@wrongstack/cli 0.296.2 → 0.296.4

package/dist/execution-storage-observability.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"execution-storage-observability.d.ts","sourceRoot":"","sources":["../src/execution-storage-observability.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AAExD,wBAAgB,2BAA2B,CACzC,MAAM,EAAE,QAAQ,EAChB,WAAW,EAAE,MAAM,GAAG,SAAS,GAC9B,MAAM,IAAI,CA4BZ"}
+{"version":3,"file":"execution-storage-observability.d.ts","sourceRoot":"","sources":["../src/execution-storage-observability.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AAExD,wBAAgB,2BAA2B,CACzC,MAAM,EAAE,QAAQ,EAChB,WAAW,EAAE,MAAM,GAAG,SAAS,GAC9B,MAAM,IAAI,CAiFZ"}

package/dist/execution.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"execution.d.ts","sourceRoot":"","sources":["../src/execution.ts"],"names":[],"mappings":"AA0DA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAMrD,YAAY,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAWlE,OAAO,EACL,+BAA+B,EAC/B,kCAAkC,EAClC,8BAA8B,EAC9B,8BAA8B,EAC9B,6BAA6B,GAC9B,MAAM,8BAA8B,CAAC;AAEtC,YAAY,EACV,SAAS,EACT,aAAa,EACb,WAAW,EACX,aAAa,EACb,gBAAgB,EAChB,gBAAgB,EAChB,cAAc,GACf,MAAM,mBAAmB,CAAC;AAE3B,wBAAsB,OAAO,CAAC,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,CAw6BhE"}
+{"version":3,"file":"execution.d.ts","sourceRoot":"","sources":["../src/execution.ts"],"names":[],"mappings":"AA0DA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAMrD,YAAY,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAWlE,OAAO,EACL,+BAA+B,EAC/B,kCAAkC,EAClC,8BAA8B,EAC9B,8BAA8B,EAC9B,6BAA6B,GAC9B,MAAM,8BAA8B,CAAC;AAEtC,YAAY,EACV,SAAS,EACT,aAAa,EACb,WAAW,EACX,aAAa,EACb,gBAAgB,EAChB,gBAAgB,EAChB,cAAc,GACf,MAAM,mBAAmB,CAAC;AAE3B,wBAAsB,OAAO,CAAC,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,CA06BhE"}

package/dist/fleet/host-subagent-factory.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"host-subagent-factory.d.ts","sourceRoot":"","sources":["../../src/fleet/host-subagent-factory.ts"],"names":[],"mappings":"AAcA,OAAO,EACL,KAAK,YAAY,EAEjB,KAAK,sBAAsB,EAK5B,MAAM,+BAA+B,CAAC;AAUvC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAG9D,OAAO,KAAK,EACV,MAAM,EAIN,cAAc,EAEd,IAAI,EACL,MAAM,wBAAwB,CAAC;AAIhC,OAAO,KAAK,EAAE,cAAc,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AAW7E,MAAM,WAAW,0BAA0B;IACzC,IAAI,EAAE,cAAc,CAAC;IACrB,IAAI,EAAE,qBAAqB,CAAC;IAC5B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IACvC,cAAc,CAAC,EAAE,sBAAsB,GAAG,SAAS,CAAC;IACpD,WAAW,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC;IAC1C,iBAAiB,EAAE,MAAM,MAAM,CAAC;IAChC,kBAAkB,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC/D,oBAAoB,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,KAAK,YAAY,CAAC;CAC1D;AAED,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,0BAA0B,GAC/B,YAAY,CAySd"}
+{"version":3,"file":"host-subagent-factory.d.ts","sourceRoot":"","sources":["../../src/fleet/host-subagent-factory.ts"],"names":[],"mappings":"AAcA,OAAO,EACL,KAAK,YAAY,EAEjB,KAAK,sBAAsB,EAK5B,MAAM,+BAA+B,CAAC;AAUvC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAG9D,OAAO,KAAK,EACV,MAAM,EAIN,cAAc,EAEd,IAAI,EACL,MAAM,wBAAwB,CAAC;AAIhC,OAAO,KAAK,EAAE,cAAc,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AAW7E,MAAM,WAAW,0BAA0B;IACzC,IAAI,EAAE,cAAc,CAAC;IACrB,IAAI,EAAE,qBAAqB,CAAC;IAC5B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IACvC,cAAc,CAAC,EAAE,sBAAsB,GAAG,SAAS,CAAC;IACpD,WAAW,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC;IAC1C,iBAAiB,EAAE,MAAM,MAAM,CAAC;IAChC,kBAAkB,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC/D,oBAAoB,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,KAAK,YAAY,CAAC;CAC1D;AAED,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,0BAA0B,GAC/B,YAAY,CAmTd"}

package/dist/{hq-BECGICEZ.js → hq-JUYKUNJX.js}

@@ -36,7 +36,7 @@ var hqCmd = async (args, deps) => {
   return 1;
 };
 async function startServer(deps) {
-  const { startHqServer } = await import("./hq-server-FJOVOERO.js");
+  const { startHqServer } = await import("./hq-server-6AQ3BXZA.js");
   const dataDir = resolveDataDir(deps);
   const flags = deps.flags ?? {};
   const host = typeof flags["host"] === "string" ? flags["host"] : HQ_CLI_DEFAULT_HOST;
@@ -544,4 +544,4 @@ export {
   hqCmd,
   resolveAuditActor
 };
-//# sourceMappingURL=hq-BECGICEZ.js.map
+//# sourceMappingURL=hq-JUYKUNJX.js.map

package/dist/hq-server/auth.d.ts

@@ -4,6 +4,7 @@
  * @module hq-server/auth
  */
 import type * as http from 'node:http';
+import type { HqSessionEntry } from './types.js';
 export declare const HQ_SESSION_COOKIE = "hq.session";
 export declare const HQ_SESSION_MAX_AGE_MS: number;
 export interface HqBrowserAuthContext {
@@ -12,7 +13,18 @@ export interface HqBrowserAuthContext {
     id: string;
     capabilities?: string[];
 }
-export type HqBrowserAuthResult = HqBrowserAuthContext | 'cookie' | undefined;
+/**
+ * Cookie-session auth context — returned when a valid `hq.session` cookie
+ * is presented. Password-origin cookies have `kind: 'cookie'` (full
+ * access). Token-origin cookies carry the source token's capabilities
+ * so capability checks (e.g. `control.enqueue`) still apply.
+ */
+export interface HqCookieAuthContext {
+    kind: 'cookie';
+    tokenId?: string;
+    capabilities?: string[];
+}
+export type HqBrowserAuthResult = HqBrowserAuthContext | HqCookieAuthContext | undefined;
 /**
  * The only featureful frontend is the packaged, same-origin React SPA.
  * The missing-assets recovery document contains inline CSS but no script.
@@ -25,6 +37,7 @@ export declare function parseCookieHeader(cookieHeader: string | undefined): Rec
 export declare function setHqSessionCookie(res: http.ServerResponse, value: string, secure?: boolean): void;
 export declare function clearHqSessionCookie(res: http.ServerResponse, secure?: boolean): void;
 export declare function isTokenAuth(auth: HqBrowserAuthResult): auth is HqBrowserAuthContext;
+export declare function isCookieAuth(auth: HqBrowserAuthResult): auth is HqCookieAuthContext;
 /**
  * Constant-time membership test for a token set. Returns the matching stored
  * token (so callers can look up its metadata) or undefined. Iterates and
@@ -41,7 +54,5 @@ export declare function authenticateBrowserRequest(req: http.IncomingMessage, ur
     }>;
     passwordHash?: string | undefined;
     cookieSecret?: string | undefined;
-}, sessions: Map<string, {
-    createdAt: number;
-}>): HqBrowserAuthResult;
+}, sessions: Map<string, HqSessionEntry>): HqBrowserAuthResult;
 //# sourceMappingURL=auth.d.ts.map

package/dist/hq-server/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/hq-server/auth.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,KAAK,KAAK,IAAI,MAAM,WAAW,CAAC;AAKvC,eAAO,MAAM,iBAAiB,eAAe,CAAC;AAC9C,eAAO,MAAM,qBAAqB,QAA0B,CAAC;AAI7D,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,OAAO,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,EAAE,EAAE,MAAM,CAAC;IACX,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;CACzB;AAED,MAAM,MAAM,mBAAmB,GAAG,oBAAoB,GAAG,QAAQ,GAAG,SAAS,CAAC;AAI9E;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,IAAI,CAAC,cAAc,GAAG,IAAI,CAoBnE;AA+DD,wBAAgB,uBAAuB,CACrC,GAAG,EAAE,IAAI,CAAC,eAAe,EACzB,SAAS,CAAC,EAAE,MAAM,EAClB,SAAS,CAAC,EAAE,MAAM,EAClB,oBAAoB,GAAE,WAAW,CAAC,MAAM,CAAa,GACpD,OAAO,CAgCT;AAQD,wBAAgB,wBAAwB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAElF;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAatF;AAED,wBAAgB,iBAAiB,CAAC,YAAY,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAmB1F;AAED,wBAAgB,kBAAkB,CAChC,GAAG,EAAE,IAAI,CAAC,cAAc,EACxB,KAAK,EAAE,MAAM,EACb,MAAM,CAAC,EAAE,OAAO,GACf,IAAI,CAUN;AAED,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,IAAI,CAAC,cAAc,EAAE,MAAM,CAAC,EAAE,OAAO,GAAG,IAAI,CAIrF;AAID,wBAAgB,WAAW,CAAC,IAAI,EAAE,mBAAmB,GAAG,IAAI,IAAI,oBAAoB,CAEnF;AAgCD;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAQ9F;AAED,wBAAgB,0BAA0B,CACxC,GAAG,EAAE,IAAI,CAAC,eAAe,EACzB,GAAG,EAAE,GAAG,EACR,WAAW,EAAE;IACX,aAAa,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC3B,gBAAgB,EAAE,GAAG,CAAC,MAAM,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAC;IACvE,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACnC,EACD,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE;IAAE,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,GAC3C,mBAAmB,CAiCrB"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/hq-server/auth.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,KAAK,KAAK,IAAI,MAAM,WAAW,CAAC;AAEvC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAIjD,eAAO,MAAM,iBAAiB,eAAe,CAAC;AAC9C,eAAO,MAAM,qBAAqB,QAA0B,CAAC;AAI7D,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,OAAO,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,EAAE,EAAE,MAAM,CAAC;IACX,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;CACzB;AAED;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,QAAQ,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;CACzB;AAED,MAAM,MAAM,mBAAmB,GAAG,oBAAoB,GAAG,mBAAmB,GAAG,SAAS,CAAC;AAIzF;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,IAAI,CAAC,cAAc,GAAG,IAAI,CAoBnE;AA+DD,wBAAgB,uBAAuB,CACrC,GAAG,EAAE,IAAI,CAAC,eAAe,EACzB,SAAS,CAAC,EAAE,MAAM,EAClB,SAAS,CAAC,EAAE,MAAM,EAClB,oBAAoB,GAAE,WAAW,CAAC,MAAM,CAAa,GACpD,OAAO,CAgCT;AAQD,wBAAgB,wBAAwB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAElF;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAatF;AAED,wBAAgB,iBAAiB,CAAC,YAAY,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAmB1F;AAED,wBAAgB,kBAAkB,CAChC,GAAG,EAAE,IAAI,CAAC,cAAc,EACxB,KAAK,EAAE,MAAM,EACb,MAAM,CAAC,EAAE,OAAO,GACf,IAAI,CAUN;AAED,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,IAAI,CAAC,cAAc,EAAE,MAAM,CAAC,EAAE,OAAO,GAAG,IAAI,CAIrF;AAID,wBAAgB,WAAW,CAAC,IAAI,EAAE,mBAAmB,GAAG,IAAI,IAAI,oBAAoB,CAEnF;AAED,wBAAgB,YAAY,CAAC,IAAI,EAAE,mBAAmB,GAAG,IAAI,IAAI,mBAAmB,CAEnF;AAgCD;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAQ9F;AAED,wBAAgB,0BAA0B,CACxC,GAAG,EAAE,IAAI,CAAC,eAAe,EACzB,GAAG,EAAE,GAAG,EACR,WAAW,EAAE;IACX,aAAa,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC3B,gBAAgB,EAAE,GAAG,CAAC,MAAM,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAC;IACvE,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACnC,EACD,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,GACpC,mBAAmB,CAkDrB"}

