@wrongstack/cli 0.295.1 → 0.296.3

package/dist/hq-server/auth.d.ts

@@ -4,6 +4,7 @@
  * @module hq-server/auth
  */
 import type * as http from 'node:http';
+import type { HqSessionEntry } from './types.js';
 export declare const HQ_SESSION_COOKIE = "hq.session";
 export declare const HQ_SESSION_MAX_AGE_MS: number;
 export interface HqBrowserAuthContext {
@@ -12,7 +13,18 @@ export interface HqBrowserAuthContext {
     id: string;
     capabilities?: string[];
 }
-export type HqBrowserAuthResult = HqBrowserAuthContext | 'cookie' | undefined;
+/**
+ * Cookie-session auth context — returned when a valid `hq.session` cookie
+ * is presented. Password-origin cookies have `kind: 'cookie'` (full
+ * access). Token-origin cookies carry the source token's capabilities
+ * so capability checks (e.g. `control.enqueue`) still apply.
+ */
+export interface HqCookieAuthContext {
+    kind: 'cookie';
+    tokenId?: string;
+    capabilities?: string[];
+}
+export type HqBrowserAuthResult = HqBrowserAuthContext | HqCookieAuthContext | undefined;
 /**
  * The only featureful frontend is the packaged, same-origin React SPA.
  * The missing-assets recovery document contains inline CSS but no script.
@@ -25,6 +37,7 @@ export declare function parseCookieHeader(cookieHeader: string | undefined): Rec
 export declare function setHqSessionCookie(res: http.ServerResponse, value: string, secure?: boolean): void;
 export declare function clearHqSessionCookie(res: http.ServerResponse, secure?: boolean): void;
 export declare function isTokenAuth(auth: HqBrowserAuthResult): auth is HqBrowserAuthContext;
+export declare function isCookieAuth(auth: HqBrowserAuthResult): auth is HqCookieAuthContext;
 /**
  * Constant-time membership test for a token set. Returns the matching stored
  * token (so callers can look up its metadata) or undefined. Iterates and
@@ -41,7 +54,5 @@ export declare function authenticateBrowserRequest(req: http.IncomingMessage, ur
     }>;
     passwordHash?: string | undefined;
     cookieSecret?: string | undefined;
-}, sessions: Map<string, {
-    createdAt: number;
-}>): HqBrowserAuthResult;
+}, sessions: Map<string, HqSessionEntry>): HqBrowserAuthResult;
 //# sourceMappingURL=auth.d.ts.map

package/dist/hq-server/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/hq-server/auth.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,KAAK,KAAK,IAAI,MAAM,WAAW,CAAC;AAKvC,eAAO,MAAM,iBAAiB,eAAe,CAAC;AAC9C,eAAO,MAAM,qBAAqB,QAA0B,CAAC;AAI7D,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,OAAO,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,EAAE,EAAE,MAAM,CAAC;IACX,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;CACzB;AAED,MAAM,MAAM,mBAAmB,GAAG,oBAAoB,GAAG,QAAQ,GAAG,SAAS,CAAC;AAI9E;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,IAAI,CAAC,cAAc,GAAG,IAAI,CAoBnE;AA+DD,wBAAgB,uBAAuB,CACrC,GAAG,EAAE,IAAI,CAAC,eAAe,EACzB,SAAS,CAAC,EAAE,MAAM,EAClB,SAAS,CAAC,EAAE,MAAM,EAClB,oBAAoB,GAAE,WAAW,CAAC,MAAM,CAAa,GACpD,OAAO,CAgCT;AAQD,wBAAgB,wBAAwB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAElF;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAatF;AAED,wBAAgB,iBAAiB,CAAC,YAAY,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAmB1F;AAED,wBAAgB,kBAAkB,CAChC,GAAG,EAAE,IAAI,CAAC,cAAc,EACxB,KAAK,EAAE,MAAM,EACb,MAAM,CAAC,EAAE,OAAO,GACf,IAAI,CAUN;AAED,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,IAAI,CAAC,cAAc,EAAE,MAAM,CAAC,EAAE,OAAO,GAAG,IAAI,CAIrF;AAID,wBAAgB,WAAW,CAAC,IAAI,EAAE,mBAAmB,GAAG,IAAI,IAAI,oBAAoB,CAEnF;AAgCD;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAQ9F;AAED,wBAAgB,0BAA0B,CACxC,GAAG,EAAE,IAAI,CAAC,eAAe,EACzB,GAAG,EAAE,GAAG,EACR,WAAW,EAAE;IACX,aAAa,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC3B,gBAAgB,EAAE,GAAG,CAAC,MAAM,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAC;IACvE,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACnC,EACD,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE;IAAE,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,GAC3C,mBAAmB,CAiCrB"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/hq-server/auth.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,KAAK,KAAK,IAAI,MAAM,WAAW,CAAC;AAEvC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAIjD,eAAO,MAAM,iBAAiB,eAAe,CAAC;AAC9C,eAAO,MAAM,qBAAqB,QAA0B,CAAC;AAI7D,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,OAAO,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,EAAE,EAAE,MAAM,CAAC;IACX,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;CACzB;AAED;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,QAAQ,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;CACzB;AAED,MAAM,MAAM,mBAAmB,GAAG,oBAAoB,GAAG,mBAAmB,GAAG,SAAS,CAAC;AAIzF;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,IAAI,CAAC,cAAc,GAAG,IAAI,CAoBnE;AA+DD,wBAAgB,uBAAuB,CACrC,GAAG,EAAE,IAAI,CAAC,eAAe,EACzB,SAAS,CAAC,EAAE,MAAM,EAClB,SAAS,CAAC,EAAE,MAAM,EAClB,oBAAoB,GAAE,WAAW,CAAC,MAAM,CAAa,GACpD,OAAO,CAgCT;AAQD,wBAAgB,wBAAwB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAElF;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAatF;AAED,wBAAgB,iBAAiB,CAAC,YAAY,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAmB1F;AAED,wBAAgB,kBAAkB,CAChC,GAAG,EAAE,IAAI,CAAC,cAAc,EACxB,KAAK,EAAE,MAAM,EACb,MAAM,CAAC,EAAE,OAAO,GACf,IAAI,CAUN;AAED,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,IAAI,CAAC,cAAc,EAAE,MAAM,CAAC,EAAE,OAAO,GAAG,IAAI,CAIrF;AAID,wBAAgB,WAAW,CAAC,IAAI,EAAE,mBAAmB,GAAG,IAAI,IAAI,oBAAoB,CAEnF;AAED,wBAAgB,YAAY,CAAC,IAAI,EAAE,mBAAmB,GAAG,IAAI,IAAI,mBAAmB,CAEnF;AAgCD;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAQ9F;AAED,wBAAgB,0BAA0B,CACxC,GAAG,EAAE,IAAI,CAAC,eAAe,EACzB,GAAG,EAAE,GAAG,EACR,WAAW,EAAE;IACX,aAAa,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC3B,gBAAgB,EAAE,GAAG,CAAC,MAAM,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAC;IACvE,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACnC,EACD,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,GACpC,mBAAmB,CAkDrB"}

package/dist/hq-server/project-root.d.ts

@@ -0,0 +1,5 @@
+export declare function resolveHqProjectRoot(globalRoot: string, ids: {
+    sessionId?: string | undefined;
+    projectId?: string | undefined;
+}): Promise<string | undefined>;
+//# sourceMappingURL=project-root.d.ts.map

package/dist/hq-server/project-root.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"project-root.d.ts","sourceRoot":"","sources":["../../src/hq-server/project-root.ts"],"names":[],"mappings":"AAEA,wBAAgB,oBAAoB,CAClC,UAAU,EAAE,MAAM,EAClB,GAAG,EAAE;IAAE,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,GACtE,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAmC7B"}

package/dist/hq-server/routes/auth-handlers.d.ts

@@ -0,0 +1,25 @@
+import type * as http from 'node:http';
+import { type HqAlertRuleConfig, type HqRedactionPolicy, type HqToken } from '@wrongstack/core/hq';
+import type { HqRouterMutableAuth, HqSessionEntry } from '../types.js';
+export declare function handleApiAuthStatus(req: http.IncomingMessage, res: http.ServerResponse, url: URL, mutableAuth: HqRouterMutableAuth, sessions: Map<string, HqSessionEntry>, requireBrowserAuth: boolean | undefined, trustedPublicOrigins: Set<string>, secureCookies: boolean | undefined): Promise<void>;
+export declare function handleApiLogin(req: http.IncomingMessage, res: http.ServerResponse, mutableAuth: HqRouterMutableAuth, sessions: Map<string, HqSessionEntry>, loginAttempts: Map<string, {
+    count: number;
+    blockedUntil: number;
+    lastAttempt: number;
+}>, secureCookies: boolean | undefined): Promise<void>;
+export declare function handleApiLogout(req: http.IncomingMessage, res: http.ServerResponse, mutableAuth: HqRouterMutableAuth, sessions: Map<string, HqSessionEntry>, secureCookies: boolean | undefined): Promise<void>;
+export declare function handleApiPassword(req: http.IncomingMessage, res: http.ServerResponse, mutableAuth: HqRouterMutableAuth, sessions: Map<string, HqSessionEntry>, dataDir: string, secureCookies: boolean | undefined, requireBrowserAuth: boolean | undefined): Promise<void>;
+export declare function applyAuthFile(mutableAuth: HqRouterMutableAuth, next: {
+    browserTokens?: Array<{
+        token: string;
+        id: string;
+        capabilities?: string[];
+    }>;
+    clientTokens?: Array<HqToken>;
+    redactionPolicy?: Partial<HqRedactionPolicy>;
+    passwordHash?: string;
+    cookieSecret?: string;
+    alertRules?: HqAlertRuleConfig;
+}): void;
+export declare function handleApiBootstrap(req: http.IncomingMessage, res: http.ServerResponse, mutableAuth: HqRouterMutableAuth, sessions: Map<string, HqSessionEntry>, secureCookies: boolean | undefined, bootstrapStore: import('@wrongstack/core/hq').HqBootstrapCodeStore): Promise<void>;
+//# sourceMappingURL=auth-handlers.d.ts.map

