@wrongstack/cli 1.1.2 → 1.1.5

package/dist/{hq-JD5AZVMG.js → hq-54PQYR5O.js}

@@ -7,7 +7,7 @@ import {
 import {
   normalizeHqPublicOrigin,
   resolveAuditActor
-} from "./chunk-3EXRPTAU.js";
+} from "./chunk-5TQ65PXQ.js";
 import {
   parseHqIpAllowlist
 } from "./chunk-OGVSKS4Q.js";
@@ -18,13 +18,8 @@ import {
   HQ_AUTH_FILE_VERSION,
   HQ_CLI_DEFAULT_HOST,
   HqInsecureExposureError,
-  isLoopbackHost,
-  logHqAuthAudit,
-  mintHqToken,
-  mutateHqAuthFile,
-  readHqAuthFile as readHqAuthFile2
+  isLoopbackHost
 } from "@wrongstack/core/hq";
-import { expectDefined } from "@wrongstack/core/utils";
 
 // src/subcommands/handlers/hq-alerts.ts
 import * as fs from "node:fs/promises";
@@ -297,243 +292,14 @@ function printAuditHelp(deps) {
 `);
 }
 
-// src/subcommands/handlers/hq.ts
-var hqCmd = async (args, deps) => {
-  const sub = args[0];
-  if (deps.flags?.["help"] === true && (!sub || sub === "serve")) {
-    printHelp(deps);
-    return 0;
-  }
-  if (!sub || sub === "serve") {
-    return startServer(deps);
-  }
-  if (sub === "token") {
-    return hqTokenCmd(args.slice(1), deps);
-  }
-  if (sub === "audit") {
-    return hqAuditCmd(args.slice(1), deps);
-  }
-  if (sub === "alerts") {
-    return hqAlertsCmd(args.slice(1), deps);
-  }
-  if (sub === "service") {
-    const { hqServiceCmd } = await import("./hq-service-TQNPIRHL.js");
-    return hqServiceCmd(args.slice(1), deps);
-  }
-  if (sub === "help" || sub === "--help") {
-    printHelp(deps);
-    return 0;
-  }
-  deps.renderer.writeError(`Unknown hq subcommand: ${sub}
-`);
-  printHelp(deps);
-  return 1;
-};
-async function startServer(deps) {
-  const { startHqServer } = await import("./hq-server-BI23EPM7.js");
-  const dataDir = resolveDataDir(deps);
-  const flags = deps.flags ?? {};
-  const rawPublicUrl = typeof flags["hq-public-url"] === "string" ? flags["hq-public-url"] : process.env.WRONGSTACK_HQ_PUBLIC_URL;
-  let publicOrigin;
-  if (rawPublicUrl !== void 0 && rawPublicUrl.trim() !== "") {
-    try {
-      publicOrigin = normalizeHqPublicOrigin(rawPublicUrl);
-    } catch (cause) {
-      deps.renderer.writeError(`${cause instanceof Error ? cause.message : String(cause)}
-`);
-      return 1;
-    }
-  }
-  const host = typeof flags["host"] === "string" ? flags["host"] : publicOrigin !== void 0 ? "127.0.0.1" : HQ_CLI_DEFAULT_HOST;
-  const rawPort = typeof flags["port"] === "string" ? flags["port"].trim() : void 0;
-  const port = rawPort === void 0 ? 3499 : /^\d+$/.test(rawPort) ? Number(rawPort) : Number.NaN;
-  if (!Number.isInteger(port) || port < 0 || port > 65535) {
-    deps.renderer.writeError(`Invalid --port value: ${String(flags["port"])}
-`);
-    return 1;
-  }
-  if (publicOrigin !== void 0 && !isLoopbackHost(host)) {
-    deps.renderer.writeError(
-      "Persistent public HQ requires a loopback bind. Remove --host or use --host 127.0.0.1.\n"
-    );
-    return 1;
-  }
-  const strictPort = flags["strict-port"] === true;
-  const open = flags["open"] === true;
-  let password;
-  try {
-    password = await resolveHqPasswordInput({
-      ...typeof flags["password"] === "string" ? { explicitPassword: flags["password"] } : {}
-    });
-  } catch (cause) {
-    deps.renderer.writeError(`${cause instanceof Error ? cause.message : String(cause)}
-`);
-    return 1;
-  }