package/dist/hq-server/routes/auth-handlers.d.ts

@@ -1,22 +1,14 @@
 import type * as http from 'node:http';
 import { type HqAlertRuleConfig, type HqRedactionPolicy, type HqToken } from '@wrongstack/core/hq';
-import type { HqRouterMutableAuth } from '../types.js';
-export declare function handleApiAuthStatus(req: http.IncomingMessage, res: http.ServerResponse, url: URL, mutableAuth: HqRouterMutableAuth, sessions: Map<string, {
-    createdAt: number;
-}>, requireBrowserAuth: boolean | undefined, trustedPublicOrigins: Set<string>, secureCookies: boolean | undefined): Promise<void>;
-export declare function handleApiLogin(req: http.IncomingMessage, res: http.ServerResponse, mutableAuth: HqRouterMutableAuth, sessions: Map<string, {
-    createdAt: number;
-}>, loginAttempts: Map<string, {
+import type { HqRouterMutableAuth, HqSessionEntry } from '../types.js';
+export declare function handleApiAuthStatus(req: http.IncomingMessage, res: http.ServerResponse, url: URL, mutableAuth: HqRouterMutableAuth, sessions: Map<string, HqSessionEntry>, requireBrowserAuth: boolean | undefined, trustedPublicOrigins: Set<string>, secureCookies: boolean | undefined): Promise<void>;
+export declare function handleApiLogin(req: http.IncomingMessage, res: http.ServerResponse, mutableAuth: HqRouterMutableAuth, sessions: Map<string, HqSessionEntry>, loginAttempts: Map<string, {
     count: number;
     blockedUntil: number;
     lastAttempt: number;
 }>, secureCookies: boolean | undefined): Promise<void>;
-export declare function handleApiLogout(req: http.IncomingMessage, res: http.ServerResponse, mutableAuth: HqRouterMutableAuth, sessions: Map<string, {
-    createdAt: number;
-}>, secureCookies: boolean | undefined): Promise<void>;
-export declare function handleApiPassword(req: http.IncomingMessage, res: http.ServerResponse, mutableAuth: HqRouterMutableAuth, sessions: Map<string, {
-    createdAt: number;
-}>, dataDir: string, secureCookies: boolean | undefined, requireBrowserAuth: boolean | undefined): Promise<void>;
+export declare function handleApiLogout(req: http.IncomingMessage, res: http.ServerResponse, mutableAuth: HqRouterMutableAuth, sessions: Map<string, HqSessionEntry>, secureCookies: boolean | undefined): Promise<void>;
+export declare function handleApiPassword(req: http.IncomingMessage, res: http.ServerResponse, mutableAuth: HqRouterMutableAuth, sessions: Map<string, HqSessionEntry>, dataDir: string, secureCookies: boolean | undefined, requireBrowserAuth: boolean | undefined): Promise<void>;
 export declare function applyAuthFile(mutableAuth: HqRouterMutableAuth, next: {
     browserTokens?: Array<{
         token: string;
@@ -29,4 +21,5 @@ export declare function applyAuthFile(mutableAuth: HqRouterMutableAuth, next: {
     cookieSecret?: string;
     alertRules?: HqAlertRuleConfig;
 }): void;
+export declare function handleApiBootstrap(req: http.IncomingMessage, res: http.ServerResponse, mutableAuth: HqRouterMutableAuth, sessions: Map<string, HqSessionEntry>, secureCookies: boolean | undefined, bootstrapStore: import('@wrongstack/core/hq').HqBootstrapCodeStore): Promise<void>;
 //# sourceMappingURL=auth-handlers.d.ts.map

package/dist/hq-server/routes/auth-handlers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-handlers.d.ts","sourceRoot":"","sources":["../../../src/hq-server/routes/auth-handlers.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,KAAK,IAAI,MAAM,WAAW,CAAC;AACvC,OAAO,EAOL,KAAK,iBAAiB,EACtB,KAAK,iBAAiB,EACtB,KAAK,OAAO,EACb,MAAM,qBAAqB,CAAC;AAW7B,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAQvD,wBAAsB,mBAAmB,CACvC,GAAG,EAAE,IAAI,CAAC,eAAe,EACzB,GAAG,EAAE,IAAI,CAAC,cAAc,EACxB,GAAG,EAAE,GAAG,EACR,WAAW,EAAE,mBAAmB,EAChC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE;IAAE,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,EAC5C,kBAAkB,EAAE,OAAO,GAAG,SAAS,EACvC,oBAAoB,EAAE,GAAG,CAAC,MAAM,CAAC,EACjC,aAAa,EAAE,OAAO,GAAG,SAAS,GACjC,OAAO,CAAC,IAAI,CAAC,CAyBf;AAED,wBAAsB,cAAc,CAClC,GAAG,EAAE,IAAI,CAAC,eAAe,EACzB,GAAG,EAAE,IAAI,CAAC,cAAc,EACxB,WAAW,EAAE,mBAAmB,EAChC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE;IAAE,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,EAC5C,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,CAAC,EACxF,aAAa,EAAE,OAAO,GAAG,SAAS,GACjC,OAAO,CAAC,IAAI,CAAC,CA4Ef;AAED,wBAAsB,eAAe,CACnC,GAAG,EAAE,IAAI,CAAC,eAAe,EACzB,GAAG,EAAE,IAAI,CAAC,cAAc,EACxB,WAAW,EAAE,mBAAmB,EAChC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE;IAAE,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,EAC5C,aAAa,EAAE,OAAO,GAAG,SAAS,GACjC,OAAO,CAAC,IAAI,CAAC,CAkBf;AAED,wBAAsB,iBAAiB,CACrC,GAAG,EAAE,IAAI,CAAC,eAAe,EACzB,GAAG,EAAE,IAAI,CAAC,cAAc,EACxB,WAAW,EAAE,mBAAmB,EAChC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE;IAAE,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,EAC5C,OAAO,EAAE,MAAM,EACf,aAAa,EAAE,OAAO,GAAG,SAAS,EAClC,kBAAkB,EAAE,OAAO,GAAG,SAAS,GACtC,OAAO,CAAC,IAAI,CAAC,CA6Hf;AAED,wBAAgB,aAAa,CAC3B,WAAW,EAAE,mBAAmB,EAChC,IAAI,EAAE;IACJ,aAAa,CAAC,EAAE,KAAK,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAC;IAC9E,YAAY,CAAC,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IAC9B,eAAe,CAAC,EAAE,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAC7C,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,iBAAiB,CAAC;CAChC,GACA,IAAI,CAoBN"}
+{"version":3,"file":"auth-handlers.d.ts","sourceRoot":"","sources":["../../../src/hq-server/routes/auth-handlers.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,KAAK,IAAI,MAAM,WAAW,CAAC;AACvC,OAAO,EAOL,KAAK,iBAAiB,EACtB,KAAK,iBAAiB,EACtB,KAAK,OAAO,EACb,MAAM,qBAAqB,CAAC;AAY7B,OAAO,KAAK,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAQvE,wBAAsB,mBAAmB,CACvC,GAAG,EAAE,IAAI,CAAC,eAAe,EACzB,GAAG,EAAE,IAAI,CAAC,cAAc,EACxB,GAAG,EAAE,GAAG,EACR,WAAW,EAAE,mBAAmB,EAChC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,EACrC,kBAAkB,EAAE,OAAO,GAAG,SAAS,EACvC,oBAAoB,EAAE,GAAG,CAAC,MAAM,CAAC,EACjC,aAAa,EAAE,OAAO,GAAG,SAAS,GACjC,OAAO,CAAC,IAAI,CAAC,CAyBf;AAED,wBAAsB,cAAc,CAClC,GAAG,EAAE,IAAI,CAAC,eAAe,EACzB,GAAG,EAAE,IAAI,CAAC,cAAc,EACxB,WAAW,EAAE,mBAAmB,EAChC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,EACrC,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,CAAC,EACxF,aAAa,EAAE,OAAO,GAAG,SAAS,GACjC,OAAO,CAAC,IAAI,CAAC,CA4Ef;AAED,wBAAsB,eAAe,CACnC,GAAG,EAAE,IAAI,CAAC,eAAe,EACzB,GAAG,EAAE,IAAI,CAAC,cAAc,EACxB,WAAW,EAAE,mBAAmB,EAChC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,EACrC,aAAa,EAAE,OAAO,GAAG,SAAS,GACjC,OAAO,CAAC,IAAI,CAAC,CAkBf;AAED,wBAAsB,iBAAiB,CACrC,GAAG,EAAE,IAAI,CAAC,eAAe,EACzB,GAAG,EAAE,IAAI,CAAC,cAAc,EACxB,WAAW,EAAE,mBAAmB,EAChC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,EACrC,OAAO,EAAE,MAAM,EACf,aAAa,EAAE,OAAO,GAAG,SAAS,EAClC,kBAAkB,EAAE,OAAO,GAAG,SAAS,GACtC,OAAO,CAAC,IAAI,CAAC,CA6Hf;AAED,wBAAgB,aAAa,CAC3B,WAAW,EAAE,mBAAmB,EAChC,IAAI,EAAE;IACJ,aAAa,CAAC,EAAE,KAAK,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAC;IAC9E,YAAY,CAAC,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IAC9B,eAAe,CAAC,EAAE,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAC7C,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,iBAAiB,CAAC;CAChC,GACA,IAAI,CAoBN;AAID,wBAAsB,kBAAkB,CACtC,GAAG,EAAE,IAAI,CAAC,eAAe,EACzB,GAAG,EAAE,IAAI,CAAC,cAAc,EACxB,WAAW,EAAE,mBAAmB,EAChC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,EACrC,aAAa,EAAE,OAAO,GAAG,SAAS,EAClC,cAAc,EAAE,OAAO,qBAAqB,EAAE,oBAAoB,GACjE,OAAO,CAAC,IAAI,CAAC,CA2Ef"}

package/dist/hq-server/routes.d.ts

@@ -20,6 +20,7 @@ export declare const setHqSecurityHeaders: typeof HqServerAuth.setHqSecurityHead
 export declare const hasTrustedBrowserOrigin: typeof HqServerAuth.hasTrustedBrowserOrigin;
 export declare const authenticateBrowserRequest: typeof HqServerAuth.authenticateBrowserRequest;
 export declare const isTokenAuth: typeof HqServerAuth.isTokenAuth;
+export declare const isCookieAuth: typeof HqServerAuth.isCookieAuth;
 export declare const setHqSessionCookie: typeof HqServerAuth.setHqSessionCookie;
 export declare const clearHqSessionCookie: typeof HqServerAuth.clearHqSessionCookie;
 export declare const serializeHqSessionCookie: typeof HqServerAuth.serializeHqSessionCookie;
@@ -31,13 +32,14 @@ export declare const readRequestBody: typeof HqServerUtils.readRequestBody;
 export declare const writeInvalidBody: typeof HqServerUtils.writeInvalidBody;
 export declare const sanitizeApiError: typeof HqServerUtils.sanitizeApiError;
 export declare const buildHttpUrl: typeof HqServerUtils.buildHttpUrl;
+export declare const buildBootstrapHttpUrl: typeof HqServerUtils.buildBootstrapHttpUrl;
 export declare const buildClientWsUrl: typeof HqServerUtils.buildClientWsUrl;
 export declare const agentRingKey: typeof HqServerUtils.agentRingKey;
 export declare const agentMessageToEntry: typeof HqServerUtils.agentMessageToEntry;
 export declare const readLocalSubagentTranscript: typeof HqServerUtils.readLocalSubagentTranscript;
 export declare const lanIPv4Addresses: typeof HqServerUtils.lanIPv4Addresses;
 export declare const hqRuntimeMarkerPath: typeof HqServerUtils.hqRuntimeMarkerPath;
-import type { ConnectedClient, HqRouterMutableAuth, HqSnapshotBroadcaster, ProjectDetail, TranscriptRing } from './types.js';
+import type { ConnectedClient, HqRouterMutableAuth, HqSessionEntry, HqSnapshotBroadcaster, ProjectDetail, TranscriptRing } from './types.js';
 export type { ConnectedClient, HqSnapshotBroadcaster, ProjectDetail, TranscriptRing, };
 export interface HqRouterMailboxGateway {
     mailbox: Mailbox;
@@ -49,9 +51,7 @@ export interface HqRouterDeps {
     listeningPort: number;
     trustedPublicOrigins: Set<string>;
     mutableAuth: HqRouterMutableAuth;
-    sessions: Map<string, {
-        createdAt: number;
-    }>;
+    sessions: Map<string, HqSessionEntry>;
     loginAttempts: Map<string, {
         count: number;
         blockedUntil: number;
@@ -75,6 +75,8 @@ export interface HqRouterDeps {
     getMailboxGateway: (projectDir: string) => HqRouterMailboxGateway;
     /** Aggregate token-expiry stats for snapshot totals + alert engine. */
     getTokenStats?: (() => HqSnapshot['totals']['tokenStats'] | undefined) | undefined;
+    /** One-time bootstrap code store for token-to-cookie exchange. */
+    bootstrapStore?: import('@wrongstack/core/hq').HqBootstrapCodeStore | undefined;
 }
 /**
  * Create the HTTP request listener that handles all `/api/*` routes as well