package/dist/hq-server/routes/auth-handlers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-handlers.d.ts","sourceRoot":"","sources":["../../../src/hq-server/routes/auth-handlers.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,KAAK,IAAI,MAAM,WAAW,CAAC;AACvC,OAAO,EAOL,KAAK,iBAAiB,EACtB,KAAK,iBAAiB,EACtB,KAAK,OAAO,EACb,MAAM,qBAAqB,CAAC;AAY7B,OAAO,KAAK,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAQvE,wBAAsB,mBAAmB,CACvC,GAAG,EAAE,IAAI,CAAC,eAAe,EACzB,GAAG,EAAE,IAAI,CAAC,cAAc,EACxB,GAAG,EAAE,GAAG,EACR,WAAW,EAAE,mBAAmB,EAChC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,EACrC,kBAAkB,EAAE,OAAO,GAAG,SAAS,EACvC,oBAAoB,EAAE,GAAG,CAAC,MAAM,CAAC,EACjC,aAAa,EAAE,OAAO,GAAG,SAAS,GACjC,OAAO,CAAC,IAAI,CAAC,CAyBf;AAED,wBAAsB,cAAc,CAClC,GAAG,EAAE,IAAI,CAAC,eAAe,EACzB,GAAG,EAAE,IAAI,CAAC,cAAc,EACxB,WAAW,EAAE,mBAAmB,EAChC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,EACrC,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,CAAC,EACxF,aAAa,EAAE,OAAO,GAAG,SAAS,GACjC,OAAO,CAAC,IAAI,CAAC,CA4Ef;AAED,wBAAsB,eAAe,CACnC,GAAG,EAAE,IAAI,CAAC,eAAe,EACzB,GAAG,EAAE,IAAI,CAAC,cAAc,EACxB,WAAW,EAAE,mBAAmB,EAChC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,EACrC,aAAa,EAAE,OAAO,GAAG,SAAS,GACjC,OAAO,CAAC,IAAI,CAAC,CAkBf;AAED,wBAAsB,iBAAiB,CACrC,GAAG,EAAE,IAAI,CAAC,eAAe,EACzB,GAAG,EAAE,IAAI,CAAC,cAAc,EACxB,WAAW,EAAE,mBAAmB,EAChC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,EACrC,OAAO,EAAE,MAAM,EACf,aAAa,EAAE,OAAO,GAAG,SAAS,EAClC,kBAAkB,EAAE,OAAO,GAAG,SAAS,GACtC,OAAO,CAAC,IAAI,CAAC,CA6Hf;AAED,wBAAgB,aAAa,CAC3B,WAAW,EAAE,mBAAmB,EAChC,IAAI,EAAE;IACJ,aAAa,CAAC,EAAE,KAAK,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAC;IAC9E,YAAY,CAAC,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IAC9B,eAAe,CAAC,EAAE,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAC7C,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,iBAAiB,CAAC;CAChC,GACA,IAAI,CAoBN;AAID,wBAAsB,kBAAkB,CACtC,GAAG,EAAE,IAAI,CAAC,eAAe,EACzB,GAAG,EAAE,IAAI,CAAC,cAAc,EACxB,WAAW,EAAE,mBAAmB,EAChC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,EACrC,aAAa,EAAE,OAAO,GAAG,SAAS,EAClC,cAAc,EAAE,OAAO,qBAAqB,EAAE,oBAAoB,GACjE,OAAO,CAAC,IAAI,CAAC,CA2Ef"}

package/dist/hq-server/routes/session-handlers.d.ts

@@ -0,0 +1,8 @@
+import type * as http from 'node:http';
+import { type HqTranscriptEntry } from '@wrongstack/core/hq';
+import type { TranscriptRing } from '../types.js';
+export declare function handleApiSessions(res: http.ServerResponse): Promise<void>;
+export declare function handleApiSessionEvents(req: http.IncomingMessage, res: http.ServerResponse, match: RegExpMatchArray, transcripts: Map<string, TranscriptRing>): Promise<void>;
+export declare function handleApiSessionAgentMessages(req: http.IncomingMessage, res: http.ServerResponse, match: RegExpMatchArray, agentMessages: Map<string, HqTranscriptEntry[]>): Promise<void>;
+export declare function handleApiAgentMessages(req: http.IncomingMessage, res: http.ServerResponse, match: RegExpMatchArray, agentMessages: Map<string, HqTranscriptEntry[]>): Promise<void>;
+//# sourceMappingURL=session-handlers.d.ts.map

package/dist/hq-server/routes/session-handlers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-handlers.d.ts","sourceRoot":"","sources":["../../../src/hq-server/routes/session-handlers.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,KAAK,IAAI,MAAM,WAAW,CAAC;AACvC,OAAO,EAGL,KAAK,iBAAiB,EACvB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAQlD,wBAAsB,iBAAiB,CAAC,GAAG,EAAE,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAmC/E;AAED,wBAAsB,sBAAsB,CAC1C,GAAG,EAAE,IAAI,CAAC,eAAe,EACzB,GAAG,EAAE,IAAI,CAAC,cAAc,EACxB,KAAK,EAAE,gBAAgB,EACvB,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,GACvC,OAAO,CAAC,IAAI,CAAC,CA8Ef;AAED,wBAAsB,6BAA6B,CACjD,GAAG,EAAE,IAAI,CAAC,eAAe,EACzB,GAAG,EAAE,IAAI,CAAC,cAAc,EACxB,KAAK,EAAE,gBAAgB,EACvB,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE,iBAAiB,EAAE,CAAC,GAC9C,OAAO,CAAC,IAAI,CAAC,CAiBf;AAED,wBAAsB,sBAAsB,CAC1C,GAAG,EAAE,IAAI,CAAC,eAAe,EACzB,GAAG,EAAE,IAAI,CAAC,cAAc,EACxB,KAAK,EAAE,gBAAgB,EACvB,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE,iBAAiB,EAAE,CAAC,GAC9C,OAAO,CAAC,IAAI,CAAC,CAiBf"}

package/dist/hq-server/routes.d.ts

@@ -13,13 +13,14 @@ import type { TrustBoundary } from '@wrongstack/core/security';
 import { type createHqPersistence } from '@wrongstack/core/hq';
 import type { HqSnapshot, HqAlertEngine, HqCommandAuditLog, HqEventEnvelope, HqTranscriptEntry } from '@wrongstack/core/hq';
 import type { createMailboxHttpRouter } from '@wrongstack/core/coordination';
-import { type GlobalMailbox, type MailboxHttpAccessDecision, type MailboxHttpRateLimiter } from '@wrongstack/core/coordination';
+import { type Mailbox, type MailboxHttpAccessDecision, type MailboxHttpRateLimiter } from '@wrongstack/core/coordination';
 import * as HqServerAuth from './auth.js';
 import * as HqServerUtils from './utils.js';
 export declare const setHqSecurityHeaders: typeof HqServerAuth.setHqSecurityHeaders;
 export declare const hasTrustedBrowserOrigin: typeof HqServerAuth.hasTrustedBrowserOrigin;
 export declare const authenticateBrowserRequest: typeof HqServerAuth.authenticateBrowserRequest;
 export declare const isTokenAuth: typeof HqServerAuth.isTokenAuth;
+export declare const isCookieAuth: typeof HqServerAuth.isCookieAuth;
 export declare const setHqSessionCookie: typeof HqServerAuth.setHqSessionCookie;
 export declare const clearHqSessionCookie: typeof HqServerAuth.clearHqSessionCookie;
 export declare const serializeHqSessionCookie: typeof HqServerAuth.serializeHqSessionCookie;
@@ -31,16 +32,17 @@ export declare const readRequestBody: typeof HqServerUtils.readRequestBody;
 export declare const writeInvalidBody: typeof HqServerUtils.writeInvalidBody;
 export declare const sanitizeApiError: typeof HqServerUtils.sanitizeApiError;
 export declare const buildHttpUrl: typeof HqServerUtils.buildHttpUrl;
+export declare const buildBootstrapHttpUrl: typeof HqServerUtils.buildBootstrapHttpUrl;
 export declare const buildClientWsUrl: typeof HqServerUtils.buildClientWsUrl;
 export declare const agentRingKey: typeof HqServerUtils.agentRingKey;
 export declare const agentMessageToEntry: typeof HqServerUtils.agentMessageToEntry;
 export declare const readLocalSubagentTranscript: typeof HqServerUtils.readLocalSubagentTranscript;
 export declare const lanIPv4Addresses: typeof HqServerUtils.lanIPv4Addresses;
 export declare const hqRuntimeMarkerPath: typeof HqServerUtils.hqRuntimeMarkerPath;
-import type { ConnectedClient, HqRouterMutableAuth, HqSnapshotBroadcaster, ProjectDetail, TranscriptRing } from './types.js';
+import type { ConnectedClient, HqRouterMutableAuth, HqSessionEntry, HqSnapshotBroadcaster, ProjectDetail, TranscriptRing } from './types.js';
 export type { ConnectedClient, HqSnapshotBroadcaster, ProjectDetail, TranscriptRing, };
 export interface HqRouterMailboxGateway {
-    mailbox: GlobalMailbox;
+    mailbox: Mailbox;
     router: ReturnType<typeof createMailboxHttpRouter>;
 }
 export interface HqRouterDeps {
@@ -49,9 +51,7 @@ export interface HqRouterDeps {
     listeningPort: number;
     trustedPublicOrigins: Set<string>;
     mutableAuth: HqRouterMutableAuth;
-    sessions: Map<string, {
-        createdAt: number;
-    }>;
+    sessions: Map<string, HqSessionEntry>;
     loginAttempts: Map<string, {
         count: number;
         blockedUntil: number;
@@ -75,6 +75,8 @@ export interface HqRouterDeps {
     getMailboxGateway: (projectDir: string) => HqRouterMailboxGateway;
     /** Aggregate token-expiry stats for snapshot totals + alert engine. */
     getTokenStats?: (() => HqSnapshot['totals']['tokenStats'] | undefined) | undefined;
+    /** One-time bootstrap code store for token-to-cookie exchange. */
+    bootstrapStore?: import('@wrongstack/core/hq').HqBootstrapCodeStore | undefined;
 }
 /**
  * Create the HTTP request listener that handles all `/api/*` routes as well

