.value }),\n          capabilities: resolvedCapabilities.capabilities,\n        };\n        return {\n          ...current,\n          [tokenField]: [...tokens, newToken],\n        };\n      },\n      { warn: (msg) => deps.renderer.writeWarning(`${msg}\\n`) },\n    );\n    const list = next[tokenField] ?? [];\n    const token = expectDefined(list[list.length - 1]);\n    const hashField = await computeAuditHashField(dataDir, (msg) =>\n      deps.renderer.writeWarning(`${msg}\\n`),\n    );\n    logHqAuthAudit(\n      dataDir,\n      {\n        kind: 'create',\n        scope,\n        tokenId: token.id,\n        ...(token.label ? { label: token.label } : {}),\n        ...(token.capabilities ? { capabilities: token.capabilities } : {}),\n        ...(token.expiresAt ? { expiresAt: token.expiresAt } : {}),\n        actor: resolveAuditActor(),\n        ...hashField,\n      },\n      {\n        onError: (err) =>\n          deps.renderer.writeWarning(`(audit write failed: ${err.message})\\n`),\n      },\n    );\n    const endpoint = scope === 'client' ? '/ws/client' : '/ws/browser';\n    deps.renderer.write(`Created ${scope} token.\\n`);\n    deps.renderer.write(`  id:         ${token.id}\\n`);\n    if (token.label) deps.renderer.write(`  label:      ${token.label}\\n`);\n    deps.renderer.write(`  capabilities: ${(token.capabilities ?? []).join(', ') || '(none)'}\\n`);\n    deps.renderer.write(`  token:      ${token.token}\\n`);\n    deps.renderer.write(`  createdAt:  ${token.createdAt}\\n`);\n    if (token.expiresAt) deps.renderer.write(`  expiresAt:  ${token.expiresAt}\\n`);\n    deps.renderer.write(`\\n`);\n    deps.renderer.write(`Connect with: ws://localhost:3499${endpoint}?token=${token.token}\\n`);\n    deps.renderer.write(`(Copy the token now \u2014 it will not be shown again in full.)\\n`);\n    return 0;\n  } catch (err) {\n    deps.renderer.writeError(`Failed to write auth.json: ${(err as Error).message}\\n`);\n    return 1;\n  }\n}\n\n// \u2500\u2500 --ttl parsing \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n//\n// Delegates to the shared `parseTokenTtlValue` from utils/hq-ttl.ts so the\n// same syntax (1h, 7d, 3600s, bare ms) is accepted here and in the\n// server-startup `--hq-token-ttl` flag.\n\nimport { parseTokenTtlValue as parseTtlValue } from '../../utils/hq-ttl.js';\n\ninterface ResolvedTtl {\n  value?: number | undefined;\n  error?: string | undefined;\n}\n\nfunction resolveTokenTtl(args: string[], deps: SubcommandDeps): ResolvedTtl {\n  // parseArgs may have already lifted `--ttl <value>` into deps.flags.\n  const flagValue = deps.flags?.['ttl'];\n  if (typeof flagValue === 'string' && flagValue.length > 0) {\n    return parseTtlValue(flagValue);\n  }\n  // Inline `--ttl=1h`.\n  const inline = args.find((a) => a?.startsWith('--ttl='));\n  if (inline) {\n    return parseTtlValue(inline.slice('--ttl='.length));\n  }\n  // Bare `--ttl <value>` \u2014 scan args manually so we don't depend on parseArgs.