-  const bootstrapPasswordOnly = /^(?:1|true)$/i.test(
-    process.env.WRONGSTACK_HQ_BOOTSTRAP_PASSWORD_ONLY?.trim() ?? ""
-  );
-  const allowInsecureOpen = flags["insecure-open"] === true;
-  const rawAllowlist = typeof flags["hq-allowlist"] === "string" ? flags["hq-allowlist"] : process.env.WRONGSTACK_HQ_ALLOWLIST;
-  let ipAllowlist;
-  try {
-    ipAllowlist = parseHqIpAllowlist(rawAllowlist);
-  } catch (cause) {
-    deps.renderer.writeError(`${cause instanceof Error ? cause.message : String(cause)}
-`);
-    return 1;
-  }
-  const rawTtl = typeof flags["hq-token-ttl"] === "string" ? flags["hq-token-ttl"] : void 0;
-  let tokenTtlMs;
-  if (rawTtl !== void 0 && rawTtl.length > 0) {
-    const parsed = parseTokenTtlValue(rawTtl);
-    if (parsed.error) {
-      deps.renderer.writeError(`Invalid --hq-token-ttl: ${parsed.error}
-`);
-      return 1;
-    }
-    tokenTtlMs = parsed.value;
-  }
-  const rawHops = typeof flags["hq-trusted-proxy-hops"] === "string" ? flags["hq-trusted-proxy-hops"] : void 0;
-  let trustedProxyHops;
-  if (rawHops !== void 0 && rawHops.length > 0) {
-    const parsed = Number.parseInt(rawHops, 10);
-    if (!Number.isFinite(parsed) || parsed < 0 || String(parsed) !== rawHops.trim()) {
-      deps.renderer.writeError(
-        "--hq-trusted-proxy-hops must be a non-negative integer (0 = ignore X-Forwarded-For).\n"
-      );
-      return 1;
-    }
-    trustedProxyHops = parsed;
-  }
-  if (password !== void 0 && password.length < 8) {
-    deps.renderer.writeError("HQ password must be at least 8 characters.\n");
-    return 1;
-  }
-  let handle;
-  try {
-    handle = await startHqServer({
-      host,
-      port,
-      strictPort,
-      dataDir,
-      allowInsecureOpen,
-      secureCookies: publicOrigin !== void 0,
-      requireBrowserAuth: publicOrigin !== void 0,
-      ...password !== void 0 ? { password } : {},
-      ...bootstrapPasswordOnly ? { bootstrapPasswordOnly: true } : {},
-      ...tokenTtlMs !== void 0 ? { tokenTtlMs } : {},
-      ...trustedProxyHops !== void 0 ? { trustedProxyHops } : {},
-      ...ipAllowlist !== void 0 ? { ipAllowlist } : {}
-    });
-  } catch (err) {
-    if (err instanceof HqInsecureExposureError) {
-      deps.renderer.writeError(`${err.message}
-`);
-      return 1;
-    }
-    throw err;
-  }
-  if (publicOrigin !== void 0) {
-    if (handle.firstRunSetup?.passwordMode !== true) {
-      await handle.close();
-      deps.renderer.writeError(
-        "Persistent public HQ requires password mode. Set WRONGSTACK_HQ_PASSWORD and retry.\n"
-      );
-      return 1;
-    }
-    handle.trustPublicOrigin(publicOrigin);
-    deps.renderer.write(`Public endpoint:  ${publicOrigin}/
-`);
-    deps.renderer.write(`Public mobile:    ${publicOrigin}/mobile
-`);
-  }
-  if (open) {
-    try {
-      const { openBrowser } = await import("@wrongstack/webui-server");
-      openBrowser(
-        publicOrigin ?? handle.firstRunSetup?.browserUrl ?? `http://${handle.host}:${handle.port}`
-      );
-    } catch {
-    }
-  }
-  writeStartupInfo(deps, handle);
-  deps.renderer.write(
-    ipAllowlist === void 0 ? "Network allowlist: disabled (authentication remains required when configured).\n" : `Network allowlist: active (${ipAllowlist.length} configured rule${ipAllowlist.length === 1 ? "" : "s"} + loopback).