package/dist/hq-server/routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"routes.d.ts","sourceRoot":"","sources":["../../src/hq-server/routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,OAAO,KAAK,KAAK,IAAI,MAAM,WAAW,CAAC;AACvC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC;AACpC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,EAA6B,KAAK,mBAAmB,EAAmM,MAAM,qBAAqB,CAAC;AAC3R,OAAO,KAAK,EAAE,UAAU,EAAE,aAAa,EAAqD,iBAAiB,EAAE,eAAe,EAAmE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAChP,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,+BAA+B,CAAC;AAC7E,OAAO,EAAE,KAAK,aAAa,EAAE,KAAK,yBAAyB,EAAE,KAAK,sBAAsB,EAAqB,MAAM,+BAA+B,CAAC;AAGnJ,OAAO,KAAK,YAAY,MAAM,WAAW,CAAC;AAE1C,OAAO,KAAK,aAAa,MAAM,YAAY,CAAC;AAW5C,eAAO,MAAM,oBAAoB,0CAAoC,CAAC;AACtE,eAAO,MAAM,uBAAuB,6CAAuC,CAAC;AAC5E,eAAO,MAAM,0BAA0B,gDAA0C,CAAC;AAClF,eAAO,MAAM,WAAW,iCAA2B,CAAC;AACpD,eAAO,MAAM,kBAAkB,wCAAkC,CAAC;AAClE,eAAO,MAAM,oBAAoB,0CAAoC,CAAC;AACtE,eAAO,MAAM,wBAAwB,8CAAwC,CAAC;AAC9E,eAAO,MAAM,oBAAoB,0CAAoC,CAAC;AACtE,eAAO,MAAM,iBAAiB,uCAAiC,CAAC;AAChE,eAAO,MAAM,iBAAiB,eAAiC,CAAC;AAEhE,eAAO,MAAM,iBAAiB,wCAAkC,CAAC;AACjE,eAAO,MAAM,eAAe,sCAAgC,CAAC;AAC7D,eAAO,MAAM,gBAAgB,uCAAiC,CAAC;AAC/D,eAAO,MAAM,gBAAgB,uCAAiC,CAAC;AAC/D,eAAO,MAAM,YAAY,mCAA6B,CAAC;AACvD,eAAO,MAAM,gBAAgB,uCAAiC,CAAC;AAC/D,eAAO,MAAM,YAAY,mCAA6B,CAAC;AACvD,eAAO,MAAM,mBAAmB,0CAAoC,CAAC;AACrE,eAAO,MAAM,2BAA2B,kDAA4C,CAAC;AACrF,eAAO,MAAM,gBAAgB,uCAAiC,CAAC;AAC/D,eAAO,MAAM,mBAAmB,0CAAoC,CAAC;AAIrE,OAAO,KAAK,EACV,eAAe,EACf,mBAAmB,EACnB,qBAAqB,EACrB,aAAa,EACb,cAAc,EACf,MAAM,YAAY,CAAC;AAEpB,YAAY,EACV,eAAe,EACf,qBAAqB,EACrB,aAAa,EACb,cAAc,GACf,CAAC;AASF,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,aAAa,CAAC;IACvB,MAAM,EAAE,UAAU,CAAC,OAAO,uBAAuB,CAAC,CAAC;CACpD;AAED,MAAM,WAAW,YAAY;IAC3B,aAAa,EAAE,aAAa,CAAC;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,EAAE,MAAM,CAAC;IACtB,oBAAoB,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAClC,WAAW,EAAE,mBAAmB,CAAC;IACjC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC7C,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACzF,OAAO,EAAE,GAAG,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC;IACzC,QAAQ,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC;IACzB,QAAQ,EAAE,eAAe,EAAE,CAAC;IAC5B,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IACzC,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE,iBAAiB,EAAE,CAAC,CAAC;IAChD,eAAe,EAAE,GAAG,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAAC;IACrD,yBAAyB,EAAE,sBAAsB,CAAC;IAClD,WAAW,EAAE,aAAa,CAAC;IAC3B,QAAQ,EAAE,iBAAiB,CAAC;IAC5B,WAAW,EAAE,UAAU,CAAC,OAAO,mBAAmB,CAAC,CAAC;IACpD,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,kBAAkB,EAAE,OAAO,GAAG,SAAS,CAAC;IACxC,aAAa,EAAE,OAAO,GAAG,SAAS,CAAC;IACnC,uBAAuB,EAAE,CACvB,GAAG,EAAE,IAAI,CAAC,eAAe,EACzB,UAAU,EAAE,MAAM,KACf,yBAAyB,CAAC;IAC/B,iBAAiB,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,sBAAsB,CAAC;IAClE,uEAAuE;IACvE,aAAa,CAAC,EAAE,CAAC,MAAM,UAAU,CAAC,QAAQ,CAAC,CAAC,YAAY,CAAC,GAAG,SAAS,CAAC,GAAG,SAAS,CAAC;CACpF;AAID;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,YAAY,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,eAAe,EAAE,GAAG,EAAE,IAAI,CAAC,cAAc,KAAK,OAAO,CAAC,IAAI,CAAC,CA6PzH"}
+{"version":3,"file":"routes.d.ts","sourceRoot":"","sources":["../../src/hq-server/routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,OAAO,KAAK,KAAK,IAAI,MAAM,WAAW,CAAC;AACvC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC;AACpC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,EAAE,KAAK,mBAAmB,EAAyC,MAAM,qBAAqB,CAAC;AACtG,OAAO,KAAK,EAAE,UAAU,EAAE,aAAa,EAAkC,iBAAiB,EAAE,eAAe,EAAuC,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACjM,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,+BAA+B,CAAC;AAC7E,OAAO,EACL,KAAK,OAAO,EACZ,KAAK,yBAAyB,EAC9B,KAAK,sBAAsB,EAE5B,MAAM,+BAA+B,CAAC;AAGvC,OAAO,KAAK,YAAY,MAAM,WAAW,CAAC;AAE1C,OAAO,KAAK,aAAa,MAAM,YAAY,CAAC;AAyB5C,eAAO,MAAM,oBAAoB,0CAAoC,CAAC;AACtE,eAAO,MAAM,uBAAuB,6CAAuC,CAAC;AAC5E,eAAO,MAAM,0BAA0B,gDAA0C,CAAC;AAClF,eAAO,MAAM,WAAW,iCAA2B,CAAC;AACpD,eAAO,MAAM,YAAY,kCAA4B,CAAC;AACtD,eAAO,MAAM,kBAAkB,wCAAkC,CAAC;AAClE,eAAO,MAAM,oBAAoB,0CAAoC,CAAC;AACtE,eAAO,MAAM,wBAAwB,8CAAwC,CAAC;AAC9E,eAAO,MAAM,oBAAoB,0CAAoC,CAAC;AACtE,eAAO,MAAM,iBAAiB,uCAAiC,CAAC;AAChE,eAAO,MAAM,iBAAiB,eAAiC,CAAC;AAEhE,eAAO,MAAM,iBAAiB,wCAAkC,CAAC;AACjE,eAAO,MAAM,eAAe,sCAAgC,CAAC;AAC7D,eAAO,MAAM,gBAAgB,uCAAiC,CAAC;AAC/D,eAAO,MAAM,gBAAgB,uCAAiC,CAAC;AAC/D,eAAO,MAAM,YAAY,mCAA6B,CAAC;AACvD,eAAO,MAAM,qBAAqB,4CAAsC,CAAC;AACzE,eAAO,MAAM,gBAAgB,uCAAiC,CAAC;AAC/D,eAAO,MAAM,YAAY,mCAA6B,CAAC;AACvD,eAAO,MAAM,mBAAmB,0CAAoC,CAAC;AACrE,eAAO,MAAM,2BAA2B,kDAA4C,CAAC;AACrF,eAAO,MAAM,gBAAgB,uCAAiC,CAAC;AAC/D,eAAO,MAAM,mBAAmB,0CAAoC,CAAC;AAIrE,OAAO,KAAK,EACV,eAAe,EACf,mBAAmB,EACnB,cAAc,EACd,qBAAqB,EACrB,aAAa,EACb,cAAc,EACf,MAAM,YAAY,CAAC;AAEpB,YAAY,EACV,eAAe,EACf,qBAAqB,EACrB,aAAa,EACb,cAAc,GACf,CAAC;AAIF,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,UAAU,CAAC,OAAO,uBAAuB,CAAC,CAAC;CACpD;AAED,MAAM,WAAW,YAAY;IAC3B,aAAa,EAAE,aAAa,CAAC;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,EAAE,MAAM,CAAC;IACtB,oBAAoB,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAClC,WAAW,EAAE,mBAAmB,CAAC;IACjC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IACtC,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACzF,OAAO,EAAE,GAAG,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC;IACzC,QAAQ,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC;IACzB,QAAQ,EAAE,eAAe,EAAE,CAAC;IAC5B,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IACzC,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE,iBAAiB,EAAE,CAAC,CAAC;IAChD,eAAe,EAAE,GAAG,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAAC;IACrD,yBAAyB,EAAE,sBAAsB,CAAC;IAClD,WAAW,EAAE,aAAa,CAAC;IAC3B,QAAQ,EAAE,iBAAiB,CAAC;IAC5B,WAAW,EAAE,UAAU,CAAC,OAAO,mBAAmB,CAAC,CAAC;IACpD,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,kBAAkB,EAAE,OAAO,GAAG,SAAS,CAAC;IACxC,aAAa,EAAE,OAAO,GAAG,SAAS,CAAC;IACnC,uBAAuB,EAAE,CACvB,GAAG,EAAE,IAAI,CAAC,eAAe,EACzB,UAAU,EAAE,MAAM,KACf,yBAAyB,CAAC;IAC/B,iBAAiB,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,sBAAsB,CAAC;IAClE,uEAAuE;IACvE,aAAa,CAAC,EAAE,CAAC,MAAM,UAAU,CAAC,QAAQ,CAAC,CAAC,YAAY,CAAC,GAAG,SAAS,CAAC,GAAG,SAAS,CAAC;IACnF,kEAAkE;IAClE,cAAc,CAAC,EAAE,OAAO,qBAAqB,EAAE,oBAAoB,GAAG,SAAS,CAAC;CACjF;AAID;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,YAAY,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,eAAe,EAAE,GAAG,EAAE,IAAI,CAAC,cAAc,KAAK,OAAO,CAAC,IAAI,CAAC,CAgRzH"}