\n  const idx = args.indexOf('--ttl');\n  if (idx >= 0) {\n    const raw = args[idx + 1];\n    if (raw === undefined || raw.startsWith('-')) {\n      return { error: '--ttl requires a value (e.g. --ttl 1h, --ttl 7d, --ttl 3600s)' };\n    }\n    return parseTtlValue(raw);\n  }\n  return {};\n}\n\nasync function tokenList(args: string[], deps: SubcommandDeps): Promise<number> {\n  const scope = resolveTokenScope(args, deps);\n  const dataDir = resolveDataDir(deps);\n  const tokenField = scope === 'client' ? 'clientTokens' : 'browserTokens';\n  const authFile = await readHqAuthFile(dataDir, {\n    warn: (msg) => deps.renderer.writeWarning(`${msg}\\n`),\n  });\n  const tokens: HqToken[] = authFile[tokenField] ?? [];\n\n  if (tokens.length === 0) {\n    deps.renderer.write(`No ${scope} tokens issued. ${scope === 'browser' ? 'Browsers' : 'Clients'} are in OPEN MODE.\\n`);\n    deps.renderer.write(`Run \\`wstack hq token create ${scope === 'client' ? '--client ' : ''}[label]\\` to enter TOKEN MODE.\\n`);\n    return 0;\n  }\n\n  deps.renderer.write(`${scope === 'client' ? 'Client' : 'Browser'} tokens (${tokens.length}) \u2014 TOKEN MODE:\\n`);\n  deps.renderer.write('\\n');\n  for (const t of tokens) {\n    const masked = `${t.token.slice(0, 6)}\u2026${t.token.slice(-4)} (${t.token.length} chars)`;\n    const capabilities = t.capabilities === undefined ? 'legacy-unscoped' : t.capabilities.join(',') || 'none';\n    const expires = t.expiresAt ?? '(never)';\n    deps.renderer.write(`  ${t.id}  ${masked}  ${t.createdAt}  expires ${expires}${t.label ? `  \"${t.label}\"` : ''}  [${capabilities}]${t.lastUsedAt ? `  lastUsed ${t.lastUsedAt}` : ''}\\n`);\n  }\n  deps.renderer.write('\\n');\n  deps.renderer.write(`${scope === 'client' ? 'Clients' : 'Browsers'} must append ?token=<full-token> to /ws/${scope}.\\n`);\n  return 0;\n}\n\nasync function tokenRevoke(args: string[], deps: SubcommandDeps): Promise<number> {\n  const scope = resolveTokenScope(args, deps);\n  const pos = tokenPositionals(args);\n  const idPrefix = pos[0];\n  if (!idPrefix) {\n    deps.renderer.writeError(`Usage: wstack hq token revoke ${scope === 'client' ? '--client ' : ''}<id-prefix>\\n`);\n    return 1;\n  }\n\n  const dataDir = resolveDataDir(deps);\n  const tokenField = scope === 'client' ? 'clientTokens' : 'browserTokens';\n  let revoked: HqToken | undefined;\n  try {\n    await mutateHqAuthFile(\n      dataDir,\n      (current) => {\n        const tokens = current[tokenField] ?? [];\n        // Prefix match: revoke the first token whose id starts with the\n        // supplied prefix. The full id is long; users usually paste the\n        // first 8 chars.\n        const matches = tokens.filter((t) => t.id.startsWith(idPrefix));\n        if (matches.length === 0) {\n          revoked = undefined;\n          return current;\n        }\n        if (matches.length > 1) {\n          revoked = matches[0]; // caller will surface ambiguity below\n          return current;\n        }\n        revoked = matches[0];\n        return {\n          ...current,\n          [tokenField]: tokens.filter((t) => t.id !