-`
-  );
-  await new Promise((resolve2) => {
-    const shutdown = async () => {
-      try {
-        await handle.close();
-      } catch (err) {
-        deps.renderer.write(`HQ server close error: ${String(err)}
-`);
-      }
-      resolve2();
-    };
-    process.on("SIGINT", shutdown);
-    process.on("SIGTERM", shutdown);
-  });
-  return 0;
-}
-function writeStartupInfo(deps, handle) {
-  deps.renderer.write(`WrongStack HQ listening on http://${handle.host}:${handle.port}
-`);
-  if (!handle.firstRunSetup) {
-    deps.renderer.write(`Client endpoint:  ws://${handle.host}:${handle.port}/ws/client
-`);
-    deps.renderer.write(`Browser endpoint: http://${handle.host}:${handle.port}
-`);
-    deps.renderer.write(
-      `Mobile endpoint:  http://${handle.host}:${handle.port}/mobile (password required)
-`
-    );
-    return;
-  }
-  if (process.env.WRONGSTACK_HQ_SUPPRESS_STARTUP_SECRETS === "1") {
-    deps.renderer.write(`Browser endpoint: http://${handle.host}:${handle.port}
-`);
-    deps.renderer.write(
-      `Mobile endpoint:  http://${handle.host}:${handle.port}/mobile (password required)
-`
-    );
-    deps.renderer.write(`Client endpoint:  ws://${handle.host}:${handle.port}/ws/client
-`);
-    deps.renderer.write(
-      `Startup credentials suppressed; auth state is stored in ${handle.firstRunSetup.dataDir}.
-`
-    );
-    return;
-  }
-  const mobileUrl = new URL(handle.firstRunSetup.browserUrl);
-  mobileUrl.pathname = "/mobile";
-  mobileUrl.search = "";
-  mobileUrl.hash = "";
-  deps.renderer.write(`Browser endpoint: ${handle.firstRunSetup.browserUrl}
-`);
-  deps.renderer.write(`Mobile endpoint:  ${mobileUrl.toString()} (password required)
-`);
-  deps.renderer.write(`Client endpoint:  ${handle.firstRunSetup.clientUrl}
-`);
-  deps.renderer.write(
-    handle.firstRunSetup.createdAuth ? `
-First-run HQ auth created in ${handle.firstRunSetup.dataDir}
-` : `
-HQ auth loaded from ${handle.firstRunSetup.dataDir}
-`
-  );
-  deps.renderer.write(`Start clients with:
-`);
-  deps.renderer.write(`  WRONGSTACK_HQ_URL=${handle.firstRunSetup.clientEnv.WRONGSTACK_HQ_URL}
-`);
-  if (handle.firstRunSetup.clientEnv.WRONGSTACK_HQ_TOKEN) {
-    deps.renderer.write(
-      `  WRONGSTACK_HQ_TOKEN=${handle.firstRunSetup.clientEnv.WRONGSTACK_HQ_TOKEN}
-`
-    );
-  }
-}
+// src/subcommands/handlers/hq-token.ts
+import {
+  logHqAuthAudit,
+  mintHqToken,
+  mutateHqAuthFile,
+  readHqAuthFile as readHqAuthFile2
+} from "@wrongstack/core/hq";
+import { expectDefined } from "@wrongstack/core/utils";
 async function hqTokenCmd(args, deps) {
   const action = args[0];
   if (deps.flags?.["help"] === true || action === "help" || action === "--help") {
@@ -846,157 +612,395 @@ async function tokenRevoke(args, deps) {
   );
   return 0;
 }
-function printHelp(deps) {
-  deps.renderer.write(`Usage: wstack hq <serve | token | audit | service>
+function printTokenHelp(deps) {
+  deps.renderer.write(`Usage: wstack hq token <create | list | revoke>
 `);
   deps.renderer.write("\n");
-  deps.renderer.write(`  wstack hq                      Start the HQ command center server.
-`);
-  deps.renderer.write(`  wstack hq serve                Same as above (explicit form).