package/dist/hq-server/snapshot.d.ts

@@ -15,6 +15,50 @@ export declare const HQ_SNAPSHOT_BROADCAST_DEBOUNCE_MS = 100;
  * the dashboard — from doing a full rebuild + atomic disk write at up to 10 Hz.
  */
 export declare const HQ_SNAPSHOT_PERSIST_MIN_INTERVAL_MS = 3000;
+/** Unsent bytes retained for one dashboard socket before it is disconnected. */
+export declare const HQ_BROWSER_MAX_BUFFERED_BYTES: number;
+/**
+ * Send an already-serialized frame to a WebSocket peer, enforcing
+ * per-client backpressure.
+ *
+ * A `readyState === OPEN` check alone says the socket is connected, not that
+ * anyone is reading it. `ws` buffers whatever it cannot flush, so a tab that
+ * stalled — backgrounded, throttled, paused in devtools — makes this process
+ * retain every subsequent broadcast for it. These are full fleet snapshots,
+ * historically as large as 9 MB each, which is the difference between a
+ * bounded cost and an unbounded one.
+ *
+ * Mirrors `sendSerialized` in `@wrongstack/webui-server`, deliberately
+ * duplicated rather than imported: HQ's snapshot path is in the CLI's
+ * always-loaded graph, and a static import would drag that whole package into
+ * boot, which the CLI keeps behind a lazy import on purpose.
+ */
+export declare function sendGuarded(ws: WebSocket, data: string): boolean;
+/**
+ * How long a session/fleet snapshot may go unrefreshed before it is treated
+ * as gone.
+ *
+ * `session.ended` is the only thing that used to remove these entries, so any
+ * session that died without sending one — crash, SIGKILL, dropped network,
+ * closed laptop — stayed in its client's map for as long as the socket lived.
+ * That is both retained memory and, worse, permanent weight in every
+ * `buildSnapshot()` broadcast to every browser.
+ *
+ * A live session republishes unconditionally every 2.5s (`session-bridge.ts`
+ * forces the snapshot on a timer, bypassing its own dedupe hash), so
+ * `receivedAt` is a true liveness signal rather than a change signal. Five
+ * minutes is 120 consecutive missed publishes — far past any GC pause,
+ * scheduler stall, or transient hiccup, so this never evicts a live session.
+ */
+export declare const HQ_STALE_SNAPSHOT_MS: number;
+/**
+ * Drop session/fleet/MCP entries whose publisher has stopped refreshing them.
+ *
+ * Runs from `buildSnapshot` because that is exactly the moment stale entries
+ * would otherwise be serialized into a broadcast — no separate timer to own,
+ * and no window where a reaped entry is still visible to a reader.
+ */
+export declare function reapStaleClientState(clients: Map<WebSocket, ConnectedClient>, nowMs?: number): void;
 export declare function buildSnapshot(clients: Map<WebSocket, ConnectedClient>, options?: {
     tokenStats?: HqSnapshot['totals']['tokenStats'];
 }): HqSnapshot;

package/dist/hq-server/snapshot.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"snapshot.d.ts","sourceRoot":"","sources":["../../src/hq-server/snapshot.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAwD,mBAAmB,EAAE,eAAe,EAA0H,aAAa,EAA+D,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACtV,OAAO,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC;AAC/B,OAAO,KAAK,EAAE,eAAe,EAAE,qBAAqB,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAKxF,eAAO,MAAM,iCAAiC,MAAM,CAAC;AACrD;;;;;;GAMG;AACH,eAAO,MAAM,mCAAmC,OAAQ,CAAC;AAIzD,wBAAgB,aAAa,CAC3B,OAAO,EAAE,GAAG,CAAC,SAAS,EAAE,eAAe,CAAC,EACxC,OAAO,CAAC,EAAE;IAAE,UAAU,CAAC,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,YAAY,CAAC,CAAA;CAAE,GAC5D,UAAU,CAySZ;AAID,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,GAAG,CAAC,SAAS,EAAE,eAAe,CAAC,EACxC,QAAQ,EAAE,GAAG,CAAC,SAAS,CAAC,EACxB,WAAW,CAAC,EAAE,aAAa,GAC1B,qBAAqB,CA+DvB;AAID,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,GAAG,CAAC,SAAS,EAAE,eAAe,CAAC,EACxC,SAAS,EAAE,MAAM,GAChB,aAAa,GAAG,IAAI,CAqDtB;AAID,wBAAgB,cAAc,CAAC,KAAK,EAAE,eAAe,EAAE,QAAQ,EAAE,GAAG,CAAC,SAAS,CAAC,GAAG,IAAI,CAMrF;AAED,8EAA8E;AAC9E,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,mBAAmB,EAC5B,QAAQ,EAAE,GAAG,CAAC,SAAS,CAAC,GACvB,IAAI,CAKN"}
+{"version":3,"file":"snapshot.d.ts","sourceRoot":"","sources":["../../src/hq-server/snapshot.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAIV,mBAAmB,EACnB,eAAe,EAOf,aAAa,EAIb,UAAU,EACX,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC;AAC/B,OAAO,KAAK,EAAE,eAAe,EAAE,qBAAqB,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAKxF,eAAO,MAAM,iCAAiC,MAAM,CAAC;AACrD;;;;;;GAMG;AACH,eAAO,MAAM,mCAAmC,OAAQ,CAAC;AAEzD,gFAAgF;AAChF,eAAO,MAAM,6BAA6B,QAAmB,CAAC;AAE9D;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,WAAW,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAqBhE;AAED;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,oBAAoB,QAAa,CAAC;AAE/C;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,GAAG,CAAC,SAAS,EAAE,eAAe,CAAC,EACxC,KAAK,GAAE,MAAmB,GACzB,IAAI,CAgBN;AAID,wBAAgB,aAAa,CAC3B,OAAO,EAAE,GAAG,CAAC,SAAS,EAAE,eAAe,CAAC,EACxC,OAAO,CAAC,EAAE;IAAE,UAAU,CAAC,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,YAAY,CAAC,CAAA;CAAE,GAC5D,UAAU,CA0SZ;AAID,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,GAAG,CAAC,SAAS,EAAE,eAAe,CAAC,EACxC,QAAQ,EAAE,GAAG,CAAC,SAAS,CAAC,EACxB,WAAW,CAAC,EAAE,aAAa,GAC1B,qBAAqB,CAgEvB;AAID,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,GAAG,CAAC,SAAS,EAAE,eAAe,CAAC,EACxC,SAAS,EAAE,MAAM,GAChB,aAAa,GAAG,IAAI,CAqDtB;AAID,wBAAgB,cAAc,CAAC,KAAK,EAAE,eAAe,EAAE,QAAQ,EAAE,GAAG,CAAC,SAAS,CAAC,GAAG,IAAI,CAIrF;AAED,8EAA8E;AAC9E,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,mBAAmB,EAC5B,QAAQ,EAAE,GAAG,CAAC,SAAS,CAAC,GACvB,IAAI,CAGN"}

package/dist/hq-server/types.d.ts

@@ -3,10 +3,9 @@
  *
  * @module hq-server/types
  */
+import type { HqAlertRuleConfig, HqBrowserMessage, HqClientCapability, HqClientRecord, HqEventEnvelope, HqFleetSnapshotPayload, HqMailboxSnapshotPayload, HqMcpServerHealth, HqPersistence, HqProjectIdentity, HqProjectRecord, HqQueuedCommand, HqRedactionPolicy, HqSessionSnapshotPayload, HqToken, HqTranscriptEntry } from '@wrongstack/core/hq';
 import type { WebSocket } from 'ws';
-import type { HqClientCapability, HqAlertRuleConfig, HqClientRecord, HqEventEnvelope, HqFleetSnapshotPayload, HqMailboxSnapshotPayload, HqMcpServerHealth, HqPersistence, HqProjectIdentity, HqProjectRecord, HqQueuedCommand, HqRedactionPolicy, HqSessionSnapshotPayload, HqToken, HqTranscriptEntry } from '@wrongstack/core/hq';
-import type { HqBrowserMessage } from '@wrongstack/core/hq';
-export type { HqClientCapability, HqClientRecord, HqEventEnvelope, HqFleetSnapshotPayload, HqMailboxSnapshotPayload, HqMcpServerHealth, HqPersistence, HqProjectIdentity, HqProjectRecord, HqQueuedCommand, HqRedactionPolicy, HqSessionSnapshotPayload, HqToken, HqTranscriptEntry, HqBrowserMessage, };
+export type { HqBrowserMessage, HqClientCapability, HqClientRecord, HqEventEnvelope, HqFleetSnapshotPayload, HqMailboxSnapshotPayload, HqMcpServerHealth, HqPersistence, HqProjectIdentity, HqProjectRecord, HqQueuedCommand, HqRedactionPolicy, HqSessionSnapshotPayload, HqToken, HqTranscriptEntry, };
 export interface TrackedSessionSnapshot {
     payload: HqSessionSnapshotPayload;
     /** Epoch ms of the last `session.snapshot` refresh — freshness authority for the cleanup timer. */
@@ -45,7 +44,10 @@ export interface ConnectedClient {
     /** Per-client coordinator fleet snapshots, keyed by runId and owned by a session when known. */
     fleets: Map<string, TrackedFleetSnapshot>;
     /** Per-session MCP health snapshots, keyed by sessionId. */
-    mcpSnapshots: Map<string, HqMcpServerHealth[]>;
+    mcpSnapshots: Map<string, {
+        servers: HqMcpServerHealth[];
+        receivedAt: number;
+    }>;
     /** Pending outbound commands (Phase 3 — control plane). */
     commandQueue: HqQueuedCommand[];
 }
@@ -63,6 +65,22 @@ export interface HqRouterMutableAuth {
     cookieSecret?: string | undefined;
     alertRules: HqAlertRuleConfig | undefined;
 }
+/**
+ * Session record stored in the server-side `sessions` Map.
+ *
+ * - `kind: 'password'` — created by `/api/login`; full browser access.
+ * - `kind: 'token'` — created by `/api/auth/bootstrap`; scoped to the
+ *   originating browser token's ID and capabilities so revocation/expiry
+ *   of that token invalidates the session too.
+ */
+export interface HqSessionEntry {
+    readonly createdAt: number;
+    readonly kind: 'password' | 'token';
+    /** For token sessions: the browser-token ID this session was minted from. */
+    readonly tokenId?: string | undefined;
+    /** For token sessions: capabilities inherited from the source token. */
+    readonly capabilities?: string[] | undefined;
+}
 export interface TranscriptRing {
     entries: HqTranscriptEntry[];
     machineId?: string;