== (revoked as HqToken).id),\n        };\n      },\n      { warn: (msg) => deps.renderer.writeWarning(`${msg}\\n`) },\n    );\n  } catch (err) {\n    deps.renderer.writeError(`Failed to write auth.json: ${(err as Error).message}\\n`);\n    return 1;\n  }\n\n  if (!revoked) {\n    deps.renderer.writeError(`No ${scope} token found matching id-prefix \"${idPrefix}\".\\n`);\n    return 1;\n  }\n  deps.renderer.write(`Revoked ${scope} token ${revoked.id}${revoked.label ? ` (\"${revoked.label}\")` : ''}.\\n`);\n  const hashField = await computeAuditHashField(dataDir, (msg) =>\n    deps.renderer.writeWarning(`${msg}\\n`),\n  );\n  logHqAuthAudit(\n    dataDir,\n    {\n      kind: 'revoke',\n      scope,\n      tokenId: revoked.id,\n      ...(revoked.label ? { label: revoked.label } : {}),\n      ...(revoked.capabilities ? { capabilities: revoked.capabilities } : {}),\n      actor: resolveAuditActor(),\n      ...hashField,\n    },\n    {\n      onError: (err) =>\n        deps.renderer.writeWarning(`(audit write failed: ${err.message})\\n`),\n    },\n  );\n  return 0;\n}\n\nfunction printHelp(deps: SubcommandDeps): void {\n  deps.renderer.write(`Usage: wstack hq <serve | token | audit>\\n`);\n  deps.renderer.write('\\n');\n  deps.renderer.write(`  wstack hq                      Start the HQ command center server.\\n`);\n  deps.renderer.write(`  wstack hq serve                Same as above (explicit form).\\n`);\n  deps.renderer.write(`  wstack hq token create [label] [--ttl <dur>] Mint a browser token, enter token mode.\\n`);\n  deps.renderer.write(`  wstack hq token create --client [label] [--ttl <dur>]  Mint a client token (/ws/client).\\n`);\n  deps.renderer.write(`  wstack hq token list           List issued browser tokens.\\n`);\n  deps.renderer.write(`  wstack hq token list --client   List issued client tokens.\\n`);\n  deps.renderer.write(`  wstack hq token revoke <id>    Revoke a browser token (id prefix match).\\n`);\n  deps.renderer.write(`  wstack hq token revoke --client <id>  Revoke a client token.\\n`);\n  deps.renderer.write(`  wstack hq audit verify         Re-derive auth.json contentHash for forensic comparison.\\n`);\n  deps.renderer.write('\\n');\n  deps.renderer.write(`Flags (apply to all subcommands):\\n`);\n  deps.renderer.write(`  --data-dir <path>   Override HQ data directory (default ~/.wrongstack/hq).\\n`);\n  deps.renderer.write(`  --host <ip>         Bind host (default 0.0.0.0; use 127.0.0.1 for local-only).\\n`);\n  deps.renderer.write(`  --tunnel            Publish a temporary *.trycloudflare.com URL (requires cloudflared).\\n`);\n  deps.renderer.write(`  --password <value>  Set or rotate the browser login password.\\n`);\n  deps.renderer.write(`  --insecure-open     Allow a non-loopback bind with no token/password set.\\n`);\n  deps.renderer.write(`  --port <n>          Bind port (default 3499).\\n`);\n  deps.renderer.write(`  --strict-port       Fail if port is in use.\\n`);\n  deps.renderer.write(`  --hq-token-ttl <dur>  Stamp an expiresAt on first-run tokens (e.g. 1h, 7d, 3600s).\\n`);\n  deps.renderer.write(`  --open              Open the dashboard in the default browser.\\n`);\n  deps.renderer.write(`  --client, -c        Operate on client tokens instead of browser tokens.\\n`);\n  deps.renderer.write(`  --capabilities <csv>  Token grants (browser: control.enqueue; client: telemetry.publish,control.execute).\\n`);\n  deps.renderer.write(`  --ttl <duration>    Stamp an expiresAt on the token (e.g. --ttl 1h, --ttl 7d, --ttl 3600s).\\n`);\n  deps.renderer.write('\\n');\n  deps.renderer.write(`auth.json schema version: ${HQ_AUTH_FILE_VERSION}.\\n`);\n}\n"],