package/dist/hq-server/routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"routes.d.ts","sourceRoot":"","sources":["../../src/hq-server/routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,OAAO,KAAK,KAAK,IAAI,MAAM,WAAW,CAAC;AACvC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC;AACpC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,EAAE,KAAK,mBAAmB,EAAyC,MAAM,qBAAqB,CAAC;AACtG,OAAO,KAAK,EAAE,UAAU,EAAE,aAAa,EAAkC,iBAAiB,EAAE,eAAe,EAAuC,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACjM,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,+BAA+B,CAAC;AAC7E,OAAO,EACL,KAAK,OAAO,EACZ,KAAK,yBAAyB,EAC9B,KAAK,sBAAsB,EAE5B,MAAM,+BAA+B,CAAC;AAGvC,OAAO,KAAK,YAAY,MAAM,WAAW,CAAC;AAE1C,OAAO,KAAK,aAAa,MAAM,YAAY,CAAC;AAwB5C,eAAO,MAAM,oBAAoB,0CAAoC,CAAC;AACtE,eAAO,MAAM,uBAAuB,6CAAuC,CAAC;AAC5E,eAAO,MAAM,0BAA0B,gDAA0C,CAAC;AAClF,eAAO,MAAM,WAAW,iCAA2B,CAAC;AACpD,eAAO,MAAM,kBAAkB,wCAAkC,CAAC;AAClE,eAAO,MAAM,oBAAoB,0CAAoC,CAAC;AACtE,eAAO,MAAM,wBAAwB,8CAAwC,CAAC;AAC9E,eAAO,MAAM,oBAAoB,0CAAoC,CAAC;AACtE,eAAO,MAAM,iBAAiB,uCAAiC,CAAC;AAChE,eAAO,MAAM,iBAAiB,eAAiC,CAAC;AAEhE,eAAO,MAAM,iBAAiB,wCAAkC,CAAC;AACjE,eAAO,MAAM,eAAe,sCAAgC,CAAC;AAC7D,eAAO,MAAM,gBAAgB,uCAAiC,CAAC;AAC/D,eAAO,MAAM,gBAAgB,uCAAiC,CAAC;AAC/D,eAAO,MAAM,YAAY,mCAA6B,CAAC;AACvD,eAAO,MAAM,gBAAgB,uCAAiC,CAAC;AAC/D,eAAO,MAAM,YAAY,mCAA6B,CAAC;AACvD,eAAO,MAAM,mBAAmB,0CAAoC,CAAC;AACrE,eAAO,MAAM,2BAA2B,kDAA4C,CAAC;AACrF,eAAO,MAAM,gBAAgB,uCAAiC,CAAC;AAC/D,eAAO,MAAM,mBAAmB,0CAAoC,CAAC;AAIrE,OAAO,KAAK,EACV,eAAe,EACf,mBAAmB,EACnB,qBAAqB,EACrB,aAAa,EACb,cAAc,EACf,MAAM,YAAY,CAAC;AAEpB,YAAY,EACV,eAAe,EACf,qBAAqB,EACrB,aAAa,EACb,cAAc,GACf,CAAC;AAIF,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,UAAU,CAAC,OAAO,uBAAuB,CAAC,CAAC;CACpD;AAED,MAAM,WAAW,YAAY;IAC3B,aAAa,EAAE,aAAa,CAAC;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,EAAE,MAAM,CAAC;IACtB,oBAAoB,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAClC,WAAW,EAAE,mBAAmB,CAAC;IACjC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC7C,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACzF,OAAO,EAAE,GAAG,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC;IACzC,QAAQ,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC;IACzB,QAAQ,EAAE,eAAe,EAAE,CAAC;IAC5B,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IACzC,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE,iBAAiB,EAAE,CAAC,CAAC;IAChD,eAAe,EAAE,GAAG,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAAC;IACrD,yBAAyB,EAAE,sBAAsB,CAAC;IAClD,WAAW,EAAE,aAAa,CAAC;IAC3B,QAAQ,EAAE,iBAAiB,CAAC;IAC5B,WAAW,EAAE,UAAU,CAAC,OAAO,mBAAmB,CAAC,CAAC;IACpD,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,kBAAkB,EAAE,OAAO,GAAG,SAAS,CAAC;IACxC,aAAa,EAAE,OAAO,GAAG,SAAS,CAAC;IACnC,uBAAuB,EAAE,CACvB,GAAG,EAAE,IAAI,CAAC,eAAe,EACzB,UAAU,EAAE,MAAM,KACf,yBAAyB,CAAC;IAC/B,iBAAiB,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,sBAAsB,CAAC;IAClE,uEAAuE;IACvE,aAAa,CAAC,EAAE,CAAC,MAAM,UAAU,CAAC,QAAQ,CAAC,CAAC,YAAY,CAAC,GAAG,SAAS,CAAC,GAAG,SAAS,CAAC;CACpF;AAID;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,YAAY,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,eAAe,EAAE,GAAG,EAAE,IAAI,CAAC,cAAc,KAAK,OAAO,CAAC,IAAI,CAAC,CA6PzH"}
+{"version":3,"file":"routes.d.ts","sourceRoot":"","sources":["../../src/hq-server/routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,OAAO,KAAK,KAAK,IAAI,MAAM,WAAW,CAAC;AACvC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC;AACpC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,EAAE,KAAK,mBAAmB,EAAyC,MAAM,qBAAqB,CAAC;AACtG,OAAO,KAAK,EAAE,UAAU,EAAE,aAAa,EAAkC,iBAAiB,EAAE,eAAe,EAAuC,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACjM,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,+BAA+B,CAAC;AAC7E,OAAO,EACL,KAAK,OAAO,EACZ,KAAK,yBAAyB,EAC9B,KAAK,sBAAsB,EAE5B,MAAM,+BAA+B,CAAC;AAGvC,OAAO,KAAK,YAAY,MAAM,WAAW,CAAC;AAE1C,OAAO,KAAK,aAAa,MAAM,YAAY,CAAC;AAyB5C,eAAO,MAAM,oBAAoB,0CAAoC,CAAC;AACtE,eAAO,MAAM,uBAAuB,6CAAuC,CAAC;AAC5E,eAAO,MAAM,0BAA0B,gDAA0C,CAAC;AAClF,eAAO,MAAM,WAAW,iCAA2B,CAAC;AACpD,eAAO,MAAM,YAAY,kCAA4B,CAAC;AACtD,eAAO,MAAM,kBAAkB,wCAAkC,CAAC;AAClE,eAAO,MAAM,oBAAoB,0CAAoC,CAAC;AACtE,eAAO,MAAM,wBAAwB,8CAAwC,CAAC;AAC9E,eAAO,MAAM,oBAAoB,0CAAoC,CAAC;AACtE,eAAO,MAAM,iBAAiB,uCAAiC,CAAC;AAChE,eAAO,MAAM,iBAAiB,eAAiC,CAAC;AAEhE,eAAO,MAAM,iBAAiB,wCAAkC,CAAC;AACjE,eAAO,MAAM,eAAe,sCAAgC,CAAC;AAC7D,eAAO,MAAM,gBAAgB,uCAAiC,CAAC;AAC/D,eAAO,MAAM,gBAAgB,uCAAiC,CAAC;AAC/D,eAAO,MAAM,YAAY,mCAA6B,CAAC;AACvD,eAAO,MAAM,qBAAqB,4CAAsC,CAAC;AACzE,eAAO,MAAM,gBAAgB,uCAAiC,CAAC;AAC/D,eAAO,MAAM,YAAY,mCAA6B,CAAC;AACvD,eAAO,MAAM,mBAAmB,0CAAoC,CAAC;AACrE,eAAO,MAAM,2BAA2B,kDAA4C,CAAC;AACrF,eAAO,MAAM,gBAAgB,uCAAiC,CAAC;AAC/D,eAAO,MAAM,mBAAmB,0CAAoC,CAAC;AAIrE,OAAO,KAAK,EACV,eAAe,EACf,mBAAmB,EACnB,cAAc,EACd,qBAAqB,EACrB,aAAa,EACb,cAAc,EACf,MAAM,YAAY,CAAC;AAEpB,YAAY,EACV,eAAe,EACf,qBAAqB,EACrB,aAAa,EACb,cAAc,GACf,CAAC;AAIF,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,UAAU,CAAC,OAAO,uBAAuB,CAAC,CAAC;CACpD;AAED,MAAM,WAAW,YAAY;IAC3B,aAAa,EAAE,aAAa,CAAC;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,EAAE,MAAM,CAAC;IACtB,oBAAoB,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAClC,WAAW,EAAE,mBAAmB,CAAC;IACjC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IACtC,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACzF,OAAO,EAAE,GAAG,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC;IACzC,QAAQ,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC;IACzB,QAAQ,EAAE,eAAe,EAAE,CAAC;IAC5B,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IACzC,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE,iBAAiB,EAAE,CAAC,CAAC;IAChD,eAAe,EAAE,GAAG,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAAC;IACrD,yBAAyB,EAAE,sBAAsB,CAAC;IAClD,WAAW,EAAE,aAAa,CAAC;IAC3B,QAAQ,EAAE,iBAAiB,CAAC;IAC5B,WAAW,EAAE,UAAU,CAAC,OAAO,mBAAmB,CAAC,CAAC;IACpD,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,kBAAkB,EAAE,OAAO,GAAG,SAAS,CAAC;IACxC,aAAa,EAAE,OAAO,GAAG,SAAS,CAAC;IACnC,uBAAuB,EAAE,CACvB,GAAG,EAAE,IAAI,CAAC,eAAe,EACzB,UAAU,EAAE,MAAM,KACf,yBAAyB,CAAC;IAC/B,iBAAiB,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,sBAAsB,CAAC;IAClE,uEAAuE;IACvE,aAAa,CAAC,EAAE,CAAC,MAAM,UAAU,CAAC,QAAQ,CAAC,CAAC,YAAY,CAAC,GAAG,SAAS,CAAC,GAAG,SAAS,CAAC;IACnF,kEAAkE;IAClE,cAAc,CAAC,EAAE,OAAO,qBAAqB,EAAE,oBAAoB,GAAG,SAAS,CAAC;CACjF;AAID;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,YAAY,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,eAAe,EAAE,GAAG,EAAE,IAAI,CAAC,cAAc,KAAK,OAAO,CAAC,IAAI,CAAC,CAgRzH"}

package/dist/hq-server/snapshot.d.ts

@@ -15,6 +15,50 @@ export declare const HQ_SNAPSHOT_BROADCAST_DEBOUNCE_MS = 100;
  * the dashboard — from doing a full rebuild + atomic disk write at up to 10 Hz.
  */
 export declare const HQ_SNAPSHOT_PERSIST_MIN_INTERVAL_MS = 3000;
+/** Unsent bytes retained for one dashboard socket before it is disconnected. */
+export declare const HQ_BROWSER_MAX_BUFFERED_BYTES: number;
+/**
+ * Send an already-serialized frame to a WebSocket peer, enforcing
+ * per-client backpressure.
+ *
+ * A `readyState === OPEN` check alone says the socket is connected, not that
+ * anyone is reading it. `ws` buffers whatever it cannot flush, so a tab that
+ * stalled — backgrounded, throttled, paused in devtools — makes this process
+ * retain every subsequent broadcast for it. These are full fleet snapshots,
+ * historically as large as 9 MB each, which is the difference between a
+ * bounded cost and an unbounded one.
+ *
+ * Mirrors `sendSerialized` in `@wrongstack/webui-server`, deliberately
+ * duplicated rather than imported: HQ's snapshot path is in the CLI's
+ * always-loaded graph, and a static import would drag that whole package into
+ * boot, which the CLI keeps behind a lazy import on purpose.
+ */
+export declare function sendGuarded(ws: WebSocket, data: string): boolean;
+/**
+ * How long a session/fleet snapshot may go unrefreshed before it is treated
+ * as gone.
+ *
+ * `session.ended` is the only thing that used to remove these entries, so any
+ * session that died without sending one — crash, SIGKILL, dropped network,
+ * closed laptop — stayed in its client's map for as long as the socket lived.
+ * That is both retained memory and, worse, permanent weight in every
+ * `buildSnapshot()` broadcast to every browser.
+ *
+ * A live session republishes unconditionally every 2.5s (`session-bridge.ts`
+ * forces the snapshot on a timer, bypassing its own dedupe hash), so
+ * `receivedAt` is a true liveness signal rather than a change signal. Five
+ * minutes is 120 consecutive missed publishes — far past any GC pause,
+ * scheduler stall, or transient hiccup, so this never evicts a live session.
+ */
+export declare const HQ_STALE_SNAPSHOT_MS: number;
+/**
+ * Drop session/fleet/MCP entries whose publisher has stopped refreshing them.
+ *
+ * Runs from `buildSnapshot` because that is exactly the moment stale entries
+ * would otherwise be serialized into a broadcast — no separate timer to own,
+ * and no window where a reaped entry is still visible to a reader.
+ */
+export declare function reapStaleClientState(clients: Map<WebSocket, ConnectedClient>, nowMs?: number): void;
 export declare function buildSnapshot(clients: Map<WebSocket, ConnectedClient>, options?: {
     tokenStats?: HqSnapshot['totals']['tokenStats'];
 }): HqSnapshot;