package/dist/hq-server/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/hq-server/types.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC;AACpC,OAAO,KAAK,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,cAAc,EAAE,eAAe,EAAE,sBAAsB,EAAE,wBAAwB,EAAE,iBAAiB,EAAE,aAAa,EAAE,iBAAiB,EAAE,eAAe,EAAE,eAAe,EAAE,iBAAiB,EAAE,wBAAwB,EAAE,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACpU,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAE5D,YAAY,EACV,kBAAkB,EAClB,cAAc,EACd,eAAe,EACf,sBAAsB,EACtB,wBAAwB,EACxB,iBAAiB,EACjB,aAAa,EACb,iBAAiB,EACjB,eAAe,EACf,eAAe,EACf,iBAAiB,EACjB,wBAAwB,EACxB,OAAO,EACP,iBAAiB,EACjB,gBAAgB,GACjB,CAAC;AAIF,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,wBAAwB,CAAC;IAClC,mGAAmG;IACnG,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,sBAAsB,CAAC;IAChC,uDAAuD;IACvD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,SAAS,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,iBAAiB,CAAC;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IAChC,0EAA0E;IAC1E,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,kFAAkF;IAClF,uBAAuB,EAAE,iBAAiB,CAAC;IAC3C,uEAAuE;IACvE,YAAY,EAAE,MAAM,CAAC;IACrB,kEAAkE;IAClE,SAAS,EAAE,GAAG,CAAC,MAAM,EAAE,wBAAwB,CAAC,CAAC;IACjD,sEAAsE;IACtE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,kEAAkE;IAClE,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAAC;IAC9C,gGAAgG;IAChG,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;IAC1C,4DAA4D;IAC5D,YAAY,EAAE,GAAG,CAAC,MAAM,EAAE,iBAAiB,EAAE,CAAC,CAAC;IAC/C,2DAA2D;IAC3D,YAAY,EAAE,eAAe,EAAE,CAAC;CACjC;AAED,MAAM,WAAW,mBAAmB;IAClC,cAAc,EAAE,iBAAiB,CAAC;IAClC,sBAAsB,EAAE,OAAO,CAAC,iBAAiB,CAAC,GAAG,SAAS,CAAC;IAC/D,aAAa,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC3B,YAAY,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC1B,gBAAgB,EAAE,GAAG,CAAC,MAAM,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAC;IACvE,eAAe,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACtC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,UAAU,EAAE,iBAAiB,GAAG,SAAS,CAAC;CAC3C;AAID,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,iBAAiB,EAAE,CAAC;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAID,MAAM,WAAW,qBAAqB;IACpC,iBAAiB,IAAI,MAAM,CAAC;IAC5B,SAAS,IAAI,IAAI,CAAC;IAClB,KAAK,IAAI,IAAI,CAAC;CACf;AAID,MAAM,WAAW,aAAa;IAC5B,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,eAAe,CAAC;IACzB,OAAO,EAAE,SAAS,cAAc,EAAE,CAAC;IACnC,SAAS,EAAE,SAAS,wBAAwB,EAAE,CAAC;CAChD"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/hq-server/types.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EACV,iBAAiB,EACjB,gBAAgB,EAChB,kBAAkB,EAClB,cAAc,EACd,eAAe,EACf,sBAAsB,EACtB,wBAAwB,EACxB,iBAAiB,EACjB,aAAa,EACb,iBAAiB,EACjB,eAAe,EACf,eAAe,EACf,iBAAiB,EACjB,wBAAwB,EACxB,OAAO,EACP,iBAAiB,EAClB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC;AAEpC,YAAY,EACV,gBAAgB,EAChB,kBAAkB,EAClB,cAAc,EACd,eAAe,EACf,sBAAsB,EACtB,wBAAwB,EACxB,iBAAiB,EACjB,aAAa,EACb,iBAAiB,EACjB,eAAe,EACf,eAAe,EACf,iBAAiB,EACjB,wBAAwB,EACxB,OAAO,EACP,iBAAiB,GAClB,CAAC;AAIF,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,wBAAwB,CAAC;IAClC,mGAAmG;IACnG,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,sBAAsB,CAAC;IAChC,uDAAuD;IACvD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,SAAS,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,iBAAiB,CAAC;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IAChC,0EAA0E;IAC1E,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,kFAAkF;IAClF,uBAAuB,EAAE,iBAAiB,CAAC;IAC3C,uEAAuE;IACvE,YAAY,EAAE,MAAM,CAAC;IACrB,kEAAkE;IAClE,SAAS,EAAE,GAAG,CAAC,MAAM,EAAE,wBAAwB,CAAC,CAAC;IACjD,sEAAsE;IACtE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,kEAAkE;IAClE,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAAC;IAC9C,gGAAgG;IAChG,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;IAC1C,4DAA4D;IAC5D,YAAY,EAAE,GAAG,CAAC,MAAM,EAAE;QAAE,OAAO,EAAE,iBAAiB,EAAE,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAChF,2DAA2D;IAC3D,YAAY,EAAE,eAAe,EAAE,CAAC;CACjC;AAED,MAAM,WAAW,mBAAmB;IAClC,cAAc,EAAE,iBAAiB,CAAC;IAClC,sBAAsB,EAAE,OAAO,CAAC,iBAAiB,CAAC,GAAG,SAAS,CAAC;IAC/D,aAAa,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC3B,YAAY,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC1B,gBAAgB,EAAE,GAAG,CAAC,MAAM,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAC;IACvE,eAAe,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACtC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,UAAU,EAAE,iBAAiB,GAAG,SAAS,CAAC;CAC3C;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC;IACpC,6EAA6E;IAC7E,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC,wEAAwE;IACxE,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;CAC9C;AAID,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,iBAAiB,EAAE,CAAC;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAID,MAAM,WAAW,qBAAqB;IACpC,iBAAiB,IAAI,MAAM,CAAC;IAC5B,SAAS,IAAI,IAAI,CAAC;IAClB,KAAK,IAAI,IAAI,CAAC;CACf;AAID,MAAM,WAAW,aAAa;IAC5B,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,eAAe,CAAC;IACzB,OAAO,EAAE,SAAS,cAAc,EAAE,CAAC;IACnC,SAAS,EAAE,SAAS,wBAAwB,EAAE,CAAC;CAChD"}

package/dist/hq-server/utils.d.ts

@@ -43,6 +43,14 @@ export declare function displayHost(host: string): string;
 export declare function readRequestBody(req: http.IncomingMessage, maxBytes?: number): Promise<string>;
 export declare function writeInvalidBody(res: http.ServerResponse, error: unknown): void;
 export declare function buildHttpUrl(host: string, port: number, token?: string): string;
+/**
+ * Build the browser startup URL with a one-time bootstrap code in the
+ * fragment (`#bootstrap=…`). Fragments never reach HTTP access logs,
+ * Referer headers, or proxy caches — unlike query-string tokens. The
+ * SPA extracts the fragment, POSTs it to `/api/auth/bootstrap`, and
+ * receives only an HttpOnly session cookie.
+ */
+export declare function buildBootstrapHttpUrl(host: string, port: number, bootstrapCode: string): string;
 export declare function buildClientWsUrl(host: string, port: number, token?: string): string;
 export declare function hqRuntimeMarkerPath(dataDir: string): string;
 /** Non-internal IPv4 addresses, so we can print URLs reachable from other machines. */

package/dist/hq-server/utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../../src/hq-server/utils.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,KAAK,KAAK,IAAI,MAAM,WAAW,CAAC;AAGvC,OAAO,KAAK,EAAE,eAAe,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAK7F,eAAO,MAAM,mBAAmB,OAAO,CAAC;AACxC,eAAO,MAAM,uBAAuB,MAAM,CAAC;AAC3C,eAAO,MAAM,eAAe,MAAM,CAAC;AAInC;;;GAGG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI,CAMxE;AAID;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAEjF;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,iBAAiB,CAmBjF;AAED;;;;;;;GAOG;AACH,wBAAsB,2BAA2B,CAC/C,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,iBAAiB,EAAE,GAAG,IAAI,CAAC,CA2BrC;AAID,2DAA2D;AAC3D,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAM9D;AAED,qFAAqF;AACrF,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEhD;AAMD,gFAAgF;AAChF,wBAAgB,eAAe,CAAC,GAAG,EAAE,IAAI,CAAC,eAAe,EAAE,QAAQ,SAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CAuBhG;AAED,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,IAAI,CAAC,cAAc,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI,CAI/E;AAID,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAI/E;AAED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAInF;AAID,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAE3D;AAID,uFAAuF;AACvF,wBAAgB,gBAAgB,IAAI,MAAM,EAAE,CAa3C;AAID,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAIvF;AAID;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,EAAE,SAAS,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAGhG;AAID;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,WAAW,EAAE,aAAa,EAAE,KAAK,EAAE,eAAe,GAAG,IAAI,CA+B/F;AAID;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,CAerD"}
+{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../../src/hq-server/utils.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,KAAK,KAAK,IAAI,MAAM,WAAW,CAAC;AAGvC,OAAO,KAAK,EAAE,eAAe,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAK7F,eAAO,MAAM,mBAAmB,OAAO,CAAC;AACxC,eAAO,MAAM,uBAAuB,MAAM,CAAC;AAC3C,eAAO,MAAM,eAAe,MAAM,CAAC;AAInC;;;GAGG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI,CAMxE;AAID;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAEjF;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,iBAAiB,CAmBjF;AAED;;;;;;;GAOG;AACH,wBAAsB,2BAA2B,CAC/C,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,iBAAiB,EAAE,GAAG,IAAI,CAAC,CA2BrC;AAID,2DAA2D;AAC3D,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAM9D;AAED,qFAAqF;AACrF,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEhD;AAMD,gFAAgF;AAChF,wBAAgB,eAAe,CAAC,GAAG,EAAE,IAAI,CAAC,eAAe,EAAE,QAAQ,SAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CAuBhG;AAED,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,IAAI,CAAC,cAAc,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI,CAI/E;AAID,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAI/E;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,MAAM,CAI/F;AAED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAInF;AAID,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAE3D;AAID,uFAAuF;AACvF,wBAAgB,gBAAgB,IAAI,MAAM,EAAE,CAa3C;AAID,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAIvF;AAID;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,EAAE,SAAS,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAGhG;AAID;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,WAAW,EAAE,aAAa,EAAE,KAAK,EAAE,eAAe,GAAG,IAAI,CA+B/F;AAID;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,CAerD"}

