@wrongstack/core 0.284.1 → 0.286.0

package/dist/hq/alerts.d.ts

@@ -0,0 +1,67 @@
+/**
+ * HQ alerting engine — evaluates the current snapshot against a set of
+ * operator-configurable rules and emits `hq.alert` messages when a threshold
+ * is crossed. Mirrors the BrainMonitor's self-activation logic (tool-failure
+ * streaks, error storms) but at the fleet-wide command-center scope.
+ *
+ * Rules are evaluated on a periodic tick (default 15s, unref'd) against the
+ * latest in-memory snapshot. Deduplication prevents alert storms: a rule that
+ * is still firing is not re-emitted until it clears (state machine per rule).
+ *
+ * @module hq/alerts
+ */
+import type { HqAlertMessage, HqSnapshot } from './protocol.js';
+/** Severity levels for alerts, mirroring {@link HqAlertMessage}. */
+export type HqAlertSeverity = HqAlertMessage['severity'];
+export interface HqAlert {
+    id: string;
+    ruleId: string;
+    severity: HqAlertSeverity;
+    message: string;
+    /** Epoch ms when the alert first fired in its current episode. */
+    firstFiredAt: number;
+    /** Epoch ms of the most recent evaluation that confirmed the alert. */
+    lastFiredAt: number;
+}
+export interface HqAlertRuleConfig {
+    /** Maximum cost (USD) across the whole fleet before alerting. Default 50. */
+    costThresholdUsd?: number;
+    /** Seconds of silence from ALL machines before a stale alert fires. Default 120. */
+    staleMachineSeconds?: number;
+    /** Minimum number of active agents before concurrency alert fires. Default: disabled (0). */
+    maxAgents?: number;
+}
+/**
+ * In-memory alert state. Tracks which rules are currently firing so the same
+ * alert is not re-emitted every tick — only state transitions (cleared →
+ * firing) emit. Optionally persists to disk via a callback.
+ */
+export declare class HqAlertEngine {
+    private readonly active;
+    private readonly history;
+    private readonly maxHistory;
+    private timer;
+    private readonly onAlert;
+    constructor(opts: {
+        onAlert: (alert: HqAlert) => void;
+        maxHistory?: number;
+    });
+    /**
+     * Evaluate all rules against the snapshot. Emits (via the `onAlert`
+     * callback) only for rules that newly transition to firing. Clears rules
+     * that are no longer firing. Returns the list of newly-fired alerts.
+     */
+    evaluate(snapshot: HqSnapshot | null, config?: HqAlertRuleConfig, now?: number): HqAlert[];
+    /** Currently-active (firing) alerts. */
+    activeAlerts(): HqAlert[];
+    /** Historical alerts (newest-last), capped at maxHistory. */
+    recentAlerts(limit?: number): HqAlert[];
+    /**
+     * Start periodic evaluation against a snapshot getter. The timer is
+     * unref'd so it never keeps the process alive. Returns a disposer.
+     */
+    startPeriodic(getSnapshot: () => HqSnapshot | null, config?: HqAlertRuleConfig | (() => HqAlertRuleConfig | undefined), intervalMs?: number): () => void;
+}
+/** Map an internal {@link HqAlert} to the wire {@link HqAlertMessage}. */
+export declare function toAlertMessage(alert: HqAlert): HqAlertMessage;
+//# sourceMappingURL=alerts.d.ts.map