+  "mappings": ";;;;;;;;;;AAoBA,SAAS,sBAAsB,qBAAqB,kBAAkB,aAAa,gBAAgB,kBAAkB,gBAAgB,mBAAmB,iBAAiB,sBAAsB;AAC/L,SAAS,+BAA6C;AACtD,SAAS,qBAAqB;AAI9B,YAAY,QAAQ;AAcpB,SAAS,eAAe,MAA8B;AACpD,QAAM,WAAW,OAAO,KAAK,QAAQ,UAAU,MAAM,WAAW,KAAK,MAAM,UAAU,IAAI;AACzF,SAAO,iBAAiB,QAAQ;AAClC;AAEO,IAAM,QAA2B,OAAO,MAAM,SAAS;AAC5D,QAAM,MAAM,KAAK,CAAC;AAGlB,MAAI,CAAC,OAAO,QAAQ,SAAS;AAC3B,WAAO,YAAY,IAAI;AAAA,EACzB;AAEA,MAAI,QAAQ,SAAS;AACnB,WAAO,WAAW,KAAK,MAAM,CAAC,GAAG,IAAI;AAAA,EACvC;AAEA,MAAI,QAAQ,SAAS;AACnB,WAAO,WAAW,KAAK,MAAM,CAAC,GAAG,IAAI;AAAA,EACvC;AAEA,MAAI,QAAQ,UAAU,QAAQ,UAAU;AACtC,cAAU,IAAI;AACd,WAAO;AAAA,EACT;AAEA,OAAK,SAAS,WAAW,0BAA0B,GAAG;AAAA,CAAI;AAC1D,YAAU,IAAI;AACd,SAAO;AACT;AAEA,eAAe,YAAY,MAAuC;AAChE,QAAM,EAAE,cAAc,IAAI,MAAM,OAAO,yBAAoB;AAC3D,QAAM,UAAU,eAAe,IAAI;AACnC,QAAM,QAAQ,KAAK,SAAS,CAAC;AAC7B,QAAM,OAAO,OAAO,MAAM,MAAM,MAAM,WAAW,MAAM,MAAM,IAAI;AACjE,QAAM,OAAO,OAAO,MAAM,MAAM,MAAM,WAAW,OAAO,SAAS,MAAM,MAAM,GAAG,EAAE,IAAI;AACtF,QAAM,aAAa,MAAM,aAAa,MAAM;AAC5C,QAAM,OAAO,MAAM,MAAM,MAAM;AAC/B,QAAM,WACJ,OAAO,MAAM,UAAU,MAAM,WAAW,MAAM,UAAU,IAAI,QAAQ,IAAI;AAC1E,QAAM,oBAAoB,MAAM,eAAe,MAAM;AACrD,QAAM,SAAS,OAAO,MAAM,cAAc,MAAM,WAAW,MAAM,cAAc,IAAI;AACnF,MAAI;AACJ,MAAI,WAAW,UAAa,OAAO,SAAS,GAAG;AAC7C,UAAM,SAAS,mBAAc,MAAM;AACnC,QAAI,OAAO,OAAO;AAChB,WAAK,SAAS,WAAW,2BAA2B,OAAO,KAAK;AAAA,CAAI;AACpE,aAAO;AAAA,IACT;AACA,iBAAa,OAAO;AAAA,EACtB;AAEA,MAAI,aAAa,UAAa,SAAS,SAAS,GAAG;AACjD,SAAK,SAAS,WAAW,8CAA8C;AACvE,WAAO;AAAA,EACT;AAEA,MAAI;AACJ,MAAI;AACF,aAAS,MAAM,cAAc;AAAA,MAC3B;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,GAAI,aAAa,SAAY,EAAE,SAAS,IAAI,CAAC;AAAA,MAC7C,GAAI,eAAe,SAAY,EAAE,WAAW,IAAI,CAAC;AAAA,IACnD,CAAC;AAAA,EACH,SAAS,KAAK;AAGZ,QAAI,eAAe,yBAAyB;AAC1C,WAAK,SAAS,WAAW,GAAG,IAAI,OAAO;AAAA,CAAI;AAC3C,aAAO;AAAA,IACT;AACA,UAAM;AAAA,EACR;AAEA,MAAI,MAAM;AACR,QAAI;AACF,YAAM,EAAE,YAAY,IAAI,MAAM,OAAO,0BAA0B;AAC/D,kBAAY,OAAO,eAAe,cAAc,UAAU,OAAO,IAAI,IAAI,OAAO,IAAI,EAAE;AAAA,IACxF,QAAQ;AAAA,IAER;AAAA,EACF;AAEA,mBAAiB,MAAM,MAAM;AAG7B,QAAM,IAAI,QAAc,CAAC,YAAY;AACnC,UAAM,WAAW,YAAY;AAC3B,UAAI;AACF,cAAM,OAAO,MAAM;AAAA,MACrB,SAAS,KAAK;AACZ,aAAK,SAAS,MAAM,0BAA0B,OAAO,GAAG,CAAC;AAAA,CAAI;AAAA,MAC/D;AACA,cAAQ;AAAA,IACV;AACA,YAAQ,GAAG,UAAU,QAAQ;AAC7B,YAAQ,GAAG,WAAW,QAAQ;AAAA,EAChC,CAAC;AACD,SAAO;AACT;AAEA,SAAS,iBAAiB,MAAsB,QAA8B;AAC5E,OAAK,SAAS,MAAM,qCAAqC,OAAO,IAAI,IAAI,OAAO,IAAI;AAAA,CAAI;AACvF,MAAI,CAAC,OAAO,eAAe;AACzB,SAAK,SAAS,MAAM,0BAA0B,OAAO,IAAI,IAAI,OAAO,IAAI;AAAA,CAAc;AACtF,SAAK,SAAS,MAAM,4BAA4B,OAAO,IAAI,IAAI,OAAO,IAAI;AAAA,CAAI;AAC9E;AAAA,EACF;AAEA,OAAK,SAAS,MAAM,qBAAqB,OAAO,cAAc,UAAU;AAAA,CAAI;AAC5E,OAAK,SAAS,MAAM,qBAAqB,OAAO,cAAc,SAAS;AAAA,CAAI;AAC3E,OAAK,SAAS;AAAA,IACZ,OAAO,cAAc,cACjB;AAAA,+BAAkC,OAAO,cAAc,OAAO;AAAA,IAC9D;AAAA,sBAAyB,OAAO,cAAc,OAAO;AAAA;AAAA,EAC3D;AACA,OAAK,SAAS,MAAM;AAAA,CAAuB;AAC3C,OAAK,SAAS,MAAM,uBAAuB,OAAO,cAAc,UAAU,iBAAiB;AAAA,CAAI;AAC/F,MAAI,OAAO,cAAc,UAAU,qBAAqB;AACtD,SAAK,SAAS;AAAA,MACZ,yBAAyB,OAAO,cAAc,UAAU,mBAAmB;AAAA;AAAA,IAC7E;AAAA,EACF;AACF;AAEA,eAAe,WAAW,MAAgB,MAAuC;AAC/E,QAAM,SAAS,KAAK,CAAC;AAErB,MAAI,WAAW,UAAU;AACvB,WAAO,YAAY,KAAK,MAAM,CAAC,GAAG,IAAI;AAAA,EACxC;AACA,MAAI,WAAW,UAAU,WAAW,QAAQ,CAAC,QAAQ;AACnD,WAAO,UAAU,KAAK,MAAM,CAAC,GAAG,IAAI;AAAA,EACtC;AACA,MAAI,WAAW,YAAY,WAAW,QAAQ,WAAW,UAAU;AACjE,WAAO,YAAY,KAAK,MAAM,CAAC,GAAG,IAAI;AAAA,EACxC;AAEA,OAAK,SAAS,WAAW,gCAAgC,UAAU,QAAQ;AAAA,CAAI;AAC/E,OAAK,SAAS,MAAM,+CAA+C;AACnE,SAAO;AACT;AAwBA,eAAe,WAAW,MAAgB,MAAuC;AAC/E,QAAM,SAAS,KAAK,CAAC;AAErB,MAAI,WAAW,YAAY,WAAW,QAAW;AAC/C,WAAO,cAAc,IAAI;AAAA,EAC3B;AAEA,OAAK,SAAS,WAAW,gCAAgC,UAAU,QAAQ;AAAA,CAAI;AAC/E,OAAK,SAAS,MAAM,mCAAmC;AACvD,SAAO;AACT;AAEA,eAAe,cAAc,MAAuC;AAClE,QAAM,UAAU,eAAe,IAAI;AACnC,QAAM,WAAW,eAAe,OAAO;AACvC,QAAM,YAAY,gBAAgB,OAAO;AAEzC,OAAK,SAAS,MAAM,gBAAgB,QAAQ;AAAA,CAAI;AAChD,OAAK,SAAS,MAAM,gBAAgB,SAAS;AAAA,CAAI;AAOjD,QAAM,aAAa,MAAM,gBAAgB,QAAQ;AACjD,MAAI,CAAC,YAAY;AACf,SAAK,SAAS;AAAA,MACZ;AAAA;AAAA,IACF;AACA,SAAK,SAAS;AAAA,MACZ;AAAA;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAEA,QAAM,WAAW,MAAM,eAAe,SAAS;AAAA,IAC7C,MAAM,CAAC,QAAQ,KAAK,SAAS,aAAa,GAAG,GAAG;AAAA,CAAI;AAAA,EACtD,CAAC;AAED,QAAM,OAAO,kBAAkB,QAAQ;AACvC,MAAI,SAAS,QAAW;AACtB,SAAK,SAAS;AAAA,MACZ;AAAA;AAAA,IACF;AACA,SAAK,SAAS;AAAA,MACZ;AAAA;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAEA,OAAK,SAAS,MAAM,gBAAgB,IAAI;AAAA,CAAI;AAC5C,OAAK,SAAS,MAAM,IAAI;AACxB,OAAK,SAAS;AAAA,IACZ;AAAA;AAAA,EACF;AACA,OAAK,SAAS;AAAA,IACZ;AAAA;AAAA,EACF;AACA,OAAK,SAAS;AAAA,IACZ;AAAA;AAAA,EACF;AACA,SAAO;AACT;AAEA,eAAe,gBAAgB,UAAoC;AACjE,MAAI;AACF,UAAS,UAAO,QAAQ;AACxB,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAoBA,eAAe,sBACb,SACA,MACmC;AACnC,QAAM,YAAY,MAAM,eAAe,SAAS,EAAE,KAAK,CAAC;AACxD,QAAM,OAAO,kBAAkB,SAAS;AACxC,SAAO,SAAS,SAAY,EAAE,aAAa,KAAK,IAAI,CAAC;AACvD;AASA,IAAM,qBAA4D;AAAA,EAChE,SAAS,CAAC,iBAAiB;AAAA,EAC3B,QAAQ,CAAC,qBAAqB,iBAAiB;AACjD;AAEA,IAAM,6BAAoE;AAAA,EACxE,SAAS,CAAC,iBAAiB;AAAA,EAC3B,QAAQ,CAAC,mBAAmB;AAC9B;AAGA,SAAS,kBAAkB,MAAgB,MAAkC;AAC3E,SAAO,KAAK,QAAQ,QAAQ,MAAM,QAChC,KAAK,QAAQ,GAAG,MAAM,QACtB,KAAK,KAAK,CAAC,MAAM,MAAM,cAAc,MAAM,IAAI,IAC7C,WACA;AACN;AAGA,SAAS,iBAAiB,MAA0B;AAClD,QAAM,SAAmB,CAAC;AAC1B,WAAS,IAAI,GAAG,IAAI,KAAK,QAAQ,KAAK;AACpC,UAAM,MAAM,KAAK,CAAC;AAClB,QAAI,CAAC,IAAK;AACV,QAAI,QAAQ,cAAc,QAAQ,QAAQ,IAAI,WAAW,iBAAiB,EAAG;AAC7E,QAAI,QAAQ,kBAAkB;AAC5B,WAAK;AACL;AAAA,IACF;AAEA,QAAI,QAAQ,SAAS;AACnB,WAAK;AACL;AAAA,IACF;AACA,QAAI,IAAI,WAAW,QAAQ,EAAG;AAC9B,QAAI,CAAC,IAAI,WAAW,GAAG,EAAG,QAAO,KAAK,GAAG;AAAA,EAC3C;AACA,SAAO;AACT;AAEA,SAAS,qBAAqB,MAAgB,MAAoD;AAChG,QAAM,SAAS,KAAK,QAAQ,cAAc;AAC1C,MAAI,WAAW,OAAW,QAAO;AACjC,QAAM,SAAS,KAAK,KAAK,CAAC,QAAQ,IAAI,WAAW,iBAAiB,CAAC;AACnE,MAAI,OAAQ,QAAO,OAAO,MAAM,kBAAkB,MAAM;AACxD,QAAM,QAAQ,KAAK,QAAQ,gBAAgB;AAC3C,SAAO,SAAS,IAAI,KAAK,QAAQ,CAAC,KAAK,OAAO;AAChD;AAEA,SAAS,yBACP,OACA,MACA,MAC6C;AAC7C,QAAM,MAAM,qBAAqB,MAAM,IAAI;AAC3C,MAAI,QAAQ,OAAW,QAAO,EAAE,cAAc,CAAC,GAAG,2BAA2B,KAAK,CAAC,EAAE;AACrF,MAAI,OAAO,QAAQ,UAAU;AAC3B,