package/dist/hq-server/snapshot.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"snapshot.d.ts","sourceRoot":"","sources":["../../src/hq-server/snapshot.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAwD,mBAAmB,EAAE,eAAe,EAA0H,aAAa,EAA+D,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACtV,OAAO,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC;AAC/B,OAAO,KAAK,EAAE,eAAe,EAAE,qBAAqB,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAKxF,eAAO,MAAM,iCAAiC,MAAM,CAAC;AACrD;;;;;;GAMG;AACH,eAAO,MAAM,mCAAmC,OAAQ,CAAC;AAIzD,wBAAgB,aAAa,CAC3B,OAAO,EAAE,GAAG,CAAC,SAAS,EAAE,eAAe,CAAC,EACxC,OAAO,CAAC,EAAE;IAAE,UAAU,CAAC,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,YAAY,CAAC,CAAA;CAAE,GAC5D,UAAU,CAySZ;AAID,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,GAAG,CAAC,SAAS,EAAE,eAAe,CAAC,EACxC,QAAQ,EAAE,GAAG,CAAC,SAAS,CAAC,EACxB,WAAW,CAAC,EAAE,aAAa,GAC1B,qBAAqB,CA+DvB;AAID,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,GAAG,CAAC,SAAS,EAAE,eAAe,CAAC,EACxC,SAAS,EAAE,MAAM,GAChB,aAAa,GAAG,IAAI,CAqDtB;AAID,wBAAgB,cAAc,CAAC,KAAK,EAAE,eAAe,EAAE,QAAQ,EAAE,GAAG,CAAC,SAAS,CAAC,GAAG,IAAI,CAMrF;AAED,8EAA8E;AAC9E,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,mBAAmB,EAC5B,QAAQ,EAAE,GAAG,CAAC,SAAS,CAAC,GACvB,IAAI,CAKN"}
+{"version":3,"file":"snapshot.d.ts","sourceRoot":"","sources":["../../src/hq-server/snapshot.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAIV,mBAAmB,EACnB,eAAe,EAOf,aAAa,EAIb,UAAU,EACX,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC;AAC/B,OAAO,KAAK,EAAE,eAAe,EAAE,qBAAqB,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAKxF,eAAO,MAAM,iCAAiC,MAAM,CAAC;AACrD;;;;;;GAMG;AACH,eAAO,MAAM,mCAAmC,OAAQ,CAAC;AAEzD,gFAAgF;AAChF,eAAO,MAAM,6BAA6B,QAAmB,CAAC;AAE9D;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,WAAW,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAqBhE;AAED;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,oBAAoB,QAAa,CAAC;AAE/C;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,GAAG,CAAC,SAAS,EAAE,eAAe,CAAC,EACxC,KAAK,GAAE,MAAmB,GACzB,IAAI,CAgBN;AAID,wBAAgB,aAAa,CAC3B,OAAO,EAAE,GAAG,CAAC,SAAS,EAAE,eAAe,CAAC,EACxC,OAAO,CAAC,EAAE;IAAE,UAAU,CAAC,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,YAAY,CAAC,CAAA;CAAE,GAC5D,UAAU,CA0SZ;AAID,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,GAAG,CAAC,SAAS,EAAE,eAAe,CAAC,EACxC,QAAQ,EAAE,GAAG,CAAC,SAAS,CAAC,EACxB,WAAW,CAAC,EAAE,aAAa,GAC1B,qBAAqB,CAgEvB;AAID,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,GAAG,CAAC,SAAS,EAAE,eAAe,CAAC,EACxC,SAAS,EAAE,MAAM,GAChB,aAAa,GAAG,IAAI,CAqDtB;AAID,wBAAgB,cAAc,CAAC,KAAK,EAAE,eAAe,EAAE,QAAQ,EAAE,GAAG,CAAC,SAAS,CAAC,GAAG,IAAI,CAIrF;AAED,8EAA8E;AAC9E,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,mBAAmB,EAC5B,QAAQ,EAAE,GAAG,CAAC,SAAS,CAAC,GACvB,IAAI,CAGN"}

package/dist/hq-server/types.d.ts

@@ -3,10 +3,9 @@
  *
  * @module hq-server/types
  */
+import type { HqAlertRuleConfig, HqBrowserMessage, HqClientCapability, HqClientRecord, HqEventEnvelope, HqFleetSnapshotPayload, HqMailboxSnapshotPayload, HqMcpServerHealth, HqPersistence, HqProjectIdentity, HqProjectRecord, HqQueuedCommand, HqRedactionPolicy, HqSessionSnapshotPayload, HqToken, HqTranscriptEntry } from '@wrongstack/core/hq';
 import type { WebSocket } from 'ws';
-import type { HqClientCapability, HqAlertRuleConfig, HqClientRecord, HqEventEnvelope, HqFleetSnapshotPayload, HqMailboxSnapshotPayload, HqMcpServerHealth, HqPersistence, HqProjectIdentity, HqProjectRecord, HqQueuedCommand, HqRedactionPolicy, HqSessionSnapshotPayload, HqToken, HqTranscriptEntry } from '@wrongstack/core/hq';
-import type { HqBrowserMessage } from '@wrongstack/core/hq';
-export type { HqClientCapability, HqClientRecord, HqEventEnvelope, HqFleetSnapshotPayload, HqMailboxSnapshotPayload, HqMcpServerHealth, HqPersistence, HqProjectIdentity, HqProjectRecord, HqQueuedCommand, HqRedactionPolicy, HqSessionSnapshotPayload, HqToken, HqTranscriptEntry, HqBrowserMessage, };
+export type { HqBrowserMessage, HqClientCapability, HqClientRecord, HqEventEnvelope, HqFleetSnapshotPayload, HqMailboxSnapshotPayload, HqMcpServerHealth, HqPersistence, HqProjectIdentity, HqProjectRecord, HqQueuedCommand, HqRedactionPolicy, HqSessionSnapshotPayload, HqToken, HqTranscriptEntry, };
 export interface TrackedSessionSnapshot {
     payload: HqSessionSnapshotPayload;
     /** Epoch ms of the last `session.snapshot` refresh — freshness authority for the cleanup timer. */
@@ -45,7 +44,10 @@ export interface ConnectedClient {
     /** Per-client coordinator fleet snapshots, keyed by runId and owned by a session when known. */
     fleets: Map<string, TrackedFleetSnapshot>;
     /** Per-session MCP health snapshots, keyed by sessionId. */
-    mcpSnapshots: Map<string, HqMcpServerHealth[]>;
+    mcpSnapshots: Map<string, {
+        servers: HqMcpServerHealth[];
+        receivedAt: number;
+    }>;
     /** Pending outbound commands (Phase 3 — control plane). */
     commandQueue: HqQueuedCommand[];
 }
@@ -63,6 +65,22 @@ export interface HqRouterMutableAuth {
     cookieSecret?: string | undefined;
     alertRules: HqAlertRuleConfig | undefined;
 }
+/**
+ * Session record stored in the server-side `sessions` Map.
+ *
+ * - `kind: 'password'` — created by `/api/login`; full browser access.
+ * - `kind: 'token'` — created by `/api/auth/bootstrap`; scoped to the
+ *   originating browser token's ID and capabilities so revocation/expiry
+ *   of that token invalidates the session too.
+ */
+export interface HqSessionEntry {
+    readonly createdAt: number;
+    readonly kind: 'password' | 'token';
+    /** For token sessions: the browser-token ID this session was minted from. */
+    readonly tokenId?: string | undefined;
+    /** For token sessions: capabilities inherited from the source token. */
+    readonly capabilities?: string[] | undefined;
+}
 export interface TranscriptRing {
     entries: HqTranscriptEntry[];
     machineId?: string;

package/dist/hq-server/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/hq-server/types.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC;AACpC,OAAO,KAAK,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,cAAc,EAAE,eAAe,EAAE,sBAAsB,EAAE,wBAAwB,EAAE,iBAAiB,EAAE,aAAa,EAAE,iBAAiB,EAAE,eAAe,EAAE,eAAe,EAAE,iBAAiB,EAAE,wBAAwB,EAAE,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACpU,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAE5D,YAAY,EACV,kBAAkB,EAClB,cAAc,EACd,eAAe,EACf,sBAAsB,EACtB,wBAAwB,EACxB,iBAAiB,EACjB,aAAa,EACb,iBAAiB,EACjB,eAAe,EACf,eAAe,EACf,iBAAiB,EACjB,wBAAwB,EACxB,OAAO,EACP,iBAAiB,EACjB,gBAAgB,GACjB,CAAC;AAIF,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,wBAAwB,CAAC;IAClC,mGAAmG;IACnG,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,sBAAsB,CAAC;IAChC,uDAAuD;IACvD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,SAAS,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,iBAAiB,CAAC;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IAChC,0EAA0E;IAC1E,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,kFAAkF;IAClF,uBAAuB,EAAE,iBAAiB,CAAC;IAC3C,uEAAuE;IACvE,YAAY,EAAE,MAAM,CAAC;IACrB,kEAAkE;IAClE,SAAS,EAAE,GAAG,CAAC,MAAM,EAAE,wBAAwB,CAAC,CAAC;IACjD,sEAAsE;IACtE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,kEAAkE;IAClE,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAAC;IAC9C,gGAAgG;IAChG,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;IAC1C,4DAA4D;IAC5D,YAAY,EAAE,GAAG,CAAC,MAAM,EAAE,iBAAiB,EAAE,CAAC,CAAC;IAC/C,2DAA2D;IAC3D,YAAY,EAAE,eAAe,EAAE,CAAC;CACjC;AAED,MAAM,WAAW,mBAAmB;IAClC,cAAc,EAAE,iBAAiB,CAAC;IAClC,sBAAsB,EAAE,OAAO,CAAC,iBAAiB,CAAC,GAAG,SAAS,CAAC;IAC/D,aAAa,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC3B,YAAY,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC1B,gBAAgB,EAAE,GAAG,CAAC,MAAM,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAC;IACvE,eAAe,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACtC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,UAAU,EAAE,iBAAiB,GAAG,SAAS,CAAC;CAC3C;AAID,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,iBAAiB,EAAE,CAAC;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAID,MAAM,WAAW,qBAAqB;IACpC,iBAAiB,IAAI,MAAM,CAAC;IAC5B,SAAS,IAAI,IAAI,CAAC;IAClB,KAAK,IAAI,IAAI,CAAC;CACf;AAID,MAAM,WAAW,aAAa;IAC5B,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,eAAe,CAAC;IACzB,OAAO,EAAE,SAAS,cAAc,EAAE,CAAC;IACnC,SAAS,EAAE,SAAS,wBAAwB,EAAE,CAAC;CAChD"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/hq-server/types.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EACV,iBAAiB,EACjB,gBAAgB,EAChB,kBAAkB,EAClB,cAAc,EACd,eAAe,EACf,sBAAsB,EACtB,wBAAwB,EACxB,iBAAiB,EACjB,aAAa,EACb,iBAAiB,EACjB,eAAe,EACf,eAAe,EACf,iBAAiB,EACjB,wBAAwB,EACxB,OAAO,EACP,iBAAiB,EAClB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC;AAEpC,YAAY,EACV,gBAAgB,EAChB,kBAAkB,EAClB,cAAc,EACd,eAAe,EACf,sBAAsB,EACtB,wBAAwB,EACxB,iBAAiB,EACjB,aAAa,EACb,iBAAiB,EACjB,eAAe,EACf,eAAe,EACf,iBAAiB,EACjB,wBAAwB,EACxB,OAAO,EACP,iBAAiB,GAClB,CAAC;AAIF,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,wBAAwB,CAAC;IAClC,mGAAmG;IACnG,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,sBAAsB,CAAC;IAChC,uDAAuD;IACvD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,SAAS,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,iBAAiB,CAAC;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IAChC,0EAA0E;IAC1E,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,kFAAkF;IAClF,uBAAuB,EAAE,iBAAiB,CAAC;IAC3C,uEAAuE;IACvE,YAAY,EAAE,MAAM,CAAC;IACrB,kEAAkE;IAClE,SAAS,EAAE,GAAG,CAAC,MAAM,EAAE,wBAAwB,CAAC,CAAC;IACjD,sEAAsE;IACtE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,kEAAkE;IAClE,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAAC;IAC9C,gGAAgG;IAChG,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;IAC1C,4DAA4D;IAC5D,YAAY,EAAE,GAAG,CAAC,MAAM,EAAE;QAAE,OAAO,EAAE,iBAAiB,EAAE,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAChF,2DAA2D;IAC3D,YAAY,EAAE,eAAe,EAAE,CAAC;CACjC;AAED,MAAM,WAAW,mBAAmB;IAClC,cAAc,EAAE,iBAAiB,CAAC;IAClC,sBAAsB,EAAE,OAAO,CAAC,iBAAiB,CAAC,GAAG,SAAS,CAAC;IAC/D,aAAa,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC3B,YAAY,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC1B,gBAAgB,EAAE,GAAG,CAAC,MAAM,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAC;IACvE,eAAe,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACtC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,UAAU,EAAE,iBAAiB,GAAG,SAAS,CAAC;CAC3C;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC;IACpC,6EAA6E;IAC7E,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC,wEAAwE;IACxE,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;CAC9C;AAID,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,iBAAiB,EAAE,CAAC;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAID,MAAM,WAAW,qBAAqB;IACpC,iBAAiB,IAAI,MAAM,CAAC;IAC5B,SAAS,IAAI,IAAI,CAAC;IAClB,KAAK,IAAI,IAAI,CAAC;CACf;AAID,MAAM,WAAW,aAAa;IAC5B,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,eAAe,CAAC;IACzB,OAAO,EAAE,SAAS,cAAc,EAAE,CAAC;IACnC,SAAS,EAAE,SAAS,wBAAwB,EAAE,CAAC;CAChD"}