package/dist/hq/alerts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"alerts.d.ts","sourceRoot":"","sources":["../../src/hq/alerts.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAEhE,oEAAoE;AACpE,MAAM,MAAM,eAAe,GAAG,cAAc,CAAC,UAAU,CAAC,CAAC;AAEzD,MAAM,WAAW,OAAO;IACtB,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,eAAe,CAAC;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,kEAAkE;IAClE,YAAY,EAAE,MAAM,CAAC;IACrB,uEAAuE;IACvE,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,iBAAiB;IAChC,6EAA6E;IAC7E,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,oFAAoF;IACpF,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,6FAA6F;IAC7F,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AA8ED;;;;GAIG;AACH,qBAAa,aAAa;IACxB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA8B;IACrD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAiB;IACzC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,KAAK,CAA+C;IAC5D,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA2B;IAEnD,YAAY,IAAI,EAAE;QAAE,OAAO,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,EAG3E;IAED;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,EAAE,UAAU,GAAG,IAAI,EAAE,MAAM,CAAC,EAAE,iBAAiB,EAAE,GAAG,GAAE,MAAmB,GAAG,OAAO,EAAE,CAwCrG;IAED,wCAAwC;IACxC,YAAY,IAAI,OAAO,EAAE,CAExB;IAED,6DAA6D;IAC7D,YAAY,CAAC,KAAK,SAAM,GAAG,OAAO,EAAE,CAEnC;IAED;;;OAGG;IACH,aAAa,CACX,WAAW,EAAE,MAAM,UAAU,GAAG,IAAI,EACpC,MAAM,CAAC,EAAE,iBAAiB,GAAG,CAAC,MAAM,iBAAiB,GAAG,SAAS,CAAC,EAClE,UAAU,SAAS,GAClB,MAAM,IAAI,CAkBZ;CACF;AAED,0EAA0E;AAC1E,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,cAAc,CAO7D"}