WAAO,EAAE,OAAO,mDAAmD;AAAA,EACrE;AAEA,QAAM,eAAe,CAAC,GAAG,IAAI,IAAI,IAAI,MAAM,GAAG,EAAE,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC,EAAE,OAAO,OAAO,CAAC,CAAC;AAC3F,QAAM,UAAU,IAAI,IAAI,mBAAmB,KAAK,CAAC;AACjD,QAAM,UAAU,aAAa,OAAO,CAAC,eAAe,CAAC,QAAQ,IAAI,UAAU,CAAC;AAC5E,MAAI,QAAQ,SAAS,GAAG;AACtB,WAAO;AAAA,MACL,OAAO,WAAW,KAAK,wBAAwB,QAAQ,KAAK,IAAI,CAAC,cAAc,CAAC,GAAG,OAAO,EAAE,KAAK,IAAI,CAAC;AAAA,IACxG;AAAA,EACF;AACA,SAAO,EAAE,aAAa;AACxB;AAEA,eAAe,YAAY,MAAgB,MAAuC;AAChF,QAAM,QAAQ,kBAAkB,MAAM,IAAI;AAC1C,QAAM,uBAAuB,yBAAyB,OAAO,MAAM,IAAI;AACvE,MAAI,qBAAqB,OAAO;AAC9B,SAAK,SAAS,WAAW,GAAG,qBAAqB,KAAK;AAAA,CAAI;AAC1D,WAAO;AAAA,EACT;AACA,QAAM,QAAQ,gBAAgB,MAAM,IAAI;AACxC,MAAI,OAAO,OAAO;AAChB,SAAK,SAAS,WAAW,GAAG,MAAM,KAAK;AAAA,CAAI;AAC3C,WAAO;AAAA,EACT;AACA,QAAM,MAAM,iBAAiB,IAAI;AACjC,QAAM,QAAQ,IAAI,CAAC;AACnB,QAAM,UAAU,eAAe,IAAI;AACnC,QAAM,aAAa,UAAU,WAAW,iBAAiB;AAEzD,MAAI;AACF,UAAM,OAAO,MAAM;AAAA,MACjB;AAAA,MACA,CAAC,YAAY;AACX,cAAM,SAAS,QAAQ,UAAU,KAAK,CAAC;AACvC,cAAM,WAAW;AAAA,UACf,GAAG,YAAY,EAAE,OAAO,OAAO,OAAO,MAAM,CAAC;AAAA,UAC7C,cAAc,qBAAqB;AAAA,QACrC;AACA,eAAO;AAAA,UACL,GAAG;AAAA,UACH,CAAC,UAAU,GAAG,CAAC,GAAG,QAAQ,QAAQ;AAAA,QACpC;AAAA,MACF;AAAA,MACA,EAAE,MAAM,CAAC,QAAQ,KAAK,SAAS,aAAa,GAAG,GAAG;AAAA,CAAI,EAAE;AAAA,IAC1D;AACA,UAAM,OAAO,KAAK,UAAU,KAAK,CAAC;AAClC,UAAM,QAAQ,cAAc,KAAK,KAAK,SAAS,CAAC,CAAC;AACjD,UAAM,YAAY,MAAM;AAAA,MAAsB;AAAA,MAAS,CAAC,QACtD,KAAK,SAAS,aAAa,GAAG,GAAG;AAAA,CAAI;AAAA,IACvC;AACA;AAAA,MACE;AAAA,MACA;AAAA,QACE,MAAM;AAAA,QACN;AAAA,QACA,SAAS,MAAM;AAAA,QACf,GAAI,MAAM,QAAQ,EAAE,OAAO,MAAM,MAAM,IAAI,CAAC;AAAA,QAC5C,GAAI,MAAM,eAAe,EAAE,cAAc,MAAM,aAAa,IAAI,CAAC;AAAA,QACjE,GAAI,MAAM,YAAY,EAAE,WAAW,MAAM,UAAU,IAAI,CAAC;AAAA,QACxD,OAAO,kBAAkB;AAAA,QACzB,GAAG;AAAA,MACL;AAAA,MACA;AAAA,QACE,SAAS,CAAC,QACR,KAAK,SAAS,aAAa,wBAAwB,IAAI,OAAO;AAAA,CAAK;AAAA,MACvE;AAAA,IACF;AACA,UAAM,WAAW,UAAU,WAAW,eAAe;AACrD,SAAK,SAAS,MAAM,WAAW,KAAK;AAAA,CAAW;AAC/C,SAAK,SAAS,MAAM,iBAAiB,MAAM,EAAE;AAAA,CAAI;AACjD,QAAI,MAAM,MAAO,MAAK,SAAS,MAAM,iBAAiB,MAAM,KAAK;AAAA,CAAI;AACrE,SAAK,SAAS,MAAM,oBAAoB,MAAM,gBAAgB,CAAC,GAAG,KAAK,IAAI,KAAK,QAAQ;AAAA,CAAI;AAC5F,SAAK,SAAS,MAAM,iBAAiB,MAAM,KAAK;AAAA,CAAI;AACpD,SAAK,SAAS,MAAM,iBAAiB,MAAM,SAAS;AAAA,CAAI;AACxD,QAAI,MAAM,UAAW,MAAK,SAAS,MAAM,iBAAiB,MAAM,SAAS;AAAA,CAAI;AAC7E,SAAK,SAAS,MAAM;AAAA,CAAI;AACxB,SAAK,SAAS,MAAM,oCAAoC,QAAQ,UAAU,MAAM,KAAK;AAAA,CAAI;AACzF,SAAK,SAAS,MAAM;AAAA,CAA8D;AAClF,WAAO;AAAA,EACT,SAAS,KAAK;AACZ,SAAK,SAAS,WAAW,8BAA+B,IAAc,OAAO;AAAA,CAAI;AACjF,WAAO;AAAA,EACT;AACF;AAeA,SAAS,gBAAgB,MAAgB,MAAmC;AAE1E,QAAM,YAAY,KAAK,QAAQ,KAAK;AACpC,MAAI,OAAO,cAAc,YAAY,UAAU,SAAS,GAAG;AACzD,WAAO,mBAAc,SAAS;AAAA,EAChC;AAEA,QAAM,SAAS,KAAK,KAAK,CAAC,MAAM,GAAG,WAAW,QAAQ,CAAC;AACvD,MAAI,QAAQ;AACV,WAAO,mBAAc,OAAO,MAAM,SAAS,MAAM,CAAC;AAAA,EACpD;AAEA,QAAM,MAAM,KAAK,QAAQ,OAAO;AAChC,MAAI,OAAO,GAAG;AACZ,UAAM,MAAM,KAAK,MAAM,CAAC;AACxB,QAAI,QAAQ,UAAa,IAAI,WAAW,GAAG,GAAG;AAC5C,aAAO,EAAE,OAAO,gEAAgE;AAAA,IAClF;AACA,WAAO,mBAAc,GAAG;AAAA,EAC1B;AACA,SAAO,CAAC;AACV;AAEA,eAAe,UAAU,MAAgB,MAAuC;AAC9E,QAAM,QAAQ,kBAAkB,MAAM,IAAI;AAC1C,QAAM,UAAU,eAAe,IAAI;AACnC,QAAM,aAAa,UAAU,WAAW,iBAAiB;AACzD,QAAM,WAAW,MAAM,eAAe,SAAS;AAAA,IAC7C,MAAM,CAAC,QAAQ,KAAK