package/dist/hq-server/utils.d.ts

@@ -43,6 +43,14 @@ export declare function displayHost(host: string): string;
 export declare function readRequestBody(req: http.IncomingMessage, maxBytes?: number): Promise<string>;
 export declare function writeInvalidBody(res: http.ServerResponse, error: unknown): void;
 export declare function buildHttpUrl(host: string, port: number, token?: string): string;
+/**
+ * Build the browser startup URL with a one-time bootstrap code in the
+ * fragment (`#bootstrap=…`). Fragments never reach HTTP access logs,
+ * Referer headers, or proxy caches — unlike query-string tokens. The
+ * SPA extracts the fragment, POSTs it to `/api/auth/bootstrap`, and
+ * receives only an HttpOnly session cookie.
+ */
+export declare function buildBootstrapHttpUrl(host: string, port: number, bootstrapCode: string): string;
 export declare function buildClientWsUrl(host: string, port: number, token?: string): string;
 export declare function hqRuntimeMarkerPath(dataDir: string): string;
 /** Non-internal IPv4 addresses, so we can print URLs reachable from other machines. */

package/dist/hq-server/utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../../src/hq-server/utils.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,KAAK,KAAK,IAAI,MAAM,WAAW,CAAC;AAGvC,OAAO,KAAK,EAAE,eAAe,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAK7F,eAAO,MAAM,mBAAmB,OAAO,CAAC;AACxC,eAAO,MAAM,uBAAuB,MAAM,CAAC;AAC3C,eAAO,MAAM,eAAe,MAAM,CAAC;AAInC;;;GAGG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI,CAMxE;AAID;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAEjF;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,iBAAiB,CAmBjF;AAED;;;;;;;GAOG;AACH,wBAAsB,2BAA2B,CAC/C,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,iBAAiB,EAAE,GAAG,IAAI,CAAC,CA2BrC;AAID,2DAA2D;AAC3D,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAM9D;AAED,qFAAqF;AACrF,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEhD;AAMD,gFAAgF;AAChF,wBAAgB,eAAe,CAAC,GAAG,EAAE,IAAI,CAAC,eAAe,EAAE,QAAQ,SAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CAuBhG;AAED,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,IAAI,CAAC,cAAc,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI,CAI/E;AAID,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAI/E;AAED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAInF;AAID,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAE3D;AAID,uFAAuF;AACvF,wBAAgB,gBAAgB,IAAI,MAAM,EAAE,CAa3C;AAID,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAIvF;AAID;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,EAAE,SAAS,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAGhG;AAID;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,WAAW,EAAE,aAAa,EAAE,KAAK,EAAE,eAAe,GAAG,IAAI,CA+B/F;AAID;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,CAerD"}
+{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../../src/hq-server/utils.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,KAAK,KAAK,IAAI,MAAM,WAAW,CAAC;AAGvC,OAAO,KAAK,EAAE,eAAe,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAK7F,eAAO,MAAM,mBAAmB,OAAO,CAAC;AACxC,eAAO,MAAM,uBAAuB,MAAM,CAAC;AAC3C,eAAO,MAAM,eAAe,MAAM,CAAC;AAInC;;;GAGG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI,CAMxE;AAID;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAEjF;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,iBAAiB,CAmBjF;AAED;;;;;;;GAOG;AACH,wBAAsB,2BAA2B,CAC/C,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,iBAAiB,EAAE,GAAG,IAAI,CAAC,CA2BrC;AAID,2DAA2D;AAC3D,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAM9D;AAED,qFAAqF;AACrF,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEhD;AAMD,gFAAgF;AAChF,wBAAgB,eAAe,CAAC,GAAG,EAAE,IAAI,CAAC,eAAe,EAAE,QAAQ,SAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CAuBhG;AAED,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,IAAI,CAAC,cAAc,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI,CAI/E;AAID,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAI/E;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,MAAM,CAI/F;AAED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAInF;AAID,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAE3D;AAID,uFAAuF;AACvF,wBAAgB,gBAAgB,IAAI,MAAM,EAAE,CAa3C;AAID,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAIvF;AAID;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,EAAE,SAAS,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAGhG;AAID;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,WAAW,EAAE,aAAa,EAAE,KAAK,EAAE,eAAe,GAAG,IAAI,CA+B/F;AAID;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,CAerD"}

package/dist/hq-server/ws.d.ts

@@ -3,8 +3,8 @@
  *
  * @module hq-server/ws
  */
-import { WebSocket } from 'ws';
 import type { HqCommandAuditLog, HqEventEnvelope, HqPersistence, HqRedactionPolicy, HqToken, HqTranscriptEntry } from '@wrongstack/core/hq';
+import { WebSocket } from 'ws';
 import type { ConnectedClient, HqSnapshotBroadcaster, TranscriptRing } from './types.js';
 export declare function handleBrowser(ws: WebSocket, snapshotBroadcaster: HqSnapshotBroadcaster, browsers: Set<WebSocket>): void;
 export declare function handleClient(ws: WebSocket, clients: Map<WebSocket, ConnectedClient>, browsers: Set<WebSocket>, eventLog: HqEventEnvelope[], auth: {

package/dist/hq-server/ws.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ws.d.ts","sourceRoot":"","sources":["../../src/hq-server/ws.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC;AAE/B,OAAO,KAAK,EAAE,iBAAiB,EAAE,eAAe,EAAgI,aAAa,EAAmB,iBAAiB,EAAmD,OAAO,EAA6B,iBAAiB,EAAoB,MAAM,qBAAqB,CAAC;AACzX,OAAO,KAAK,EAAE,eAAe,EAAE,qBAAqB,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAmBzF,wBAAgB,aAAa,CAC3B,EAAE,EAAE,SAAS,EACb,mBAAmB,EAAE,qBAAqB,EAC1C,QAAQ,EAAE,GAAG,CAAC,SAAS,CAAC,GACvB,IAAI,CAsBN;AAID,wBAAgB,YAAY,CAC1B,EAAE,EAAE,SAAS,EACb,OAAO,EAAE,GAAG,CAAC,SAAS,EAAE,eAAe,CAAC,EACxC,QAAQ,EAAE,GAAG,CAAC,SAAS,CAAC,EACxB,QAAQ,EAAE,eAAe,EAAE,EAC3B,IAAI,EAAE;IACJ,KAAK,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC5B,iBAAiB,EAAE,MAAM,OAAO,CAAC,iBAAiB,CAAC,GAAG,SAAS,CAAC;CACjE,EACD,mBAAmB,EAAE,qBAAqB,EAC1C,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,EACxC,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE,iBAAiB,EAAE,CAAC,EAC/C,WAAW,CAAC,EAAE,aAAa,EAC3B,QAAQ,CAAC,EAAE,iBAAiB,GAC3B,IAAI,CA0dN"}
+{"version":3,"file":"ws.d.ts","sourceRoot":"","sources":["../../src/hq-server/ws.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,KAAK,EACV,iBAAiB,EACjB,eAAe,EAMf,aAAa,EAEb,iBAAiB,EAGjB,OAAO,EAEP,iBAAiB,EAElB,MAAM,qBAAqB,CAAC;AAW7B,OAAO,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC;AAE/B,OAAO,KAAK,EAAE,eAAe,EAAE,qBAAqB,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAkBzF,wBAAgB,aAAa,CAC3B,EAAE,EAAE,SAAS,EACb,mBAAmB,EAAE,qBAAqB,EAC1C,QAAQ,EAAE,GAAG,CAAC,SAAS,CAAC,GACvB,IAAI,CAsBN;AAID,wBAAgB,YAAY,CAC1B,EAAE,EAAE,SAAS,EACb,OAAO,EAAE,GAAG,CAAC,SAAS,EAAE,eAAe,CAAC,EACxC,QAAQ,EAAE,GAAG,CAAC,SAAS,CAAC,EACxB,QAAQ,EAAE,eAAe,EAAE,EAC3B,IAAI,EAAE;IACJ,KAAK,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC5B,iBAAiB,EAAE,MAAM,OAAO,CAAC,iBAAiB,CAAC,GAAG,SAAS,CAAC;CACjE,EACD,mBAAmB,EAAE,qBAAqB,EAC1C,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,EACxC,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE,iBAAiB,EAAE,CAAC,EAC/C,WAAW,CAAC,EAAE,aAAa,EAC3B,QAAQ,CAAC,EAAE,iBAAiB,GAC3B,IAAI,CA0dN"}

package/dist/{hq-server-FJOVOERO.js → hq-server-6AQ3BXZA.js}

@@ -15,7 +15,7 @@ import {
   readLocalSubagentTranscript,
   sanitizeApiError,
   startHqServer
-} from "./chunk-X5DQTPXT.js";
+} from "./chunk-OI7GWJDS.js";
 import "./chunk-Q5GTM25S.js";
 import "./chunk-7OCVIDC7.js";
 export {
@@ -36,4 +36,4 @@ export {
   sanitizeApiError,
   startHqServer
 };
-//# sourceMappingURL=hq-server-FJOVOERO.js.map
+//# sourceMappingURL=hq-server-6AQ3BXZA.js.map

package/dist/hq-server.d.ts

@@ -9,10 +9,10 @@
  */
 import { type TrustBoundary } from '@wrongstack/core/security';
 import { HQ_HTML } from './hq-recovery-html.js';
-import { readLocalSubagentTranscript, agentRingKey, agentMessageToEntry, decodePathSegment, sanitizeApiError } from './hq-server/routes.js';
+import { agentMessageToEntry, agentRingKey, decodePathSegment, readLocalSubagentTranscript, sanitizeApiError } from './hq-server/routes.js';
 import type { ConnectedClient, TranscriptRing } from './hq-server/types.js';
-export type { ConnectedClient, TranscriptRing };
 export { HqInsecureExposureError } from '@wrongstack/core/hq';
+export type { ConnectedClient, TranscriptRing };
 export { HQ_HTML };
 export declare const DEFAULT_HOST = "127.0.0.1";
 export declare const DEFAULT_PORT = 3499;
@@ -22,7 +22,7 @@ export declare const CLIENT_TTL_MS = 60000;
 export declare const CLIENT_CLEANUP_INTERVAL_MS = 30000;
 export declare const BROWSER_HEARTBEAT_INTERVAL_MS = 15000;
 export declare const SESSION_SNAPSHOT_TTL_MS = 30000;
-export { readLocalSubagentTranscript, decodePathSegment, sanitizeApiError, agentRingKey, agentMessageToEntry, };
+export { agentMessageToEntry, agentRingKey, decodePathSegment, readLocalSubagentTranscript, sanitizeApiError, };
 export interface HqServerOptions {
     /** Policy authority for control-plane command enqueue decisions. */
     trustBoundary?: TrustBoundary | undefined;