package/dist/hq/auth-store.d.ts

@@ -0,0 +1,179 @@
+import type { HqRedactionPolicy } from './protocol.js';
+/** Current auth-file schema version. Bump on breaking shape changes. */
+export declare const HQ_AUTH_FILE_VERSION: 1;
+/** Default HQ data directory: `~/.wrongstack/hq` (honors WRONGSTACK_HOME). */
+export declare function defaultHqDataDir(): string;
+/**
+ * Resolve an HQ data directory from an optional override.
+ *
+ * Resolution order:
+ *   1. Explicit `override` (from `--data-dir`) — resolved against
+ *      `process.cwd()` if relative.
+ *   2. `WRONGSTACK_HQ_DATA_DIR` env var (same resolution rules).
+ *   3. `defaultHqDataDir()` — `~/.wrongstack/hq`.
+ *
+ * The env var exists so tests (and sandboxed runs) can redirect HQ state
+ * away from the real user home without threading a CLI flag everywhere.
+ */
+export declare function resolveHqDataDir(override?: string, env?: NodeJS.ProcessEnv): string;
+/**
+ * A generic HQ-issued token. Used for both browser tokens (validated on
+ * `/ws/browser`) and client tokens (validated on `/ws/client`). The two
+ * are stored in separate lists so a browser-only token cannot be replayed
+ * against the client channel and vice versa.
+ *
+ * `capabilities` scopes what a token may do. When absent the token is
+ * unrestricted (backward-compat with tokens minted before Phase 3). Known
+ * capability strings:
+ *   - `control.enqueue` — browser token may enqueue commands to clients
+ *   - `control.execute` — client token may execute `run-command` commands
+ *   - `telemetry.publish` — client token may publish telemetry
+ */
+export interface HqToken {
+    id: string;
+    token: string;
+    label?: string;
+    createdAt: string;
+    lastUsedAt?: string;
+    /**
+     * Optional capability scope. When absent, the token is unrestricted
+     * (backward-compat). When present, only the listed capabilities are
+     * granted.
+     */
+    capabilities?: string[];
+}
+/**
+ * Check whether a token grants a capability. A token with no `capabilities`
+ * field is unrestricted (backward-compat). Otherwise the capability must be
+ * explicitly listed.
+ */
+export declare function tokenHasCapability(token: HqToken | undefined, capability: string): boolean;
+/**
+ * Alias kept for backward-compat with Phase 3 callers/tests. New code
+ * should prefer `HqToken`.
+ */
+export type HqBrowserToken = HqToken;
+/** On-disk shape of `<dataDir>/auth.json`. */
+export interface HqRuntimeFile {
+    url: string;
+    updatedAt: string;
+    pid?: number;
+}
+export interface HqAuthFile {
+    version: typeof HQ_AUTH_FILE_VERSION;
+    updatedAt: string;
+    /**
+     * Operator-configured redaction policy override. When present, the HQ
+     * server applies these settings AFTER any publisher-declared policy —
+     * i.e. the operator can always tighten, never loosen.
+     */
+    redactionPolicy?: Partial<HqRedactionPolicy>;
+    /** Browser tokens — validated on `/ws/browser` upgrades (Phase 3). */
+    browserTokens?: HqToken[];
+    /** Client tokens — validated on `/ws/client` upgrades (Phase 4). */
+    clientTokens?: HqToken[];
+    /** scrypt hash of the optional browser password login. */
+    passwordHash?: string;
+    /** Secret used to sign browser session cookies. */
+    cookieSecret?: string;
+}
+/** An empty auth file — what a brand-new HQ install starts with. */
+export declare function emptyHqAuthFile(): HqAuthFile;
+/** Path to `auth.json` under the given data directory. */
+export declare function hqAuthFilePath(dataDir: string): string;
+/** Path to the best-effort runtime endpoint marker under the given data directory. */
+export declare function hqRuntimeFilePath(dataDir: string): string;
+export declare function writeHqRuntimeFile(dataDir: string, file: Omit<HqRuntimeFile, 'updatedAt'>): Promise<void>;
+export declare function readHqRuntimeFileSync(dataDir: string): HqRuntimeFile | undefined;
+/**
+ * Read `auth.json` from disk. Returns `emptyHqAuthFile()` when:
+ *   - the file does not exist (ENOENT), or
+ *   - the file cannot be parsed (the `warn` callback surfaces the error).
+ *
+ * Never throws for routine I/O — a missing or corrupt auth file should not
+ * prevent the HQ server from starting. The operator can recover by editing
+ * or deleting the file.
+ */
+export declare function readHqAuthFile(dataDir: string, opts?: {
+    warn?: (msg: string) => void;
+}): Promise<HqAuthFile>;
+/**
+ * Write `auth.json` atomically with mode 0o600. Creates the data directory
+ * if needed. Throws on I/O failure — callers (CLI commands) should surface
+ * the error to the operator.
+ */
+export declare function writeHqAuthFile(dataDir: string, file: HqAuthFile): Promise<void>;
+export interface EnsureHqFirstRunAuthOptions {
+    warn?: (msg: string) => void;
+    /** Optional browser password login. Hashed with scrypt before storage. */
+    password?: string;
+}
+export interface EnsureHqFirstRunAuthResult {
+    authFile: HqAuthFile;
+    created: boolean;
+    browserToken?: HqToken;
+    clientToken?: HqToken;
+}
+/**
+ * Ensure a brand-new HQ data directory has the auth required for safe
+ * first-run operation. Only a missing auth.json is bootstrapped; an existing
+ * file, including one with empty token arrays, is treated as operator intent.
+ */
+export declare function ensureHqFirstRunAuthFile(dataDir: string, opts?: EnsureHqFirstRunAuthOptions): Promise<EnsureHqFirstRunAuthResult>;
+/**
+ * Load → mutate → write. The mutator receives the current file (or an empty
+ * one) and returns the next file. Use this for any read-modify-write cycle
+ * to avoid clobbering concurrent edits from another CLI invocation.
+ *
+ * Note: this does NOT take a file lock. HQ auth edits are rare (operator
+ * running `wstack --hq-token add` etc.) and the atomic rename protects
+ * against torn writes; a race between two concurrent edits would be
+ * last-write-wins, which is acceptable for this low-frequency file.
+ */
+export declare function mutateHqAuthFile(dataDir: string, mutator: (current: HqAuthFile) => HqAuthFile | Promise<HqAuthFile>, opts?: {
+    warn?: (msg: string) => void;
+}): Promise<HqAuthFile>;
+/**
+ * Hash a browser password for storage in `auth.json`. Uses scrypt with a
+ * random salt; the returned string is `scrypt$<salt>$<hash>` in base64url.
+ */
+export declare function hashHqPassword(password: string): Promise<string>;
+/**
+ * Verify a browser password against a stored scrypt hash.
+ */
+export declare function verifyHqPassword(password: string, hash: string): Promise<boolean>;
+/** Mint a secret used to sign browser session cookies. */
+export declare function mintHqCookieSecret(): string;
+/**
+ * Mint a fresh token. Used for both browser and client tokens; the caller
+ * decides which list to append to.
+ */
+export declare function mintHqToken(label?: string): HqToken;
+/**
+ * Backward-compat alias for `mintHqToken`. Phase 3 callers/tests use this.
+ */
+export declare const mintHqBrowserToken: typeof mintHqToken;
+/**
+ * Watch `auth.json` for changes and invoke `onChange` with the freshly-read
+ * file. Returns a `close()` function that stops watching.
+ *
+ * The watcher debounces events (default 200ms) because most editors do a
+ * tmp+rename dance that emits multiple events. On any read failure (file
+ * deleted, corrupt, etc.) the `warn` callback is invoked with the same
+ * semantics as `readHqAuthFile`; the watcher stays active so a future
+ * valid write re-triggers the callback.
+ *
+ * Notes:
+ * - `fs.watch` is best-effort across platforms. On some network
+ *   filesystems events may not fire; the operator must restart the server
+ *   to pick up changes in that case.
+ * - The watcher polls the parent directory (not the file itself) so that
+ *   atomic rename events surface reliably.
+ */
+export declare function watchHqAuthFile(dataDir: string, onChange: (file: HqAuthFile) => void, opts?: {
+    warn?: (msg: string) => void;
+    debounceMs?: number;
+}): {
+    close: () => void;
+};
+//# sourceMappingURL=auth-store.d.ts.map