-`);
   deps.renderer.write(
-    `  wstack hq token create [label] [--ttl <dur>] Mint a browser token, enter token mode.
+    `  wstack hq token create [label] [--ttl <dur>]          Mint a browser token (enters token mode).
 `
   );
   deps.renderer.write(
-    `  wstack hq token create --client [label] [--ttl <dur>]  Mint a client token (/ws/client).
+    `  wstack hq token create --client [label] [--ttl <dur>] Mint a client token (/ws/client).
 `
   );
-  deps.renderer.write(`  wstack hq token list           List issued browser tokens.
-`);
-  deps.renderer.write(`  wstack hq token list --client   List issued client tokens.
-`);
   deps.renderer.write(
-    `  wstack hq token revoke <id>    Revoke a browser token (id prefix match).
+    `  wstack hq token list                                 List issued browser tokens (alias: ls).
 `
   );
-  deps.renderer.write(`  wstack hq token revoke --client <id>  Revoke a client token.
-`);
   deps.renderer.write(
-    `  wstack hq audit verify         Re-derive auth.json contentHash for forensic comparison.
+    `  wstack hq token list --client                         List issued client tokens.
 `
   );
   deps.renderer.write(
-    `  wstack hq service install      Install persistent Ubuntu/systemd service + updater timer.
+    `  wstack hq token revoke <id>                           Revoke a browser token (id prefix match).
 `
   );
-  deps.renderer.write(`  wstack hq service status       Show service and updater status.
-`);
-  deps.renderer.write(`  wstack hq service update       Run the guarded update job now.
-`);
   deps.renderer.write(
-    `  wstack hq service uninstall    Remove units but preserve HQ data and secret file.
+    `  wstack hq token revoke --client <id>                  Revoke a client token.
 `
   );
   deps.renderer.write("\n");
-  deps.renderer.write(`Flags (apply to all subcommands):
+  deps.renderer.write(`The token secret is printed once at create time and cannot be recovered
+`);
+  deps.renderer.write(`from auth.json (only its SHA-256 verifier is persisted). Tokens live in
+`);
+  deps.renderer.write(`<dataDir>/auth.json (default ~/.wrongstack/hq/auth.json).
+`);
+  deps.renderer.write("\n");
+  deps.renderer.write(`Flags:
 `);
   deps.renderer.write(
     `  --data-dir <path>   Override HQ data directory (default ~/.wrongstack/hq).
 `
   );
   deps.renderer.write(
-    `  --host <ip>         Bind host (default 0.0.0.0; use 127.0.0.1 for local-only).
+    `  --client, -c        Operate on client tokens instead of browser tokens.
 `
   );
   deps.renderer.write(
-    `  --tunnel            Publish a temporary *.trycloudflare.com URL (requires cloudflared).
+    `  --capabilities <csv>  Comma-separated capability grants (browser: control.enqueue,control.approve; client: telemetry.publish,control.execute).
 `
   );
   deps.renderer.write(
-    `  --hq-public-url <https-origin>  Trust a persistent TLS reverse-proxy origin; binds loopback and requires password mode.
+    `  --ttl <duration>    Stamp an expiresAt on the token (e.g. --ttl 1h, --ttl 7d, --ttl 3600s).
 `
   );
-  deps.renderer.write(`  --password <value>  Set or rotate the browser login password.
+  deps.renderer.write("\n");
+  deps.renderer.write(`Run \`wstack hq --help\` for the full HQ command list.