package/dist/hq-server/ws.d.ts

@@ -3,8 +3,8 @@
  *
  * @module hq-server/ws
  */
-import { WebSocket } from 'ws';
 import type { HqCommandAuditLog, HqEventEnvelope, HqPersistence, HqRedactionPolicy, HqToken, HqTranscriptEntry } from '@wrongstack/core/hq';
+import { WebSocket } from 'ws';
 import type { ConnectedClient, HqSnapshotBroadcaster, TranscriptRing } from './types.js';
 export declare function handleBrowser(ws: WebSocket, snapshotBroadcaster: HqSnapshotBroadcaster, browsers: Set<WebSocket>): void;
 export declare function handleClient(ws: WebSocket, clients: Map<WebSocket, ConnectedClient>, browsers: Set<WebSocket>, eventLog: HqEventEnvelope[], auth: {

package/dist/hq-server/ws.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ws.d.ts","sourceRoot":"","sources":["../../src/hq-server/ws.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC;AAE/B,OAAO,KAAK,EAAE,iBAAiB,EAAE,eAAe,EAAgI,aAAa,EAAmB,iBAAiB,EAAmD,OAAO,EAA6B,iBAAiB,EAAoB,MAAM,qBAAqB,CAAC;AACzX,OAAO,KAAK,EAAE,eAAe,EAAE,qBAAqB,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAmBzF,wBAAgB,aAAa,CAC3B,EAAE,EAAE,SAAS,EACb,mBAAmB,EAAE,qBAAqB,EAC1C,QAAQ,EAAE,GAAG,CAAC,SAAS,CAAC,GACvB,IAAI,CAsBN;AAID,wBAAgB,YAAY,CAC1B,EAAE,EAAE,SAAS,EACb,OAAO,EAAE,GAAG,CAAC,SAAS,EAAE,eAAe,CAAC,EACxC,QAAQ,EAAE,GAAG,CAAC,SAAS,CAAC,EACxB,QAAQ,EAAE,eAAe,EAAE,EAC3B,IAAI,EAAE;IACJ,KAAK,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC5B,iBAAiB,EAAE,MAAM,OAAO,CAAC,iBAAiB,CAAC,GAAG,SAAS,CAAC;CACjE,EACD,mBAAmB,EAAE,qBAAqB,EAC1C,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,EACxC,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE,iBAAiB,EAAE,CAAC,EAC/C,WAAW,CAAC,EAAE,aAAa,EAC3B,QAAQ,CAAC,EAAE,iBAAiB,GAC3B,IAAI,CA0dN"}
+{"version":3,"file":"ws.d.ts","sourceRoot":"","sources":["../../src/hq-server/ws.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,KAAK,EACV,iBAAiB,EACjB,eAAe,EAMf,aAAa,EAEb,iBAAiB,EAGjB,OAAO,EAEP,iBAAiB,EAElB,MAAM,qBAAqB,CAAC;AAW7B,OAAO,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC;AAE/B,OAAO,KAAK,EAAE,eAAe,EAAE,qBAAqB,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAkBzF,wBAAgB,aAAa,CAC3B,EAAE,EAAE,SAAS,EACb,mBAAmB,EAAE,qBAAqB,EAC1C,QAAQ,EAAE,GAAG,CAAC,SAAS,CAAC,GACvB,IAAI,CAsBN;AAID,wBAAgB,YAAY,CAC1B,EAAE,EAAE,SAAS,EACb,OAAO,EAAE,GAAG,CAAC,SAAS,EAAE,eAAe,CAAC,EACxC,QAAQ,EAAE,GAAG,CAAC,SAAS,CAAC,EACxB,QAAQ,EAAE,eAAe,EAAE,EAC3B,IAAI,EAAE;IACJ,KAAK,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC5B,iBAAiB,EAAE,MAAM,OAAO,CAAC,iBAAiB,CAAC,GAAG,SAAS,CAAC;CACjE,EACD,mBAAmB,EAAE,qBAAqB,EAC1C,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,EACxC,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE,iBAAiB,EAAE,CAAC,EAC/C,WAAW,CAAC,EAAE,aAAa,EAC3B,QAAQ,CAAC,EAAE,iBAAiB,GAC3B,IAAI,CA0dN"}

package/dist/hq-server-6AQ3BXZA.js

@@ -0,0 +1,39 @@
+import {
+  BROWSER_HEARTBEAT_INTERVAL_MS,
+  CLIENT_CLEANUP_INTERVAL_MS,
+  CLIENT_TTL_MS,
+  DEFAULT_HOST,
+  DEFAULT_PORT,
+  HQ_HTML,
+  HqInsecureExposureError,
+  MAX_EVENT_LOG,
+  MAX_NON_STRICT_PORT_SCAN,
+  SESSION_SNAPSHOT_TTL_MS,
+  agentMessageToEntry,
+  agentRingKey,
+  decodePathSegment,
+  readLocalSubagentTranscript,
+  sanitizeApiError,
+  startHqServer
+} from "./chunk-OI7GWJDS.js";
+import "./chunk-Q5GTM25S.js";
+import "./chunk-7OCVIDC7.js";
+export {
+  BROWSER_HEARTBEAT_INTERVAL_MS,
+  CLIENT_CLEANUP_INTERVAL_MS,
+  CLIENT_TTL_MS,
+  DEFAULT_HOST,
+  DEFAULT_PORT,
+  HQ_HTML,
+  HqInsecureExposureError,
+  MAX_EVENT_LOG,
+  MAX_NON_STRICT_PORT_SCAN,
+  SESSION_SNAPSHOT_TTL_MS,
+  agentMessageToEntry,
+  agentRingKey,
+  decodePathSegment,
+  readLocalSubagentTranscript,
+  sanitizeApiError,
+  startHqServer
+};
+//# sourceMappingURL=hq-server-6AQ3BXZA.js.map

package/dist/hq-server-6AQ3BXZA.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": [],
+  "sourcesContent": [],
+  "mappings": "",
+  "names": []
+}

package/dist/hq-server.d.ts

@@ -9,10 +9,10 @@
  */
 import { type TrustBoundary } from '@wrongstack/core/security';
 import { HQ_HTML } from './hq-recovery-html.js';
-import { readLocalSubagentTranscript, agentRingKey, agentMessageToEntry, decodePathSegment, sanitizeApiError } from './hq-server/routes.js';
+import { agentMessageToEntry, agentRingKey, decodePathSegment, readLocalSubagentTranscript, sanitizeApiError } from './hq-server/routes.js';
 import type { ConnectedClient, TranscriptRing } from './hq-server/types.js';
-export type { ConnectedClient, TranscriptRing };
 export { HqInsecureExposureError } from '@wrongstack/core/hq';
+export type { ConnectedClient, TranscriptRing };
 export { HQ_HTML };
 export declare const DEFAULT_HOST = "127.0.0.1";
 export declare const DEFAULT_PORT = 3499;
@@ -22,7 +22,7 @@ export declare const CLIENT_TTL_MS = 60000;
 export declare const CLIENT_CLEANUP_INTERVAL_MS = 30000;
 export declare const BROWSER_HEARTBEAT_INTERVAL_MS = 15000;
 export declare const SESSION_SNAPSHOT_TTL_MS = 30000;
-export { readLocalSubagentTranscript, decodePathSegment, sanitizeApiError, agentRingKey, agentMessageToEntry, };
+export { agentMessageToEntry, agentRingKey, decodePathSegment, readLocalSubagentTranscript, sanitizeApiError, };
 export interface HqServerOptions {
     /** Policy authority for control-plane command enqueue decisions. */
     trustBoundary?: TrustBoundary | undefined;

package/dist/hq-server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"hq-server.d.ts","sourceRoot":"","sources":["../src/hq-server.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAQH,OAAO,EAAoC,KAAK,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAKjG,OAAO,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AAIhD,OAAO,EAYL,2BAA2B,EAC3B,YAAY,EACZ,mBAAmB,EACnB,iBAAiB,EACjB,gBAAgB,EACjB,MAAM,uBAAuB,CAAC;AAS/B,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC5E,YAAY,EAAE,eAAe,EAAE,cAAc,EAAE,CAAC;AAEhD,OAAO,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AAI9D,OAAO,EAAE,OAAO,EAAE,CAAC;AACnB,eAAO,MAAM,YAAY,cAAc,CAAC;AACxC,eAAO,MAAM,YAAY,OAAO,CAAC;AACjC,eAAO,MAAM,aAAa,OAAO,CAAC;AAClC,eAAO,MAAM,wBAAwB,KAAK,CAAC;AAC3C,eAAO,MAAM,aAAa,QAAS,CAAC;AACpC,eAAO,MAAM,0BAA0B,QAAS,CAAC;AACjD,eAAO,MAAM,6BAA6B,QAAS,CAAC;AACpD,eAAO,MAAM,uBAAuB,QAAS,CAAC;AAE9C,OAAO,EACL,2BAA2B,EAC3B,iBAAiB,EACjB,gBAAgB,EAChB,YAAY,EACZ,mBAAmB,GACpB,CAAC;AAIF,MAAM,WAAW,eAAe;IAC9B,oEAAoE;IACpE,aAAa,CAAC,EAAE,aAAa,GAAG,SAAS,CAAC;IAC1C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,0BAA0B,CAAC,EAAE,MAAM,CAAC;IACpC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B;;;;;;;;;OASG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE;QACT,iBAAiB,EAAE,MAAM,CAAC;QAC1B,mBAAmB,CAAC,EAAE,MAAM,CAAC;KAC9B,CAAC;IACF,WAAW,EAAE,OAAO,CAAC;IACrB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,YAAY,EAAE,OAAO,CAAC;CACvB;AAED,MAAM,MAAM,eAAe,GAAG,uBAAuB,CAAC;AAEtD,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,CAAC,EAAE,eAAe,CAAC;IAChC,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACxC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAID,wBAAsB,aAAa,CAAC,OAAO,GAAE,eAAoB,GAAG,OAAO,CAAC,cAAc,CAAC,CAM1F"}
+{"version":3,"file":"hq-server.d.ts","sourceRoot":"","sources":["../src/hq-server.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAgCH,OAAO,EAAoC,KAAK,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAEjG,OAAO,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AAIhD,OAAO,EACL,mBAAmB,EACnB,YAAY,EAMZ,iBAAiB,EASjB,2BAA2B,EAC3B,gBAAgB,EACjB,MAAM,uBAAuB,CAAC;AAO/B,OAAO,KAAK,EAAE,eAAe,EAAkB,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAG5F,OAAO,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AAC9D,YAAY,EAAE,eAAe,EAAE,cAAc,EAAE,CAAC;AAIhD,OAAO,EAAE,OAAO,EAAE,CAAC;AACnB,eAAO,MAAM,YAAY,cAAc,CAAC;AACxC,eAAO,MAAM,YAAY,OAAO,CAAC;AACjC,eAAO,MAAM,aAAa,OAAO,CAAC;AAClC,eAAO,MAAM,wBAAwB,KAAK,CAAC;AAC3C,eAAO,MAAM,aAAa,QAAS,CAAC;AACpC,eAAO,MAAM,0BAA0B,QAAS,CAAC;AACjD,eAAO,MAAM,6BAA6B,QAAS,CAAC;AACpD,eAAO,MAAM,uBAAuB,QAAS,CAAC;AAE9C,OAAO,EACL,mBAAmB,EACnB,YAAY,EACZ,iBAAiB,EACjB,2BAA2B,EAC3B,gBAAgB,GACjB,CAAC;AAIF,MAAM,WAAW,eAAe;IAC9B,oEAAoE;IACpE,aAAa,CAAC,EAAE,aAAa,GAAG,SAAS,CAAC;IAC1C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,0BAA0B,CAAC,EAAE,MAAM,CAAC;IACpC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B;;;;;;;;;OASG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE;QACT,iBAAiB,EAAE,MAAM,CAAC;QAC1B,mBAAmB,CAAC,EAAE,MAAM,CAAC;KAC9B,CAAC;IACF,WAAW,EAAE,OAAO,CAAC;IACrB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,YAAY,EAAE,OAAO,CAAC;CACvB;AAED,MAAM,MAAM,eAAe,GAAG,uBAAuB,CAAC;AAEtD,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,CAAC,EAAE,eAAe,CAAC;IAChC,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACxC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAID,wBAAsB,aAAa,CAAC,OAAO,GAAE,eAAoB,GAAG,OAAO,CAAC,cAAc,CAAC,CAM1F"}