,SAAS,aAAa,GAAG,GAAG;AAAA,CAAI;AAAA,EACtD,CAAC;AACD,QAAM,SAAoB,SAAS,UAAU,KAAK,CAAC;AAEnD,MAAI,OAAO,WAAW,GAAG;AACvB,SAAK,SAAS,MAAM,MAAM,KAAK,mBAAmB,UAAU,YAAY,aAAa,SAAS;AAAA,CAAsB;AACpH,SAAK,SAAS,MAAM,gCAAgC,UAAU,WAAW,cAAc,EAAE;AAAA,CAAkC;AAC3H,WAAO;AAAA,EACT;AAEA,OAAK,SAAS,MAAM,GAAG,UAAU,WAAW,WAAW,SAAS,YAAY,OAAO,MAAM;AAAA,CAAmB;AAC5G,OAAK,SAAS,MAAM,IAAI;AACxB,aAAW,KAAK,QAAQ;AACtB,UAAM,SAAS,GAAG,EAAE,MAAM,MAAM,GAAG,CAAC,CAAC,SAAI,EAAE,MAAM,MAAM,EAAE,CAAC,KAAK,EAAE,MAAM,MAAM;AAC7E,UAAM,eAAe,EAAE,iBAAiB,SAAY,oBAAoB,EAAE,aAAa,KAAK,GAAG,KAAK;AACpG,UAAM,UAAU,EAAE,aAAa;AAC/B,SAAK,SAAS,MAAM,KAAK,EAAE,EAAE,KAAK,MAAM,KAAK,EAAE,SAAS,aAAa,OAAO,GAAG,EAAE,QAAQ,MAAM,EAAE,KAAK,MAAM,EAAE,MAAM,YAAY,IAAI,EAAE,aAAa,cAAc,EAAE,UAAU,KAAK,EAAE;AAAA,CAAI;AAAA,EAC1L;AACA,OAAK,SAAS,MAAM,IAAI;AACxB,OAAK,SAAS,MAAM,GAAG,UAAU,WAAW,YAAY,UAAU,2CAA2C,KAAK;AAAA,CAAK;AACvH,SAAO;AACT;AAEA,eAAe,YAAY,MAAgB,MAAuC;AAChF,QAAM,QAAQ,kBAAkB,MAAM,IAAI;AAC1C,QAAM,MAAM,iBAAiB,IAAI;AACjC,QAAM,WAAW,IAAI,CAAC;AACtB,MAAI,CAAC,UAAU;AACb,SAAK,SAAS,WAAW,iCAAiC,UAAU,WAAW,cAAc,EAAE;AAAA,CAAe;AAC9G,WAAO;AAAA,EACT;AAEA,QAAM,UAAU,eAAe,IAAI;AACnC,QAAM,aAAa,UAAU,WAAW,iBAAiB;AACzD,MAAI;AACJ,MAAI;AACF,UAAM;AAAA,MACJ;AAAA,MACA,CAAC,YAAY;AACX,cAAM,SAAS,QAAQ,UAAU,KAAK,CAAC;AAIvC,cAAM,UAAU,OAAO,OAAO,CAAC,MAAM,EAAE,GAAG,WAAW,QAAQ,CAAC;AAC9D,YAAI,QAAQ,WAAW,GAAG;AACxB,oBAAU;AACV,iBAAO;AAAA,QACT;AACA,YAAI,QAAQ,SAAS,GAAG;AACtB,oBAAU,QAAQ,CAAC;AACnB,iBAAO;AAAA,QACT;AACA,kBAAU,QAAQ,CAAC;AACnB,eAAO;AAAA,UACL,GAAG;AAAA,UACH,CAAC,UAAU,GAAG,OAAO,OAAO,CAAC,MAAM,EAAE,OAAQ,QAAoB,EAAE;AAAA,QACrE;AAAA,MACF;AAAA,MACA,EAAE,MAAM,CAAC,QAAQ,KAAK,SAAS,aAAa,GAAG,GAAG;AAAA,CAAI,EAAE;AAAA,IAC1D;AAAA,EACF,SAAS,KAAK;AACZ,SAAK,SAAS,WAAW,8BAA+B,IAAc,OAAO;AAAA,CAAI;AACjF,WAAO;AAAA,EACT;AAEA,MAAI,CAAC,SAAS;AACZ,SAAK,SAAS,WAAW,MAAM,KAAK,oCAAoC,QAAQ;AAAA,CAAM;AACtF,WAAO;AAAA,EACT;AACA,OAAK,SAAS,MAAM,WAAW,KAAK,UAAU,QAAQ,EAAE,GAAG,QAAQ,QAAQ,MAAM,QAAQ,KAAK,OAAO,EAAE;AAAA,CAAK;AAC5G,QAAM,YAAY,MAAM;AAAA,IAAsB;AAAA,IAAS,CAAC,QACtD,KAAK,SAAS,aAAa,GAAG,GAAG;AAAA,CAAI;AAAA,EACvC;AACA;AAAA,IACE;AAAA,IACA;AAAA,MACE,MAAM;AAAA,MACN;AAAA,MACA,SAAS,QAAQ;AAAA,MACjB,GAAI,QAAQ,QAAQ,EAAE,OAAO,QAAQ,MAAM,IAAI,CAAC;AAAA,MAChD,GAAI,QAAQ,eAAe,EAAE,cAAc,QAAQ,aAAa,IAAI,CAAC;AAAA,MACrE,OAAO,kBAAkB;AAAA,MACzB,GAAG;AAAA,IACL;AAAA,IACA;AAAA,MACE,SAAS,CAAC,QACR,KAAK,SAAS,aAAa,wBAAwB,IAAI,OAAO;AAAA,CAAK;AAAA,IACvE;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,UAAU,MAA4B;AAC7C,OAAK,SAAS,MAAM;AAAA,CAA4C;AAChE,OAAK,SAAS,MAAM,IAAI;AACxB,OAAK,SAAS,MAAM;AAAA,CAAwE;AAC5F,OAAK,SAAS,MAAM;AAAA,CAAmE;AACvF,OAAK,SAAS,MAAM;AAAA,CAA0F;AAC9G,OAAK,SAAS,MAAM;AAAA,CAA8F;AAClH,OAAK,SAAS,MAAM;AAAA,CAAgE;AACpF,OAAK,SAAS,MAAM;AAAA,CAAgE;AACpF,OAAK,SAAS,MAAM;AAAA,CAA8E;AAClG,OAAK,SAAS,MAAM;AAAA,CAAkE;AACtF,OAAK,SAAS,MAAM;AAAA,CAA6F;AACjH,OAAK,SAAS,MAAM,IAAI;AACxB,OAAK,SAAS,MAAM;AAAA,CAAqC;AACzD,OAAK,SAAS,MAAM;AAAA,CAAgF;AACpG,OAAK,SAAS,MAAM;AAAA,CAAoF;AACxG,OAAK,SAAS,MAAM;AAAA,CAA6F;AACjH,OAAK,SAAS,MAAM;AAAA,CAAmE;AACvF,OAAK,SAAS,MAAM;AAAA,CAA+E;AACnG,OAAK,SAAS,MAAM;AAAA,CAAmD;AACvE,OAAK,SAAS,MAAM;AAAA,CAAiD;AACrE,OAAK,SAAS,MAAM;AAAA,CAAwF;AAC5G,OAAK,SAAS,MAAM;AAAA,CAAoE;AACxF,OAAK,SAAS,MAAM;AAAA,CAA6E;AACjG,OAAK,SAAS,MAAM;AAAA,CAA+G;AACnI,OAAK,SAAS,MAAM;AAAA,CAAiG;AACrH,OAAK,SAAS,MAAM,IAAI;AACxB,OAAK,SAAS,MAAM,6BAA6B,oBAAoB;AAAA,CAAK;AAC5E;",