 `);
+}
+
+// src/subcommands/handlers/hq.ts
+var hqCmd = async (args, deps) => {
+  const sub = args[0];
+  if (deps.flags?.["help"] === true && (!sub || sub === "serve")) {
+    printHelp(deps);
+    return 0;
+  }
+  if (!sub || sub === "serve") {
+    return startServer(deps);
+  }
+  if (sub === "token") {
+    return hqTokenCmd(args.slice(1), deps);
+  }
+  if (sub === "audit") {
+    return hqAuditCmd(args.slice(1), deps);
+  }
+  if (sub === "alerts") {
+    return hqAlertsCmd(args.slice(1), deps);
+  }
+  if (sub === "service") {
+    const { hqServiceCmd } = await import("./hq-service-TQNPIRHL.js");
+    return hqServiceCmd(args.slice(1), deps);
+  }
+  if (sub === "help" || sub === "--help") {
+    printHelp(deps);
+    return 0;
+  }
+  deps.renderer.writeError(`Unknown hq subcommand: ${sub}
+`);
+  printHelp(deps);
+  return 1;
+};
+async function startServer(deps) {
+  const { startHqServer } = await import("./hq-server-YK7FBLL6.js");
+  const dataDir = resolveDataDir(deps);
+  const flags = deps.flags ?? {};
+  const rawPublicUrl = typeof flags["hq-public-url"] === "string" ? flags["hq-public-url"] : process.env.WRONGSTACK_HQ_PUBLIC_URL;
+  let publicOrigin;
+  if (rawPublicUrl !== void 0 && rawPublicUrl.trim() !== "") {
+    try {
+      publicOrigin = normalizeHqPublicOrigin(rawPublicUrl);
+    } catch (cause) {
+      deps.renderer.writeError(`${cause instanceof Error ? cause.message : String(cause)}
+`);
+      return 1;
+    }
+  }
+  const host = typeof flags["host"] === "string" ? flags["host"] : publicOrigin !== void 0 ? "127.0.0.1" : HQ_CLI_DEFAULT_HOST;
+  const rawPort = typeof flags["port"] === "string" ? flags["port"].trim() : void 0;
+  const port = rawPort === void 0 ? 3499 : /^\d+$/.test(rawPort) ? Number(rawPort) : Number.NaN;
+  if (!Number.isInteger(port) || port < 0 || port > 65535) {
+    deps.renderer.writeError(`Invalid --port value: ${String(flags["port"])}
+`);
+    return 1;
+  }
+  if (publicOrigin !== void 0 && !isLoopbackHost(host)) {
+    deps.renderer.writeError(
+      "Persistent public HQ requires a loopback bind. Remove --host or use --host 127.0.0.1.\n"
+    );
+    return 1;
+  }
+  const strictPort = flags["strict-port"] === true;
+  const open = flags["open"] === true;
+  let password;
+  try {
+    password = await resolveHqPasswordInput({
+      ...typeof flags["password"] === "string" ? { explicitPassword: flags["password"] } : {}
+    });
+  } catch (cause) {
+    deps.renderer.writeError(`${cause instanceof Error ? cause.message : String(cause)}
+`);
+    return 1;
+  }
+  const bootstrapPasswordOnly = /^(?:1|true)$/i.test(
+    process.env.WRONGSTACK_HQ_BOOTSTRAP_PASSWORD_ONLY?.trim() ?? ""
+  );
+  const allowInsecureOpen = flags["insecure-open"] === true;
+  const rawAllowlist = typeof flags["hq-allowlist"] === "string" ? flags["hq-allowlist"] : process.env.WRONGSTACK_HQ_ALLOWLIST;
+  let ipAllowlist;
+  try {
+    ipAllowlist = parseHqIpAllowlist(rawAllowlist);
+  } catch (cause) {
+    deps.renderer.writeError(`${cause instanceof Error ? cause.message : String(cause)}
+`);
+    return 1;
+  }
+  const rawTtl = typeof flags["hq-token-ttl"] === "string" ? flags["hq-token-ttl"] : void 0;
+  let tokenTtlMs;
+  if (rawTtl !== void 0 && rawTtl.length > 0) {
+    const parsed = parseTokenTtlValue(rawTtl);
+    if (parsed.error) {
+      deps.renderer.writeError(`Invalid --hq-token-ttl: ${parsed.error}
+`);
+      return 1;
+    }
+    tokenTtlMs = parsed.value;
+  }
+  const rawHops = typeof flags["hq-trusted-proxy-hops"] === "string" ? flags["hq-trusted-proxy-hops"] : void 0;
+  let trustedProxyHops;
+  if (rawHops !== void 0 && rawHops.length > 0) {
+    const parsed = Number.parseInt(rawHops, 10);