package/dist/hq-server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"hq-server.d.ts","sourceRoot":"","sources":["../src/hq-server.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAQH,OAAO,EAAoC,KAAK,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAWjG,OAAO,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AAIhD,OAAO,EAYL,2BAA2B,EAC3B,YAAY,EACZ,mBAAmB,EACnB,iBAAiB,EACjB,gBAAgB,EACjB,MAAM,uBAAuB,CAAC;AAS/B,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC5E,YAAY,EAAE,eAAe,EAAE,cAAc,EAAE,CAAC;AAEhD,OAAO,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AAI9D,OAAO,EAAE,OAAO,EAAE,CAAC;AACnB,eAAO,MAAM,YAAY,cAAc,CAAC;AACxC,eAAO,MAAM,YAAY,OAAO,CAAC;AACjC,eAAO,MAAM,aAAa,OAAO,CAAC;AAClC,eAAO,MAAM,wBAAwB,KAAK,CAAC;AAC3C,eAAO,MAAM,aAAa,QAAS,CAAC;AACpC,eAAO,MAAM,0BAA0B,QAAS,CAAC;AACjD,eAAO,MAAM,6BAA6B,QAAS,CAAC;AACpD,eAAO,MAAM,uBAAuB,QAAS,CAAC;AAE9C,OAAO,EACL,2BAA2B,EAC3B,iBAAiB,EACjB,gBAAgB,EAChB,YAAY,EACZ,mBAAmB,GACpB,CAAC;AAIF,MAAM,WAAW,eAAe;IAC9B,oEAAoE;IACpE,aAAa,CAAC,EAAE,aAAa,GAAG,SAAS,CAAC;IAC1C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,0BAA0B,CAAC,EAAE,MAAM,CAAC;IACpC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B;;;;;;;;;OASG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE;QACT,iBAAiB,EAAE,MAAM,CAAC;QAC1B,mBAAmB,CAAC,EAAE,MAAM,CAAC;KAC9B,CAAC;IACF,WAAW,EAAE,OAAO,CAAC;IACrB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,YAAY,EAAE,OAAO,CAAC;CACvB;AAED,MAAM,MAAM,eAAe,GAAG,uBAAuB,CAAC;AAEtD,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,CAAC,EAAE,eAAe,CAAC;IAChC,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACxC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAID,wBAAsB,aAAa,CAAC,OAAO,GAAE,eAAoB,GAAG,OAAO,CAAC,cAAc,CAAC,CAM1F"}
+{"version":3,"file":"hq-server.d.ts","sourceRoot":"","sources":["../src/hq-server.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAgCH,OAAO,EAAoC,KAAK,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAEjG,OAAO,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AAIhD,OAAO,EACL,mBAAmB,EACnB,YAAY,EAMZ,iBAAiB,EASjB,2BAA2B,EAC3B,gBAAgB,EACjB,MAAM,uBAAuB,CAAC;AAO/B,OAAO,KAAK,EAAE,eAAe,EAAkB,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAG5F,OAAO,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AAC9D,YAAY,EAAE,eAAe,EAAE,cAAc,EAAE,CAAC;AAIhD,OAAO,EAAE,OAAO,EAAE,CAAC;AACnB,eAAO,MAAM,YAAY,cAAc,CAAC;AACxC,eAAO,MAAM,YAAY,OAAO,CAAC;AACjC,eAAO,MAAM,aAAa,OAAO,CAAC;AAClC,eAAO,MAAM,wBAAwB,KAAK,CAAC;AAC3C,eAAO,MAAM,aAAa,QAAS,CAAC;AACpC,eAAO,MAAM,0BAA0B,QAAS,CAAC;AACjD,eAAO,MAAM,6BAA6B,QAAS,CAAC;AACpD,eAAO,MAAM,uBAAuB,QAAS,CAAC;AAE9C,OAAO,EACL,mBAAmB,EACnB,YAAY,EACZ,iBAAiB,EACjB,2BAA2B,EAC3B,gBAAgB,GACjB,CAAC;AAIF,MAAM,WAAW,eAAe;IAC9B,oEAAoE;IACpE,aAAa,CAAC,EAAE,aAAa,GAAG,SAAS,CAAC;IAC1C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,0BAA0B,CAAC,EAAE,MAAM,CAAC;IACpC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B;;;;;;;;;OASG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE;QACT,iBAAiB,EAAE,MAAM,CAAC;QAC1B,mBAAmB,CAAC,EAAE,MAAM,CAAC;KAC9B,CAAC;IACF,WAAW,EAAE,OAAO,CAAC;IACrB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,YAAY,EAAE,OAAO,CAAC;CACvB;AAED,MAAM,MAAM,eAAe,GAAG,uBAAuB,CAAC;AAEtD,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,CAAC,EAAE,eAAe,CAAC;IAChC,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACxC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAID,wBAAsB,aAAa,CAAC,OAAO,GAAE,eAAoB,GAAG,OAAO,CAAC,cAAc,CAAC,CAM1F"}

package/dist/{hq-tunnel-YZLRONPV.js → hq-tunnel-RFKGC4HI.js}

@@ -94,11 +94,14 @@ ${output.trim()}` : ""}`
     }, options.timeoutMs ?? START_TIMEOUT_MS);
   });
 }
-function buildPublicHqUrl(tunnelUrl, localBrowserUrl, includeToken) {
+function buildPublicHqUrl(tunnelUrl, localBrowserUrl, includeBootstrap) {
   const publicUrl = new URL(tunnelUrl);
-  if (includeToken && localBrowserUrl) {
-    const token = new URL(localBrowserUrl).searchParams.get("token");
-    if (token) publicUrl.searchParams.set("token", token);
+  if (includeBootstrap && localBrowserUrl) {
+    try {
+      const localHash = new URL(localBrowserUrl).hash;
+      if (localHash.startsWith("#bootstrap=")) publicUrl.hash = localHash.slice(1);
+    } catch {
+    }
   }
   return publicUrl.toString();
 }
@@ -108,4 +111,4 @@ export {
   hasRegisteredQuickTunnelConnection,
   startHqQuickTunnel
 };
-//# sourceMappingURL=hq-tunnel-YZLRONPV.js.map
+//# sourceMappingURL=hq-tunnel-RFKGC4HI.js.map