+  "names": []
+}

package/dist/hq-command-controller.d.ts

@@ -15,7 +15,7 @@
  * @module hq-command-controller
  */
 import type { HqPublisherCommandResult } from '@wrongstack/core/hq';
-import type { GlobalMailbox } from '@wrongstack/core/coordination';
+import type { RemoteMailbox } from '@wrongstack/core/coordination';
 /**
  * Mutable holder for the command dispatch targets. Each field is populated
  * lazily as the corresponding subsystem comes online (director on
@@ -24,7 +24,7 @@ import type { GlobalMailbox } from '@wrongstack/core/coordination';
  */
 export interface HqCommandController {
     /** Project mailbox used to deliver steer/broadcast messages. */
-    steerMailbox?: GlobalMailbox;
+    steerMailbox?: RemoteMailbox | undefined;
     /** Abort the session leader's running Agent.run(). Returns true if a run was aborted. */
     interruptLeader: () => boolean;
     /** Terminate a specific subagent by id. Returns true if terminated. */

package/dist/hq-command-controller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"hq-command-controller.d.ts","sourceRoot":"","sources":["../src/hq-command-controller.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAC;AACpE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAC;AAGnE;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB;IAClC,gEAAgE;IAChE,YAAY,CAAC,EAAE,aAAa,CAAC;IAC7B,yFAAyF;IACzF,eAAe,EAAE,MAAM,OAAO,CAAC;IAC/B,uEAAuE;IACvE,cAAc,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACpE,8EAA8E;IAC9E,SAAS,CAAC,EAAE,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC3C,sEAAsE;IACtE,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,EAAE,aAAa,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACtF,kFAAkF;IAClF,UAAU,EAAE,MAAM,MAAM,CAAC;IACzB,0EAA0E;IAC1E,eAAe,EAAE,MAAM,OAAO,CAAC;CAChC;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,CACvC,UAAU,EAAE,mBAAmB,GAC9B,CAAC,OAAO,EAAE;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,KAAK,OAAO,CAAC,wBAAwB,CAAC,CAcvG"}
+{"version":3,"file":"hq-command-controller.d.ts","sourceRoot":"","sources":["../src/hq-command-controller.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAC;AACpE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAC;AAGnE;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB;IAClC,gEAAgE;IAChE,YAAY,CAAC,EAAE,aAAa,GAAG,SAAS,CAAC;IACzC,yFAAyF;IACzF,eAAe,EAAE,MAAM,OAAO,CAAC;IAC/B,uEAAuE;IACvE,cAAc,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACpE,8EAA8E;IAC9E,SAAS,CAAC,EAAE,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC3C,sEAAsE;IACtE,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,EAAE,aAAa,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACtF,kFAAkF;IAClF,UAAU,EAAE,MAAM,MAAM,CAAC;IACzB,0EAA0E;IAC1E,eAAe,EAAE,MAAM,OAAO,CAAC;CAChC;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,CACvC,UAAU,EAAE,mBAAmB,GAC9B,CAAC,OAAO,EAAE;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,KAAK,OAAO,CAAC,wBAAwB,CAAC,CAcvG"}