+    if (!Number.isFinite(parsed) || parsed < 0 || String(parsed) !== rawHops.trim()) {
+      deps.renderer.writeError(
+        "--hq-trusted-proxy-hops must be a non-negative integer (0 = ignore X-Forwarded-For).\n"
+      );
+      return 1;
+    }
+    trustedProxyHops = parsed;
+  }
+  if (password !== void 0 && password.length < 8) {
+    deps.renderer.writeError("HQ password must be at least 8 characters.\n");
+    return 1;
+  }
+  let handle;
+  try {
+    handle = await startHqServer({
+      host,
+      port,
+      strictPort,
+      dataDir,
+      allowInsecureOpen,
+      secureCookies: publicOrigin !== void 0,
+      requireBrowserAuth: publicOrigin !== void 0,
+      ...password !== void 0 ? { password } : {},
+      ...bootstrapPasswordOnly ? { bootstrapPasswordOnly: true } : {},
+      ...tokenTtlMs !== void 0 ? { tokenTtlMs } : {},
+      ...trustedProxyHops !== void 0 ? { trustedProxyHops } : {},
+      ...ipAllowlist !== void 0 ? { ipAllowlist } : {}
+    });
+  } catch (err) {
+    if (err instanceof HqInsecureExposureError) {
+      deps.renderer.writeError(`${err.message}
+`);
+      return 1;
+    }
+    throw err;
+  }
+  if (publicOrigin !== void 0) {
+    if (handle.firstRunSetup?.passwordMode !== true) {
+      await handle.close();
+      deps.renderer.writeError(
+        "Persistent public HQ requires password mode. Set WRONGSTACK_HQ_PASSWORD and retry.\n"
+      );
+      return 1;
+    }
+    handle.trustPublicOrigin(publicOrigin);
+    deps.renderer.write(`Public endpoint:  ${publicOrigin}/
+`);
+    deps.renderer.write(`Public mobile:    ${publicOrigin}/mobile
+`);
+  }
+  if (open) {
+    try {
+      const { openBrowser } = await import("@wrongstack/webui-server");
+      openBrowser(
+        publicOrigin ?? handle.firstRunSetup?.browserUrl ?? `http://${handle.host}:${handle.port}`
+      );
+    } catch {
+    }
+  }
+  writeStartupInfo(deps, handle);
   deps.renderer.write(
-    `  --insecure-open     Allow a non-loopback bind with no token/password set.
+    ipAllowlist === void 0 ? "Network allowlist: disabled (authentication remains required when configured).\n" : `Network allowlist: active (${ipAllowlist.length} configured rule${ipAllowlist.length === 1 ? "" : "s"} + loopback).
 `
   );
-  deps.renderer.write(`  --port <n>          Bind port (default 3499).
+  await new Promise((resolve2) => {
+    const shutdown = async () => {
+      try {
+        await handle.close();
+      } catch (err) {
+        deps.renderer.write(`HQ server close error: ${String(err)}
 `);
-  deps.renderer.write(`  --strict-port       Fail if port is in use.
+      }
+      resolve2();
+    };
+    process.on("SIGINT", shutdown);
+    process.on("SIGTERM", shutdown);
+  });
+  return 0;
+}
+function writeStartupInfo(deps, handle) {
+  deps.renderer.write(`WrongStack HQ listening on http://${handle.host}:${handle.port}
+`);
+  if (!handle.firstRunSetup) {
+    deps.renderer.write(`Client endpoint:  ws://${handle.host}:${handle.port}/ws/client
+`);
+    deps.renderer.write(`Browser endpoint: http://${handle.host}:${handle.port}
+`);
+    deps.renderer.write(
+      `Mobile endpoint:  http://${handle.host}:${handle.port}/mobile (password required)
+`
+    );
+    return;
+  }
+  if (process.env.WRONGSTACK_HQ_SUPPRESS_STARTUP_SECRETS === "1") {
+    deps.renderer.write(`Browser endpoint: http://${handle.host}:${handle.port}
+`);
+    deps.renderer.write(
+      `Mobile endpoint:  http://${handle.host}:${handle.port}/mobile (password required)
+`
+    );
+    deps.renderer.write(`Client endpoint:  ws://${handle.host}:${handle.port}/ws/client
+`);
+    deps.renderer.write(
+      `Startup credentials suppressed; auth state is stored in ${handle.firstRunSetup.dataDir}.