package/dist/{hq-tunnel-YZLRONPV.js.map → hq-tunnel-RFKGC4HI.js.map}

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../src/hq-tunnel.ts"],
-  "sourcesContent": ["import { type ChildProcessByStdio, spawn } from 'node:child_process';\nimport type { Readable } from 'node:stream';\n\nconst QUICK_TUNNEL_URL = /https:\\/\\/[a-z0-9-]+\\.trycloudflare\\.com\\b/i;\nconst QUICK_TUNNEL_REGISTERED = /\\bRegistered tunnel connection\\b/i;\nconst START_TIMEOUT_MS = 30_000;\nconst MAX_LOG_CHARS = 16_384;\n\nexport interface HqQuickTunnelHandle {\n  url: string;\n  close(): Promise<void>;\n}\n\nexport interface HqQuickTunnelOptions {\n  executable?: string | undefined;\n  timeoutMs?: number | undefined;\n  onUnexpectedExit?: ((message: string) => void) | undefined;\n}\n\nexport function extractQuickTunnelUrl(output: string): string | undefined {\n  return output.match(QUICK_TUNNEL_URL)?.[0];\n}\n\n/** cloudflared prints the public URL before its edge connection is usable. */\nexport function hasRegisteredQuickTunnelConnection(output: string): boolean {\n  return QUICK_TUNNEL_REGISTERED.test(output);\n}\n\nfunction tail(current: string, chunk: unknown): string {\n  return `${current}${String(chunk)}`.slice(-MAX_LOG_CHARS);\n}\n\n/** Start an anonymous TryCloudflare tunnel and tie it to the HQ process lifecycle. */\nexport function startHqQuickTunnel(\n  originUrl: string,\n  options: HqQuickTunnelOptions = {},\n): Promise<HqQuickTunnelHandle> {\n  return new Promise((resolve, reject) => {\n    const executable = options.executable ?? 'cloudflared';\n    let child: ChildProcessByStdio<null, Readable, Readable>;\n    try {\n      child = spawn(executable, ['tunnel', '--url', originUrl], {\n        stdio: ['ignore', 'pipe', 'pipe'],\n        windowsHide: true,\n      });\n    } catch (error) {\n      reject(error);\n      return;\n    }\n\n    let output = '';\n    let settled = false;\n    let closing = false;\n    let publicUrl: string | undefined;\n\n    const fail = (message: string): void => {\n      if (settled) return;\n      settled = true;\n      clearTimeout(timer);\n      if (!child.killed) child.kill();\n      reject(new Error(message));\n    };\n\n    const inspect = (chunk: unknown): void => {\n      output = tail(output, chunk);\n      if (settled) return;\n      const found = extractQuickTunnelUrl(output);\n      if (found) publicUrl = found;\n      if (!publicUrl || !hasRegisteredQuickTunnelConnection(output)) return;\n      const readyUrl = publicUrl;\n      settled = true;\n      clearTimeout(timer);\n      resolve({\n        url: readyUrl,\n        close: () =>\n          new Promise<void>((done) => {\n            if (child.exitCode !== null || child.signalCode !== null) {\n              done();\n              return;\n            }\n            closing = true;\n            const forceTimer = setTimeout(() => {\n              if (child.exitCode === null && child.signalCode === null) child.kill('SIGKILL');\n            }, 3_000);\n            child.once('exit', () => {\n              clearTimeout(forceTimer);\n              done();\n            });\n            child.kill();\n          }),\n      });\n    };\n\n    child.stdout.on('data', inspect);\n    child.stderr.on('data', inspect);\n    child.once('error', (error: NodeJS.ErrnoException) => {\n      const detail =\n        error.code === 'ENOENT'\n          ? '`cloudflared` was not found in PATH. Install Cloudflare Tunnel, then retry.'\n          : `cloudflared failed to start: ${error.message}`;\n      fail(detail);\n    });\n    child.once('exit', (code, signal) => {\n      const suffix = output.trim() ? `\\n${output.trim()}` : '';\n      if (!settled) {\n        fail(\n          `cloudflared exited before publishing a tunnel URL (code ${code ?? signal ?? 'unknown'}).${suffix}`,\n        );\n      } else if (!closing) {\n        options.onUnexpectedExit?.(\n          `Cloudflare Quick Tunnel ${publicUrl ?? ''} stopped (code ${code ?? signal ?? 'unknown'}).${suffix}`,\n        );\n      }\n    });\n\n    const timer = setTimeout(() => {\n      fail(\n        `${\n          publicUrl\n            ? 'Timed out waiting for cloudflared to register the Quick Tunnel connection.'\n            : 'Timed out waiting for a trycloudflare.com URL from cloudflared.'\n        }${output.trim() ? `\\n${output.trim()}` : ''}`,\n      );\n    }, options.timeoutMs ?? START_TIMEOUT_MS);\n  });\n}\n\nexport function buildPublicHqUrl(\n  tunnelUrl: string,\n  localBrowserUrl: string | undefined,\n  includeToken: boolean,\n): string {\n  const publicUrl = new URL(tunnelUrl);\n  if (includeToken && localBrowserUrl) {\n    const token = new URL(localBrowserUrl).searchParams.get('token');\n    if (token) publicUrl.searchParams.set('token', token);\n  }\n  return publicUrl.toString();\n}\n"],
-  "mappings": ";;;;AAAA,SAAmC,aAAa;AAGhD,IAAM,mBAAmB;AACzB,IAAM,0BAA0B;AAChC,IAAM,mBAAmB;AACzB,IAAM,gBAAgB;AAaf,SAAS,sBAAsB,QAAoC;AACxE,SAAO,OAAO,MAAM,gBAAgB,IAAI,CAAC;AAC3C;AAGO,SAAS,mCAAmC,QAAyB;AAC1E,SAAO,wBAAwB,KAAK,MAAM;AAC5C;AAEA,SAAS,KAAK,SAAiB,OAAwB;AACrD,SAAO,GAAG,OAAO,GAAG,OAAO,KAAK,CAAC,GAAG,MAAM,CAAC,aAAa;AAC1D;AAGO,SAAS,mBACd,WACA,UAAgC,CAAC,GACH;AAC9B,SAAO,IAAI,QAAQ,CAAC,SAAS,WAAW;AACtC,UAAM,aAAa,QAAQ,cAAc;AACzC,QAAI;AACJ,QAAI;AACF,cAAQ,MAAM,YAAY,CAAC,UAAU,SAAS,SAAS,GAAG;AAAA,QACxD,OAAO,CAAC,UAAU,QAAQ,MAAM;AAAA,QAChC,aAAa;AAAA,MACf,CAAC;AAAA,IACH,SAAS,OAAO;AACd,aAAO,KAAK;AACZ;AAAA,IACF;AAEA,QAAI,SAAS;AACb,QAAI,UAAU;AACd,QAAI,UAAU;AACd,QAAI;AAEJ,UAAM,OAAO,CAAC,YAA0B;AACtC,UAAI,QAAS;AACb,gBAAU;AACV,mBAAa,KAAK;AAClB,UAAI,CAAC,MAAM,OAAQ,OAAM,KAAK;AAC9B,aAAO,IAAI,MAAM,OAAO,CAAC;AAAA,IAC3B;AAEA,UAAM,UAAU,CAAC,UAAyB;AACxC,eAAS,KAAK,QAAQ,KAAK;AAC3B,UAAI,QAAS;AACb,YAAM,QAAQ,sBAAsB,MAAM;AAC1C,UAAI,MAAO,aAAY;AACvB,UAAI,CAAC,aAAa,CAAC,mCAAmC,MAAM,EAAG;AAC/D,YAAM,WAAW;AACjB,gBAAU;AACV,mBAAa,KAAK;AAClB,cAAQ;AAAA,QACN,KAAK;AAAA,QACL,OAAO,MACL,IAAI,QAAc,CAAC,SAAS;AAC1B,cAAI,MAAM,aAAa,QAAQ,MAAM,eAAe,MAAM;AACxD,iBAAK;AACL;AAAA,UACF;AACA,oBAAU;AACV,gBAAM,aAAa,WAAW,MAAM;AAClC,gBAAI,MAAM,aAAa,QAAQ,MAAM,eAAe,KAAM,OAAM,KAAK,SAAS;AAAA,UAChF,GAAG,GAAK;AACR,gBAAM,KAAK,QAAQ,MAAM;AACvB,yBAAa,UAAU;AACvB,iBAAK;AAAA,UACP,CAAC;AACD,gBAAM,KAAK;AAAA,QACb,CAAC;AAAA,MACL,CAAC;AAAA,IACH;AAEA,UAAM,OAAO,GAAG,QAAQ,OAAO;AAC/B,UAAM,OAAO,GAAG,QAAQ,OAAO;AAC/B,UAAM,KAAK,SAAS,CAAC,UAAiC;AACpD,YAAM,SACJ,MAAM,SAAS,WACX,gFACA,gCAAgC,MAAM,OAAO;AACnD,WAAK,MAAM;AAAA,IACb,CAAC;AACD,UAAM,KAAK,QAAQ,CAAC,MAAM,WAAW;AACnC,YAAM,SAAS,OAAO,KAAK,IAAI;AAAA,EAAK,OAAO,KAAK,CAAC,KAAK;AACtD,UAAI,CAAC,SAAS;AACZ;AAAA,UACE,2DAA2D,QAAQ,UAAU,SAAS,KAAK,MAAM;AAAA,QACnG;AAAA,MACF,WAAW,CAAC,SAAS;AACnB,gBAAQ;AAAA,UACN,2BAA2B,aAAa,EAAE,kBAAkB,QAAQ,UAAU,SAAS,KAAK,MAAM;AAAA,QACpG;AAAA,MACF;AAAA,IACF,CAAC;AAED,UAAM,QAAQ,WAAW,MAAM;AAC7B;AAAA,QACE,GACE,YACI,+EACA,iEACN,GAAG,OAAO,KAAK,IAAI;AAAA,EAAK,OAAO,KAAK,CAAC,KAAK,EAAE;AAAA,MAC9C;AAAA,IACF,GAAG,QAAQ,aAAa,gBAAgB;AAAA,EAC1C,CAAC;AACH;AAEO,SAAS,iBACd,WACA,iBACA,cACQ;AACR,QAAM,YAAY,IAAI,IAAI,SAAS;AACnC,MAAI,gBAAgB,iBAAiB;AACnC,UAAM,QAAQ,IAAI,IAAI,eAAe,EAAE,aAAa,IAAI,OAAO;AAC/D,QAAI,MAAO,WAAU,aAAa,IAAI,SAAS,KAAK;AAAA,EACtD;AACA,SAAO,UAAU,SAAS;AAC5B;",
+  "sourcesContent": ["import { type ChildProcessByStdio, spawn } from 'node:child_process';\nimport type { Readable } from 'node:stream';\n\nconst QUICK_TUNNEL_URL = /https:\\/\\/[a-z0-9-]+\\.trycloudflare\\.com\\b/i;\nconst QUICK_TUNNEL_REGISTERED = /\\bRegistered tunnel connection\\b/i;\nconst START_TIMEOUT_MS = 30_000;\nconst MAX_LOG_CHARS = 16_384;\n\nexport interface HqQuickTunnelHandle {\n  url: string;\n  close(): Promise<void>;\n}\n\nexport interface HqQuickTunnelOptions {\n  executable?: string | undefined;\n  timeoutMs?: number | undefined;\n  onUnexpectedExit?: ((message: string) => void) | undefined;\n}\n\nexport function extractQuickTunnelUrl(output: string): string | undefined {\n  return output.match(QUICK_TUNNEL_URL)?.[0];\n}\n\n/** cloudflared prints the public URL before its edge connection is usable. */\nexport function hasRegisteredQuickTunnelConnection(output: string): boolean {\n  return QUICK_TUNNEL_REGISTERED.test(output);\n}\n\nfunction tail(current: string, chunk: unknown): string {\n  return `${current}${String(chunk)}`.slice(-MAX_LOG_CHARS);\n}\n\n/** Start an anonymous TryCloudflare tunnel and tie it to the HQ process lifecycle. */\nexport function startHqQuickTunnel(\n  originUrl: string,\n  options: HqQuickTunnelOptions = {},\n): Promise<HqQuickTunnelHandle> {\n  return new Promise((resolve, reject) => {\n    const executable = options.executable ?? 'cloudflared';\n    let child: ChildProcessByStdio<null, Readable, Readable>;\n    try {\n      child = spawn(executable, ['tunnel', '--url', originUrl], {\n        stdio: ['ignore', 'pipe', 'pipe'],\n        windowsHide: true,\n      });\n    } catch (error) {\n      reject(error);\n      return;\n    }\n\n    let output = '';\n    let settled = false;\n    let closing = false;\n    let publicUrl: string | undefined;\n\n    const fail = (message: string): void => {\n      if (settled) return;\n      settled = true;\n      clearTimeout(timer);\n      if (!child.killed) child.kill();\n      reject(new Error(message));\n    };\n\n    const inspect = (chunk: unknown): void => {\n      output = tail(output, chunk);\n      if (settled) return;\n      const found = extractQuickTunnelUrl(output);\n      if (found) publicUrl = found;\n      if (!publicUrl || !hasRegisteredQuickTunnelConnection(output)) return;\n      const readyUrl = publicUrl;\n      settled = true;\n      clearTimeout(timer);\n      resolve({\n        url: readyUrl,\n        close: () =>\n          new Promise<void>((done) => {\n            if (child.exitCode !== null || child.signalCode !== null) {\n              done();\n              return;\n            }\n            closing = true;\n            const forceTimer = setTimeout(() => {\n              if (child.exitCode === null && child.signalCode === null) child.kill('SIGKILL');\n            }, 3_000);\n            child.once('exit', () => {\n              clearTimeout(forceTimer);\n              done();\n            });\n            child.kill();\n          }),\n      });\n    };\n\n    child.stdout.on('data', inspect);\n    child.stderr.on('data', inspect);\n    child.once('error', (error: NodeJS.ErrnoException) => {\n      const detail =\n        error.code === 'ENOENT'\n          ? '`cloudflared` was not found in PATH. Install Cloudflare Tunnel, then retry.'\n          : `cloudflared failed to start: ${error.message}`;\n      fail(detail);\n    });\n    child.once('exit', (code, signal) => {\n      const suffix = output.trim() ? `\\n${output.trim()}` : '';\n      if (!settled) {\n        fail(\n          `cloudflared exited before publishing a tunnel URL (code ${code ?? signal ?? 'unknown'}).${suffix}`,\n        );\n      } else if (!closing) {\n        options.onUnexpectedExit?.(\n          `Cloudflare Quick Tunnel ${publicUrl ?? ''} stopped (code ${code ?? signal ?? 'unknown'}).${suffix}`,\n        );\n      }\n    });\n\n    const timer = setTimeout(() => {\n      fail(\n        `${\n          publicUrl\n            ? 'Timed out waiting for cloudflared to register the Quick Tunnel connection.'\n            : 'Timed out waiting for a trycloudflare.com URL from cloudflared.'\n        }${output.trim() ? `\\n${output.trim()}` : ''}`,\n      );\n    }, options.timeoutMs ?? START_TIMEOUT_MS);\n  });\n}\n\nexport function buildPublicHqUrl(\n  tunnelUrl: string,\n  localBrowserUrl: string | undefined,\n  includeBootstrap: boolean,\n): string {\n  const publicUrl = new URL(tunnelUrl);\n  if (includeBootstrap && localBrowserUrl) {\n    // Preserve the bootstrap fragment (#bootstrap=\u2026) from the local URL so\n    // the tunnel user gets the same one-time code exchange path. Never copy\n    // query-string tokens \u2014 those are the reusable credential we are\n    // eliminating.\n    try {\n      const localHash = new URL(localBrowserUrl).hash;\n      if (localHash.startsWith('#bootstrap=')) publicUrl.hash = localHash.slice(1);\n    } catch {\n      // Malformed local URL \u2014 skip.\n    }\n  }\n  return publicUrl.toString();\n}\n"],
+  "mappings": ";;;;AAAA,SAAmC,aAAa;AAGhD,IAAM,mBAAmB;AACzB,IAAM,0BAA0B;AAChC,IAAM,mBAAmB;AACzB,IAAM,gBAAgB;AAaf,SAAS,sBAAsB,QAAoC;AACxE,SAAO,OAAO,MAAM,gBAAgB,IAAI,CAAC;AAC3C;AAGO,SAAS,mCAAmC,QAAyB;AAC1E,SAAO,wBAAwB,KAAK,MAAM;AAC5C;AAEA,SAAS,KAAK,SAAiB,OAAwB;AACrD,SAAO,GAAG,OAAO,GAAG,OAAO,KAAK,CAAC,GAAG,MAAM,CAAC,aAAa;AAC1D;AAGO,SAAS,mBACd,WACA,UAAgC,CAAC,GACH;AAC9B,SAAO,IAAI,QAAQ,CAAC,SAAS,WAAW;AACtC,UAAM,aAAa,QAAQ,cAAc;AACzC,QAAI;AACJ,QAAI;AACF,cAAQ,MAAM,YAAY,CAAC,UAAU,SAAS,SAAS,GAAG;AAAA,QACxD,OAAO,CAAC,UAAU,QAAQ,MAAM;AAAA,QAChC,aAAa;AAAA,MACf,CAAC;AAAA,IACH,SAAS,OAAO;AACd,aAAO,KAAK;AACZ;AAAA,IACF;AAEA,QAAI,SAAS;AACb,QAAI,UAAU;AACd,QAAI,UAAU;AACd,QAAI;AAEJ,UAAM,OAAO,CAAC,YAA0B;AACtC,UAAI,QAAS;AACb,gBAAU;AACV,mBAAa,KAAK;AAClB,UAAI,CAAC,MAAM,OAAQ,OAAM,KAAK;AAC9B,aAAO,IAAI,MAAM,OAAO,CAAC;AAAA,IAC3B;AAEA,UAAM,UAAU,CAAC,UAAyB;AACxC,eAAS,KAAK,QAAQ,KAAK;AAC3B,UAAI,QAAS;AACb,YAAM,QAAQ,sBAAsB,MAAM;AAC1C,UAAI,MAAO,aAAY;AACvB,UAAI,CAAC,aAAa,CAAC,mCAAmC,MAAM,EAAG;AAC/D,YAAM,WAAW;AACjB,gBAAU;AACV,mBAAa,KAAK;AAClB,cAAQ;AAAA,QACN,KAAK;AAAA,QACL,OAAO,MACL,IAAI,QAAc,CAAC,SAAS;AAC1B,cAAI,MAAM,aAAa,QAAQ,MAAM,eAAe,MAAM;AACxD,iBAAK;AACL;AAAA,UACF;AACA,oBAAU;AACV,gBAAM,aAAa,WAAW,MAAM;AAClC,gBAAI,MAAM,aAAa,QAAQ,MAAM,eAAe,KAAM,OAAM,KAAK,SAAS;AAAA,UAChF,GAAG,GAAK;AACR,gBAAM,KAAK,QAAQ,MAAM;AACvB,yBAAa,UAAU;AACvB,iBAAK;AAAA,UACP,CAAC;AACD,gBAAM,KAAK;AAAA,QACb,CAAC;AAAA,MACL,CAAC;AAAA,IACH;AAEA,UAAM,OAAO,GAAG,QAAQ,OAAO;AAC/B,UAAM,OAAO,GAAG,QAAQ,OAAO;AAC/B,UAAM,KAAK,SAAS,CAAC,UAAiC;AACpD,YAAM,SACJ,MAAM,SAAS,WACX,gFACA,gCAAgC,MAAM,OAAO;AACnD,WAAK,MAAM;AAAA,IACb,CAAC;AACD,UAAM,KAAK,QAAQ,CAAC,MAAM,WAAW;AACnC,YAAM,SAAS,OAAO,KAAK,IAAI;AAAA,EAAK,OAAO,KAAK,CAAC,KAAK;AACtD,UAAI,CAAC,SAAS;AACZ;AAAA,UACE,2DAA2D,QAAQ,UAAU,SAAS,KAAK,MAAM;AAAA,QACnG;AAAA,MACF,WAAW,CAAC,SAAS;AACnB,gBAAQ;AAAA,UACN,2BAA2B,aAAa,EAAE,kBAAkB,QAAQ,UAAU,SAAS,KAAK,MAAM;AAAA,QACpG;AAAA,MACF;AAAA,IACF,CAAC;AAED,UAAM,QAAQ,WAAW,MAAM;AAC7B;AAAA,QACE,GACE,YACI,+EACA,iEACN,GAAG,OAAO,KAAK,IAAI;AAAA,EAAK,OAAO,KAAK,CAAC,KAAK,EAAE;AAAA,MAC9C;AAAA,IACF,GAAG,QAAQ,aAAa,gBAAgB;AAAA,EAC1C,CAAC;AACH;AAEO,SAAS,iBACd,WACA,iBACA,kBACQ;AACR,QAAM,YAAY,IAAI,IAAI,SAAS;AACnC,MAAI,oBAAoB,iBAAiB;AAKvC,QAAI;AACF,YAAM,YAAY,IAAI,IAAI,eAAe,EAAE;AAC3C,UAAI,UAAU,WAAW,aAAa,EAAG,WAAU,OAAO,UAAU,MAAM,CAAC;AAAA,IAC7E,QAAQ;AAAA,IAER;AAAA,EACF;AACA,SAAO,UAAU,SAAS;AAC5B;",
   "names": []
 }