package/dist/hq/auth-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-store.d.ts","sourceRoot":"","sources":["../../src/hq/auth-store.ts"],"names":[],"mappings":"AA6BA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAEvD,wEAAwE;AACxE,eAAO,MAAM,oBAAoB,EAAG,CAAU,CAAC;AAE/C,8EAA8E;AAC9E,wBAAgB,gBAAgB,IAAI,MAAM,CAEzC;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAIhG;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,OAAO;IACtB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;CACzB;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,SAAS,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAI1F;AAED;;;GAGG;AACH,MAAM,MAAM,cAAc,GAAG,OAAO,CAAC;AAErC,8CAA8C;AAC9C,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,OAAO,oBAAoB,CAAC;IACrC,SAAS,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,eAAe,CAAC,EAAE,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAC7C,sEAAsE;IACtE,aAAa,CAAC,EAAE,OAAO,EAAE,CAAC;IAC1B,oEAAoE;IACpE,YAAY,CAAC,EAAE,OAAO,EAAE,CAAC;IACzB,0DAA0D;IAC1D,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,mDAAmD;IACnD,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,oEAAoE;AACpE,wBAAgB,eAAe,IAAI,UAAU,CAK5C;AAED,0DAA0D;AAC1D,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAEtD;AAED,sFAAsF;AACtF,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAEzD;AAED,wBAAsB,kBAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAM/G;AAYD,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS,CAahF;AAED;;;;;;;;GAQG;AACH,wBAAsB,cAAc,CAClC,OAAO,EAAE,MAAM,EACf,IAAI,GAAE;IAAE,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAA;CAAO,GAC1C,OAAO,CAAC,UAAU,CAAC,CAwBrB;AAED;;;;GAIG;AACH,wBAAsB,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAQtF;AAED,MAAM,WAAW,2BAA2B;IAC1C,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7B,0EAA0E;IAC1E,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,EAAE,UAAU,CAAC;IACrB,OAAO,EAAE,OAAO,CAAC;IACjB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED;;;;GAIG;AACH,wBAAsB,wBAAwB,CAC5C,OAAO,EAAE,MAAM,EACf,IAAI,GAAE,2BAAgC,GACrC,OAAO,CAAC,0BAA0B,CAAC,CA8BrC;AAED;;;;;;;;;GASG;AACH,wBAAsB,gBAAgB,CACpC,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,CAAC,OAAO,EAAE,UAAU,KAAK,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,EAClE,IAAI,GAAE;IAAE,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAA;CAAO,GAC1C,OAAO,CAAC,UAAU,CAAC,CAKrB;AAMD;;;GAGG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAShE;AAED;;GAEG;AACH,wBAAsB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAmBvF;AAED,0DAA0D;AAC1D,wBAAgB,kBAAkB,IAAI,MAAM,CAE3C;AAED;;;GAGG;AACH,wBAAgB,WAAW,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAQnD;AAED;;GAEG;AACH,eAAO,MAAM,kBAAkB,oBAAc,CAAC;AAE9C;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,eAAe,CAC7B,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,CAAC,IAAI,EAAE,UAAU,KAAK,IAAI,EACpC,IAAI,GAAE;IAAE,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAO,GAC/D;IAAE,KAAK,EAAE,MAAM,IAAI,CAAA;CAAE,CAyDvB"}