+`
+    );
+    return;
+  }
+  const mobileUrl = new URL(handle.firstRunSetup.browserUrl);
+  mobileUrl.pathname = "/mobile";
+  mobileUrl.search = "";
+  mobileUrl.hash = "";
+  deps.renderer.write(`Browser endpoint: ${handle.firstRunSetup.browserUrl}
+`);
+  deps.renderer.write(`Mobile endpoint:  ${mobileUrl.toString()} (password required)
+`);
+  deps.renderer.write(`Client endpoint:  ${handle.firstRunSetup.clientUrl}
 `);
   deps.renderer.write(
-    `  --hq-token-ttl <dur>  Stamp an expiresAt on first-run tokens (e.g. 1h, 7d, 3600s).
+    handle.firstRunSetup.createdAuth ? `
+First-run HQ auth created in ${handle.firstRunSetup.dataDir}
+` : `
+HQ auth loaded from ${handle.firstRunSetup.dataDir}
 `
   );
+  deps.renderer.write(`Start clients with:
+`);
+  deps.renderer.write(`  WRONGSTACK_HQ_URL=${handle.firstRunSetup.clientEnv.WRONGSTACK_HQ_URL}
+`);
+  if (handle.firstRunSetup.clientEnv.WRONGSTACK_HQ_TOKEN) {
+    deps.renderer.write(
+      `  WRONGSTACK_HQ_TOKEN=${handle.firstRunSetup.clientEnv.WRONGSTACK_HQ_TOKEN}
+`
+    );
+  }
+}
+function printHelp(deps) {
+  deps.renderer.write(`Usage: wstack hq <serve | token | audit | service>
+`);
+  deps.renderer.write("\n");
+  deps.renderer.write(`  wstack hq                      Start the HQ command center server.
+`);
+  deps.renderer.write(`  wstack hq serve                Same as above (explicit form).
+`);
   deps.renderer.write(
-    `  --hq-trusted-proxy-hops <n>  Trust the rightmost n X-Forwarded-For entries when rate-limiting logins.
-                        Default 0 (ignore the header). Set to the real hop count behind a tunnel,
-                        otherwise every user shares one backoff bucket. Never guess high.
+    `  wstack hq token create [label] [--ttl <dur>] Mint a browser token, enter token mode.
 `
   );
   deps.renderer.write(
-    `  --hq-allowlist <csv>  Optional source IP/CIDR allowlist (for example 203.0.113.4,10.0.0.0/8).
+    `  wstack hq token create --client [label] [--ttl <dur>]  Mint a client token (/ws/client).
 `
   );
-  deps.renderer.write(`  --open              Open the dashboard in the default browser.
+  deps.renderer.write(`  wstack hq token list           List issued browser tokens.
+`);
+  deps.renderer.write(`  wstack hq token list --client   List issued client tokens.
 `);
   deps.renderer.write(
-    `  --client, -c        Operate on client tokens instead of browser tokens.
+    `  wstack hq token revoke <id>    Revoke a browser token (id prefix match).
 `
   );
+  deps.renderer.write(`  wstack hq token revoke --client <id>  Revoke a client token.
+`);
   deps.renderer.write(
-    `  --capabilities <csv>  Token grants (browser: control.enqueue,control.approve; client: telemetry.publish,control.execute).
+    `  wstack hq audit verify         Re-derive auth.json contentHash for forensic comparison.
 `
   );
   deps.renderer.write(
-    `  --ttl <duration>    Stamp an expiresAt on the token (e.g. --ttl 1h, --ttl 7d, --ttl 3600s).
+    `  wstack hq service install      Install persistent Ubuntu/systemd service + updater timer.
 `
   );
-  deps.renderer.write("\n");
-  deps.renderer.write(`auth.json schema version: ${HQ_AUTH_FILE_VERSION}.
+  deps.renderer.write(`  wstack hq service status       Show service and updater status.