package/dist/hq-ttl-U2FAYFAT.js

@@ -0,0 +1,8 @@
+import {
+  parseTokenTtlValue
+} from "./chunk-BGFM3PD7.js";
+import "./chunk-7OCVIDC7.js";
+export {
+  parseTokenTtlValue
+};
+//# sourceMappingURL=hq-ttl-U2FAYFAT.js.map

package/dist/hq-ttl-U2FAYFAT.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": [],
+  "sourcesContent": [],
+  "mappings": "",
+  "names": []
+}

package/dist/hq-tunnel-RFKGC4HI.js

@@ -0,0 +1,114 @@
+import "./chunk-7OCVIDC7.js";
+
+// src/hq-tunnel.ts
+import { spawn } from "node:child_process";
+var QUICK_TUNNEL_URL = /https:\/\/[a-z0-9-]+\.trycloudflare\.com\b/i;
+var QUICK_TUNNEL_REGISTERED = /\bRegistered tunnel connection\b/i;
+var START_TIMEOUT_MS = 3e4;
+var MAX_LOG_CHARS = 16384;
+function extractQuickTunnelUrl(output) {
+  return output.match(QUICK_TUNNEL_URL)?.[0];
+}
+function hasRegisteredQuickTunnelConnection(output) {
+  return QUICK_TUNNEL_REGISTERED.test(output);
+}
+function tail(current, chunk) {
+  return `${current}${String(chunk)}`.slice(-MAX_LOG_CHARS);
+}
+function startHqQuickTunnel(originUrl, options = {}) {
+  return new Promise((resolve, reject) => {
+    const executable = options.executable ?? "cloudflared";
+    let child;
+    try {
+      child = spawn(executable, ["tunnel", "--url", originUrl], {
+        stdio: ["ignore", "pipe", "pipe"],
+        windowsHide: true
+      });
+    } catch (error) {
+      reject(error);
+      return;
+    }
+    let output = "";
+    let settled = false;
+    let closing = false;
+    let publicUrl;
+    const fail = (message) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      if (!child.killed) child.kill();
+      reject(new Error(message));
+    };
+    const inspect = (chunk) => {
+      output = tail(output, chunk);
+      if (settled) return;
+      const found = extractQuickTunnelUrl(output);
+      if (found) publicUrl = found;
+      if (!publicUrl || !hasRegisteredQuickTunnelConnection(output)) return;
+      const readyUrl = publicUrl;
+      settled = true;
+      clearTimeout(timer);
+      resolve({
+        url: readyUrl,
+        close: () => new Promise((done) => {
+          if (child.exitCode !== null || child.signalCode !== null) {
+            done();
+            return;
+          }
+          closing = true;
+          const forceTimer = setTimeout(() => {
+            if (child.exitCode === null && child.signalCode === null) child.kill("SIGKILL");
+          }, 3e3);
+          child.once("exit", () => {
+            clearTimeout(forceTimer);
+            done();
+          });
+          child.kill();
+        })
+      });
+    };
+    child.stdout.on("data", inspect);
+    child.stderr.on("data", inspect);
+    child.once("error", (error) => {
+      const detail = error.code === "ENOENT" ? "`cloudflared` was not found in PATH. Install Cloudflare Tunnel, then retry." : `cloudflared failed to start: ${error.message}`;
+      fail(detail);
+    });
+    child.once("exit", (code, signal) => {
+      const suffix = output.trim() ? `
+${output.trim()}` : "";
+      if (!settled) {
+        fail(
+          `cloudflared exited before publishing a tunnel URL (code ${code ?? signal ?? "unknown"}).${suffix}`
+        );
+      } else if (!closing) {
+        options.onUnexpectedExit?.(
+          `Cloudflare Quick Tunnel ${publicUrl ?? ""} stopped (code ${code ?? signal ?? "unknown"}).${suffix}`
+        );
+      }
+    });
+    const timer = setTimeout(() => {
+      fail(
+        `${publicUrl ? "Timed out waiting for cloudflared to register the Quick Tunnel connection." : "Timed out waiting for a trycloudflare.com URL from cloudflared."}${output.trim() ? `
+${output.trim()}` : ""}`
+      );
+    }, options.timeoutMs ?? START_TIMEOUT_MS);
+  });
+}
+function buildPublicHqUrl(tunnelUrl, localBrowserUrl, includeBootstrap) {
+  const publicUrl = new URL(tunnelUrl);
+  if (includeBootstrap && localBrowserUrl) {
+    try {
+      const localHash = new URL(localBrowserUrl).hash;
+      if (localHash.startsWith("#bootstrap=")) publicUrl.hash = localHash.slice(1);
+    } catch {
+    }
+  }
+  return publicUrl.toString();
+}
+export {
+  buildPublicHqUrl,
+  extractQuickTunnelUrl,
+  hasRegisteredQuickTunnelConnection,
+  startHqQuickTunnel
+};
+//# sourceMappingURL=hq-tunnel-RFKGC4HI.js.map