package/dist/hq-tunnel.d.ts

@@ -12,5 +12,5 @@ export declare function extractQuickTunnelUrl(output: string): string | undefine
 export declare function hasRegisteredQuickTunnelConnection(output: string): boolean;
 /** Start an anonymous TryCloudflare tunnel and tie it to the HQ process lifecycle. */
 export declare function startHqQuickTunnel(originUrl: string, options?: HqQuickTunnelOptions): Promise<HqQuickTunnelHandle>;
-export declare function buildPublicHqUrl(tunnelUrl: string, localBrowserUrl: string | undefined, includeToken: boolean): string;
+export declare function buildPublicHqUrl(tunnelUrl: string, localBrowserUrl: string | undefined, includeBootstrap: boolean): string;
 //# sourceMappingURL=hq-tunnel.d.ts.map

package/dist/hq-tunnel.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"hq-tunnel.d.ts","sourceRoot":"","sources":["../src/hq-tunnel.ts"],"names":[],"mappings":"AAQA,MAAM,WAAW,mBAAmB;IAClC,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED,MAAM,WAAW,oBAAoB;IACnC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,gBAAgB,CAAC,EAAE,CAAC,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC,GAAG,SAAS,CAAC;CAC5D;AAED,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAExE;AAED,8EAA8E;AAC9E,wBAAgB,kCAAkC,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAE1E;AAMD,sFAAsF;AACtF,wBAAgB,kBAAkB,CAChC,SAAS,EAAE,MAAM,EACjB,OAAO,GAAE,oBAAyB,GACjC,OAAO,CAAC,mBAAmB,CAAC,CAyF9B;AAED,wBAAgB,gBAAgB,CAC9B,SAAS,EAAE,MAAM,EACjB,eAAe,EAAE,MAAM,GAAG,SAAS,EACnC,YAAY,EAAE,OAAO,GACpB,MAAM,CAOR"}
+{"version":3,"file":"hq-tunnel.d.ts","sourceRoot":"","sources":["../src/hq-tunnel.ts"],"names":[],"mappings":"AAQA,MAAM,WAAW,mBAAmB;IAClC,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED,MAAM,WAAW,oBAAoB;IACnC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,gBAAgB,CAAC,EAAE,CAAC,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC,GAAG,SAAS,CAAC;CAC5D;AAED,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAExE;AAED,8EAA8E;AAC9E,wBAAgB,kCAAkC,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAE1E;AAMD,sFAAsF;AACtF,wBAAgB,kBAAkB,CAChC,SAAS,EAAE,MAAM,EACjB,OAAO,GAAE,oBAAyB,GACjC,OAAO,CAAC,mBAAmB,CAAC,CAyF9B;AAED,wBAAgB,gBAAgB,CAC9B,SAAS,EAAE,MAAM,EACjB,eAAe,EAAE,MAAM,GAAG,SAAS,EACnC,gBAAgB,EAAE,OAAO,GACxB,MAAM,CAeR"}

package/dist/index.js

@@ -22,7 +22,7 @@ import {
 } from "./chunk-TGDHN4LM.js";
 import {
   DEFAULT_PORT
-} from "./chunk-X5DQTPXT.js";
+} from "./chunk-OI7GWJDS.js";
 import "./chunk-Q5GTM25S.js";
 import {
   CLI_VERSION
@@ -1521,7 +1521,7 @@ var loaders = {
   quick: async () => (await import("./quick-VIO2BEHS.js")).quickCmd,
   bench: async () => (await import("./bench-7ZDWSNEF.js")).benchCmd,
   chronicle: async () => (await import("./chronicle-QQEQFSSE.js")).chronicleCmd,
-  hq: async () => (await import("./hq-BECGICEZ.js")).hqCmd,
+  hq: async () => (await import("./hq-JUYKUNJX.js")).hqCmd,
   mailbox: async () => (await import("./mailbox-serve-2UWHEN3M.js")).mailboxServeCmd,
   permissions: async () => (await import("./permissions-FNYLZIL4.js")).permissionsCmd,
   project: async () => (await import("./project-BLQ3ALVL.js")).projectCmd
@@ -2157,7 +2157,7 @@ async function isPortInUse(host, port) {
 }
 async function handleHqShortCircuit(flags) {
   if (flags["hq"] !== true) return null;
-  const { startHqServer } = await import("./hq-server-FJOVOERO.js");
+  const { startHqServer } = await import("./hq-server-6AQ3BXZA.js");
   const tunnelRequested = flags["tunnel"] === true;
   const host = typeof flags["host"] === "string" ? flags["host"] : tunnelRequested ? "127.0.0.1" : HQ_CLI_DEFAULT_HOST;
   if (tunnelRequested && !isLoopbackHost(host)) {
@@ -2253,7 +2253,7 @@ async function handleHqShortCircuit(flags) {
       return 1;
     }
     try {
-      const { buildPublicHqUrl, startHqQuickTunnel } = await import("./hq-tunnel-YZLRONPV.js");
+      const { buildPublicHqUrl, startHqQuickTunnel } = await import("./hq-tunnel-RFKGC4HI.js");
       const originHost = handle.host === "::1" ? "[::1]" : handle.host;
       tunnel = await startHqQuickTunnel(`http://${originHost}:${handle.port}`, {
         onUnexpectedExit: (message) => process.stderr.write(`${color8.yellow("!")} ${message}
@@ -2854,7 +2854,7 @@ async function initializeCli(argv) {
 async function main(argv) {
   const cliCtx = await initializeCli(argv);
   if (typeof cliCtx === "number") return cliCtx;
-  const { runInteractive } = await import("./cli-main-6AU6E4XZ.js");
+  const { runInteractive } = await import("./cli-main-TOAWVJDY.js");
   return runInteractive(cliCtx);
 }
 

package/dist/{sdd-runtime-IKPROVV2.js → sdd-runtime-JG4EEKL6.js}

@@ -23,7 +23,7 @@ import {
   trySaveImplementationPlan,
   trySaveSpecFromAIOutput,
   trySaveTasksFromAIOutput
-} from "./chunk-IN4GXGYW.js";
+} from "./chunk-BQCAJ7FI.js";
 import "./chunk-7OCVIDC7.js";
 export {
   SDDState,
@@ -51,4 +51,4 @@ export {
   trySaveSpecFromAIOutput,
   trySaveTasksFromAIOutput
 };
-//# sourceMappingURL=sdd-runtime-IKPROVV2.js.map
+//# sourceMappingURL=sdd-runtime-JG4EEKL6.js.map

package/dist/services/sdd/task-manager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"task-manager.d.ts","sourceRoot":"","sources":["../../../src/services/sdd/task-manager.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAoB,cAAc,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAGhF,YAAY,EAAE,YAAY,EAAE,CAAC;AAC7B,OAAO,EAAE,cAAc,EAAE,CAAC;AAE1B;;GAEG;AACH,wBAAgB,aAAa,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAUhD;AAkBD,wBAAsB,wBAAwB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAqCjF;AAED,wBAAgB,eAAe,IAAI,YAAY,GAAG,IAAI,CAIrD;AAED,wBAAgB,cAAc,IAAI;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;IACtB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;CAC/B,GAAG,IAAI,CAeP;AAED,wBAAgB,iBAAiB,IAAI,OAAO,CAW3C;AAED,wBAAgB,eAAe,IAAI,MAAM,GAAG,IAAI,CAW/C;AAED,wBAAgB,0BAA0B,IAAI,MAAM,GAAG,IAAI,CAuD1D;AAED,wBAAgB,0BAA0B,IAAI,MAAM,GAAG,IAAI,CAc1D;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,CAAC,SAAS;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,EACnE,KAAK,EAAE,CAAC,EAAE,EACV,KAAK,EAAE,MAAM,GACZ,CAAC,GAAG,IAAI,CAYV;AAED,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAY5D;AAED,wBAAgB,cAAc,IAAI,MAAM,GAAG,IAAI,CAE9C;AACD,wBAAgB,oBAAoB,IAAI,WAAW,GAAG,IAAI,CAEzD"}
+{"version":3,"file":"task-manager.d.ts","sourceRoot":"","sources":["../../../src/services/sdd/task-manager.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAoB,cAAc,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAGhF,YAAY,EAAE,YAAY,EAAE,CAAC;AAC7B,OAAO,EAAE,cAAc,EAAE,CAAC;AAE1B;;GAEG;AACH,wBAAgB,aAAa,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAUhD;AAkBD,wBAAsB,wBAAwB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CA0CjF;AAED,wBAAgB,eAAe,IAAI,YAAY,GAAG,IAAI,CAIrD;AAED,wBAAgB,cAAc,IAAI;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;IACtB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;CAC/B,GAAG,IAAI,CAeP;AAED,wBAAgB,iBAAiB,IAAI,OAAO,CAW3C;AAED,wBAAgB,eAAe,IAAI,MAAM,GAAG,IAAI,CAW/C;AAED,wBAAgB,0BAA0B,IAAI,MAAM,GAAG,IAAI,CAuD1D;AAED,wBAAgB,0BAA0B,IAAI,MAAM,GAAG,IAAI,CAc1D;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,CAAC,SAAS;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,EACnE,KAAK,EAAE,CAAC,EAAE,EACV,KAAK,EAAE,MAAM,GACZ,CAAC,GAAG,IAAI,CAYV;AAED,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAY5D;AAED,wBAAgB,cAAc,IAAI,MAAM,GAAG,IAAI,CAE9C;AACD,wBAAgB,oBAAoB,IAAI,WAAW,GAAG,IAAI,CAEzD"}

package/dist/slash-commands/settings.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"settings.d.ts","sourceRoot":"","sources":["../../src/slash-commands/settings.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAQ3D,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAGhE;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,mBAAmB,GAAG,YAAY,CAi7B5E"}
+{"version":3,"file":"settings.d.ts","sourceRoot":"","sources":["../../src/slash-commands/settings.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAsB,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAU/E,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAGhE;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,mBAAmB,GAAG,YAAY,CAuiC5E"}

package/dist/{webui-server-G3TISUIY.js → webui-server-ZF5KVGC5.js}

@@ -892,7 +892,8 @@ async function runWebUI(opts) {
         projectSddSession: specsPaths.projectSddSession,
         projectSddBoards: specsPaths.projectSddBoards
       }
-    } : void 0
+    } : void 0,
+    { trustBoundary, logger: consoleLogger }
   );
   const sddWizardHandler = opts.sddSubagentFactory && specsPaths ? new SddWizardWebSocketHandler(
     buildSddWizardDeps({
@@ -1456,4 +1457,4 @@ async function runWebUI(opts) {
 export {
   runWebUI
 };
-//# sourceMappingURL=webui-server-G3TISUIY.js.map
+//# sourceMappingURL=webui-server-ZF5KVGC5.js.map