 `);
-}
-function printTokenHelp(deps) {
-  deps.renderer.write(`Usage: wstack hq token <create | list | revoke>
+  deps.renderer.write(`  wstack hq service update       Run the guarded update job now.
 `);
-  deps.renderer.write("\n");
   deps.renderer.write(
-    `  wstack hq token create [label] [--ttl <dur>]          Mint a browser token (enters token mode).
+    `  wstack hq service uninstall    Remove units but preserve HQ data and secret file.
 `
   );
+  deps.renderer.write("\n");
+  deps.renderer.write(`Flags (apply to all subcommands):
+`);
   deps.renderer.write(
-    `  wstack hq token create --client [label] [--ttl <dur>] Mint a client token (/ws/client).
+    `  --data-dir <path>   Override HQ data directory (default ~/.wrongstack/hq).
 `
   );
   deps.renderer.write(
-    `  wstack hq token list                                 List issued browser tokens (alias: ls).
+    `  --host <ip>         Bind host (default 0.0.0.0; use 127.0.0.1 for local-only).
 `
   );
   deps.renderer.write(
-    `  wstack hq token list --client                         List issued client tokens.
+    `  --tunnel            Publish a temporary *.trycloudflare.com URL (requires cloudflared).
 `
   );
   deps.renderer.write(
-    `  wstack hq token revoke <id>                           Revoke a browser token (id prefix match).
+    `  --hq-public-url <https-origin>  Trust a persistent TLS reverse-proxy origin; binds loopback and requires password mode.
 `
   );
+  deps.renderer.write(`  --password <value>  Set or rotate the browser login password.
+`);
   deps.renderer.write(
-    `  wstack hq token revoke --client <id>                  Revoke a client token.
+    `  --insecure-open     Allow a non-loopback bind with no token/password set.
 `
   );
-  deps.renderer.write("\n");
-  deps.renderer.write(`The token secret is printed once at create time and cannot be recovered
-`);
-  deps.renderer.write(`from auth.json (only its SHA-256 verifier is persisted). Tokens live in
-`);
-  deps.renderer.write(`<dataDir>/auth.json (default ~/.wrongstack/hq/auth.json).
+  deps.renderer.write(`  --port <n>          Bind port (default 3499).
 `);
-  deps.renderer.write("\n");
-  deps.renderer.write(`Flags:
+  deps.renderer.write(`  --strict-port       Fail if port is in use.
 `);
   deps.renderer.write(
-    `  --data-dir <path>   Override HQ data directory (default ~/.wrongstack/hq).
+    `  --hq-token-ttl <dur>  Stamp an expiresAt on first-run tokens (e.g. 1h, 7d, 3600s).
+`
+  );
+  deps.renderer.write(
+    `  --hq-trusted-proxy-hops <n>  Trust the rightmost n X-Forwarded-For entries when rate-limiting logins.
+                        Default 0 (ignore the header). Set to the real hop count behind a tunnel,
+                        otherwise every user shares one backoff bucket. Never guess high.
 `
   );
+  deps.renderer.write(
+    `  --hq-allowlist <csv>  Optional source IP/CIDR allowlist (for example 203.0.113.4,10.0.0.0/8).
+`
+  );
+  deps.renderer.write(`  --open              Open the dashboard in the default browser.
+`);
   deps.renderer.write(
     `  --client, -c        Operate on client tokens instead of browser tokens.
 `
   );
   deps.renderer.write(
-    `  --capabilities <csv>  Comma-separated capability grants (browser: control.enqueue,control.approve; client: telemetry.publish,control.execute).
+    `  --capabilities <csv>  Token grants (browser: control.enqueue,control.approve; client: telemetry.publish,control.execute).
 `
   );
   deps.renderer.write(
@@ -1004,10 +1008,10 @@ function printTokenHelp(deps) {
 `
   );
   deps.renderer.write("\n");
-  deps.renderer.write(`Run \`wstack hq --help\` for the full HQ command list.
+  deps.renderer.write(`auth.json schema version: ${HQ_AUTH_FILE_VERSION}.
 `);
 }
 export {
   hqCmd
 };
-//# sourceMappingURL=hq-JD5AZVMG.js.map
+//# sourceMappingURL=hq-54PQYR5O.js.map