package/dist/hq-tunnel-RFKGC4HI.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../src/hq-tunnel.ts"],
+  "sourcesContent": ["import { type ChildProcessByStdio, spawn } from 'node:child_process';\nimport type { Readable } from 'node:stream';\n\nconst QUICK_TUNNEL_URL = /https:\\/\\/[a-z0-9-]+\\.trycloudflare\\.com\\b/i;\nconst QUICK_TUNNEL_REGISTERED = /\\bRegistered tunnel connection\\b/i;\nconst START_TIMEOUT_MS = 30_000;\nconst MAX_LOG_CHARS = 16_384;\n\nexport interface HqQuickTunnelHandle {\n  url: string;\n  close(): Promise<void>;\n}\n\nexport interface HqQuickTunnelOptions {\n  executable?: string | undefined;\n  timeoutMs?: number | undefined;\n  onUnexpectedExit?: ((message: string) => void) | undefined;\n}\n\nexport function extractQuickTunnelUrl(output: string): string | undefined {\n  return output.match(QUICK_TUNNEL_URL)?.[0];\n}\n\n/** cloudflared prints the public URL before its edge connection is usable. */\nexport function hasRegisteredQuickTunnelConnection(output: string): boolean {\n  return QUICK_TUNNEL_REGISTERED.test(output);\n}\n\nfunction tail(current: string, chunk: unknown): string {\n  return `${current}${String(chunk)}`.slice(-MAX_LOG_CHARS);\n}\n\n/** Start an anonymous TryCloudflare tunnel and tie it to the HQ process lifecycle. */\nexport function startHqQuickTunnel(\n  originUrl: string,\n  options: HqQuickTunnelOptions = {},\n): Promise<HqQuickTunnelHandle> {\n  return new Promise((resolve, reject) => {\n    const executable = options.executable ?? 'cloudflared';\n    let child: ChildProcessByStdio<null, Readable, Readable>;\n    try {\n      child = spawn(executable, ['tunnel', '--url', originUrl], {\n        stdio: ['ignore', 'pipe', 'pipe'],\n        windowsHide: true,\n      });\n    } catch (error) {\n      reject(error);\n      return;\n    }\n\n    let output = '';\n    let settled = false;\n    let closing = false;\n    let publicUrl: string | undefined;\n\n    const fail = (message: string): void => {\n      if (settled) return;\n      settled = true;\n      clearTimeout(timer);\n      if (!child.killed) child.kill();\n      reject(new Error(message));\n    };\n\n    const inspect = (chunk: unknown): void => {\n      output = tail(output, chunk);\n      if (settled) return;\n      const found = extractQuickTunnelUrl(output);\n      if (found) publicUrl = found;\n      if (!publicUrl || !hasRegisteredQuickTunnelConnection(output)) return;\n      const readyUrl = publicUrl;\n      settled = true;\n      clearTimeout(timer);\n      resolve({\n        url: readyUrl,\n        close: () =>\n          new Promise<void>((done) => {\n            if (child.exitCode !== null || child.signalCode !== null) {\n              done();\n              return;\n            }\n            closing = true;\n            const forceTimer = setTimeout(() => {\n              if (child.exitCode === null && child.signalCode === null) child.kill('SIGKILL');\n            }, 3_000);\n            child.once('exit', () => {\n              clearTimeout(forceTimer);\n              done();\n            });\n            child.kill();\n          }),\n      });\n    };\n\n    child.stdout.on('data', inspect);\n    child.stderr.on('data', inspect);\n    child.once('error', (error: NodeJS.ErrnoException) => {\n      const detail =\n        error.code === 'ENOENT'\n          ? '`cloudflared` was not found in PATH. Install Cloudflare Tunnel, then retry.'\n          : `cloudflared failed to start: ${error.message}`;\n      fail(detail);\n    });\n    child.once('exit', (code, signal) => {\n      const suffix = output.trim() ? `\\n${output.trim()}` : '';\n      if (!settled) {\n        fail(\n          `cloudflared exited before publishing a tunnel URL (code ${code ?? signal ?? 'unknown'}).${suffix}`,\n        );\n      } else if (!closing) {\n        options.onUnexpectedExit?.(\n          `Cloudflare Quick Tunnel ${publicUrl ?? ''} stopped (code ${code ?? signal ?? 'unknown'}).${suffix}`,\n        );\n      }\n    });\n\n    const timer = setTimeout(() => {\n      fail(\n        `${\n          publicUrl\n            ? 'Timed out waiting for cloudflared to register the Quick Tunnel connection.'\n            : 'Timed out waiting for a trycloudflare.com URL from cloudflared.'\n        }${output.trim() ? `\\n${output.trim()}` : ''}`,\n      );\n    }, options.timeoutMs ?? START_TIMEOUT_MS);\n  });\n}\n\nexport function buildPublicHqUrl(\n  tunnelUrl: string,\n  localBrowserUrl: string | undefined,\n  includeBootstrap: boolean,\n): string {\n  const publicUrl = new URL(tunnelUrl);\n  if (includeBootstrap && localBrowserUrl) {\n    // Preserve the bootstrap fragment (#bootstrap=\u2026) from the local URL so\n    // the tunnel user gets the same one-time code exchange path. Never copy\n    // query-string tokens \u2014 those are the reusable credential we are\n    // eliminating.\n    try {\n      const localHash = new URL(localBrowserUrl).hash;\n      if (localHash.startsWith('#bootstrap=')) publicUrl.hash = localHash.slice(1);\n    } catch {\n      // Malformed local URL \u2014 skip.\n    }\n  }\n  return publicUrl.toString();\n}\n"],
+  "mappings": ";;;;AAAA,SAAmC,aAAa;AAGhD,IAAM,mBAAmB;AACzB,IAAM,0BAA0B;AAChC,IAAM,mBAAmB;AACzB,IAAM,gBAAgB;AAaf,SAAS,sBAAsB,QAAoC;AACxE,SAAO,OAAO,MAAM,gBAAgB,IAAI,CAAC;AAC3C;AAGO,SAAS,mCAAmC,QAAyB;AAC1E,SAAO,wBAAwB,KAAK,MAAM;AAC5C;AAEA,SAAS,KAAK,SAAiB,OAAwB;AACrD,SAAO,GAAG,OAAO,GAAG,OAAO,KAAK,CAAC,GAAG,MAAM,CAAC,aAAa;AAC1D;AAGO,SAAS,mBACd,WACA,UAAgC,CAAC,GACH;AAC9B,SAAO,IAAI,QAAQ,CAAC,SAAS,WAAW;AACtC,UAAM,aAAa,QAAQ,cAAc;AACzC,QAAI;AACJ,QAAI;AACF,cAAQ,MAAM,YAAY,CAAC,UAAU,SAAS,SAAS,GAAG;AAAA,QACxD,OAAO,CAAC,UAAU,QAAQ,MAAM;AAAA,QAChC,aAAa;AAAA,MACf,CAAC;AAAA,IACH,SAAS,OAAO;AACd,aAAO,KAAK;AACZ;AAAA,IACF;AAEA,QAAI,SAAS;AACb,QAAI,UAAU;AACd,QAAI,UAAU;AACd,QAAI;AAEJ,UAAM,OAAO,CAAC,YAA0B;AACtC,UAAI,QAAS;AACb,gBAAU;AACV,mBAAa,KAAK;AAClB,UAAI,CAAC,MAAM,OAAQ,OAAM,KAAK;AAC9B,aAAO,IAAI,MAAM,OAAO,CAAC;AAAA,IAC3B;AAEA,UAAM,UAAU,CAAC,UAAyB;AACxC,eAAS,KAAK,QAAQ,KAAK;AAC3B,UAAI,QAAS;AACb,YAAM,QAAQ,sBAAsB,MAAM;AAC1C,UAAI,MAAO,aAAY;AACvB,UAAI,CAAC,aAAa,CAAC,mCAAmC,MAAM,EAAG;AAC/D,YAAM,WAAW;AACjB,gBAAU;AACV,mBAAa,KAAK;AAClB,cAAQ;AAAA,QACN,KAAK;AAAA,QACL,OAAO,MACL,IAAI,QAAc,CAAC,SAAS;AAC1B,cAAI,MAAM,aAAa,QAAQ,MAAM,eAAe,MAAM;AACxD,iBAAK;AACL;AAAA,UACF;AACA,oBAAU;AACV,gBAAM,aAAa,WAAW,MAAM;AAClC,gBAAI,MAAM,aAAa,QAAQ,MAAM,eAAe,KAAM,OAAM,KAAK,SAAS;AAAA,UAChF,GAAG,GAAK;AACR,gBAAM,KAAK,QAAQ,MAAM;AACvB,yBAAa,UAAU;AACvB,iBAAK;AAAA,UACP,CAAC;AACD,gBAAM,KAAK;AAAA,QACb,CAAC;AAAA,MACL,CAAC;AAAA,IACH;AAEA,UAAM,OAAO,GAAG,QAAQ,OAAO;AAC/B,UAAM,OAAO,GAAG,QAAQ,OAAO;AAC/B,UAAM,KAAK,SAAS,CAAC,UAAiC;AACpD,YAAM,SACJ,MAAM,SAAS,WACX,gFACA,gCAAgC,MAAM,OAAO;AACnD,WAAK,MAAM;AAAA,IACb,CAAC;AACD,UAAM,KAAK,QAAQ,CAAC,MAAM,WAAW;AACnC,YAAM,SAAS,OAAO,KAAK,IAAI;AAAA,EAAK,OAAO,KAAK,CAAC,KAAK;AACtD,UAAI,CAAC,SAAS;AACZ;AAAA,UACE,2DAA2D,QAAQ,UAAU,SAAS,KAAK,MAAM;AAAA,QACnG;AAAA,MACF,WAAW,CAAC,SAAS;AACnB,gBAAQ;AAAA,UACN,2BAA2B,aAAa,EAAE,kBAAkB,QAAQ,UAAU,SAAS,KAAK,MAAM;AAAA,QACpG;AAAA,MACF;AAAA,IACF,CAAC;AAED,UAAM,QAAQ,WAAW,MAAM;AAC7B;AAAA,QACE,GACE,YACI,+EACA,iEACN,GAAG,OAAO,KAAK,IAAI;AAAA,EAAK,OAAO,KAAK,CAAC,KAAK,EAAE;AAAA,MAC9C;AAAA,IACF,GAAG,QAAQ,aAAa,gBAAgB;AAAA,EAC1C,CAAC;AACH;AAEO,SAAS,iBACd,WACA,iBACA,kBACQ;AACR,QAAM,YAAY,IAAI,IAAI,SAAS;AACnC,MAAI,oBAAoB,iBAAiB;AAKvC,QAAI;AACF,YAAM,YAAY,IAAI,IAAI,eAAe,EAAE;AAC3C,UAAI,UAAU,WAAW,aAAa,EAAG,WAAU,OAAO,UAAU,MAAM,CAAC;AAAA,IAC7E,QAAQ;AAAA,IAER;AAAA,EACF;AACA,SAAO,UAAU,SAAS;AAC5B;",
+  "names": []
+}

package/dist/hq-tunnel.d.ts

@@ -12,5 +12,5 @@ export declare function extractQuickTunnelUrl(output: string): string | undefine
 export declare function hasRegisteredQuickTunnelConnection(output: string): boolean;
 /** Start an anonymous TryCloudflare tunnel and tie it to the HQ process lifecycle. */
 export declare function startHqQuickTunnel(originUrl: string, options?: HqQuickTunnelOptions): Promise<HqQuickTunnelHandle>;
-export declare function buildPublicHqUrl(tunnelUrl: string, localBrowserUrl: string | undefined, includeToken: boolean): string;
+export declare function buildPublicHqUrl(tunnelUrl: string, localBrowserUrl: string | undefined, includeBootstrap: boolean): string;
 //# sourceMappingURL=hq-tunnel.d.ts.map

package/dist/hq-tunnel.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"hq-tunnel.d.ts","sourceRoot":"","sources":["../src/hq-tunnel.ts"],"names":[],"mappings":"AAQA,MAAM,WAAW,mBAAmB;IAClC,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED,MAAM,WAAW,oBAAoB;IACnC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,gBAAgB,CAAC,EAAE,CAAC,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC,GAAG,SAAS,CAAC;CAC5D;AAED,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAExE;AAED,8EAA8E;AAC9E,wBAAgB,kCAAkC,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAE1E;AAMD,sFAAsF;AACtF,wBAAgB,kBAAkB,CAChC,SAAS,EAAE,MAAM,EACjB,OAAO,GAAE,oBAAyB,GACjC,OAAO,CAAC,mBAAmB,CAAC,CAyF9B;AAED,wBAAgB,gBAAgB,CAC9B,SAAS,EAAE,MAAM,EACjB,eAAe,EAAE,MAAM,GAAG,SAAS,EACnC,YAAY,EAAE,OAAO,GACpB,MAAM,CAOR"}
+{"version":3,"file":"hq-tunnel.d.ts","sourceRoot":"","sources":["../src/hq-tunnel.ts"],"names":[],"mappings":"AAQA,MAAM,WAAW,mBAAmB;IAClC,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED,MAAM,WAAW,oBAAoB;IACnC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,gBAAgB,CAAC,EAAE,CAAC,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC,GAAG,SAAS,CAAC;CAC5D;AAED,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAExE;AAED,8EAA8E;AAC9E,wBAAgB,kCAAkC,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAE1E;AAMD,sFAAsF;AACtF,wBAAgB,kBAAkB,CAChC,SAAS,EAAE,MAAM,EACjB,OAAO,GAAE,oBAAyB,GACjC,OAAO,CAAC,mBAAmB,CAAC,CAyF9B;AAED,wBAAgB,gBAAgB,CAC9B,SAAS,EAAE,MAAM,EACjB,eAAe,EAAE,MAAM,GAAG,SAAS,EACnC,gBAAgB,EAAE,OAAO,GACxB,MAAM,CAeR"}