package/dist/hq/brain-bridge.d.ts

@@ -0,0 +1,37 @@
+/**
+ * BrainTelemetryBridge — forwards local Brain (decision layer) events to the
+ * HQ publisher as `brain.event` envelopes, so the command center can observe
+ * decision requests, answers, denials, ask-human escalations, and
+ * self-activated interventions across every connected machine.
+ *
+ * Source: the `brain.*` EventBus events emitted by `ObservableBrainArbiter`
+ * (`coordination/brain.ts`) and `BrainMonitor` (`coordination/brain-monitor.ts`).
+ * All payloads are plain serializable data (request id, question, source, risk,
+ * decision kind, rationale) — no closures, no decoupled relay needed.
+ *
+ * The webui `setup-events.ts` already forwards these verbatim to its browser;
+ * this bridge does the same for the cross-machine HQ plane.
+ *
+ * @module hq/brain-bridge
+ */
+import type { EventBus } from '../kernel/events.js';
+import type { HqEventEnvelope } from './protocol.js';
+import type { HqPublisher } from './publisher.js';
+export interface BrainTelemetryBridgeOptions {
+    /** Local EventBus emitting `brain.*` events. */
+    events: EventBus;
+    /** HQ publisher to forward envelopes to. */
+    publisher: HqPublisher;
+    /** Optional sessionId to tag envelopes with. */
+    sessionId?: string;
+    /** Override `now()` for deterministic tests. */
+    now?: () => string;
+}
+/**
+ * Start forwarding brain events to HQ. Returns a disposer that unsubscribes
+ * all listeners — call on shutdown.
+ */
+export declare function startBrainTelemetryBridge(opts: BrainTelemetryBridgeOptions): () => void;
+/** Re-export for type-only consumers. */
+export type { HqEventEnvelope };
+//# sourceMappingURL=brain-bridge.d.ts.map

package/dist/hq/brain-bridge.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"brain-bridge.d.ts","sourceRoot":"","sources":["../../src/hq/brain-bridge.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAEpD,OAAO,KAAK,EAAyC,eAAe,EAAE,MAAM,eAAe,CAAC;AAC5F,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAElD,MAAM,WAAW,2BAA2B;IAC1C,gDAAgD;IAChD,MAAM,EAAE,QAAQ,CAAC;IACjB,4CAA4C;IAC5C,SAAS,EAAE,WAAW,CAAC;IACvB,gDAAgD;IAChD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,gDAAgD;IAChD,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAgCD;;;GAGG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,2BAA2B,GAAG,MAAM,IAAI,CAyEvF;AAED,yCAAyC;AACzC,YAAY,EAAE,eAAe,EAAE,CAAC"}

package/dist/hq/commands.d.ts

@@ -0,0 +1,122 @@
+/**
+ * HQ control-plane command definitions — typed payloads for the commands the
+ * HQ dashboard can enqueue to connected machines (Phase 3+ of the HQ command
+ * center). These are carried over the existing `HqQueuedCommand` wire shape
+ * (`{commandId, type, payload, …}`) whose `type`/`payload` were previously
+ * type-erased. This module gives them a discriminated union for type-safe
+ * dispatch on the client side (Phase 4).
+ *
+ * Security model: `run-command` (raw shell) is gated by a per-token
+ * `control.execute` capability AND an operator opt-in; the other four commands
+ * route through the agent's own decision loop / mailbox and inherit their
+ * existing guardrails. See `docs/plans/hq-command-center-2026-07.md`.
+ *
+ * @module hq/commands
+ */
+import type { HqQueuedCommand } from './protocol.js';
+/** HQ_COMMAND_TYPES — the full set of recognized command `type` strings. */
+export declare const HQ_COMMAND_TYPES: readonly ['steer', 'btw', 'queue', 'abort', 'spawn', 'broadcast', 'run-command'];
+export type HqCommandType = (typeof HQ_COMMAND_TYPES)[number];
+/** Inject a steer text into a target agent's conversation. */
+export interface HqSteerCommand {
+    type: 'steer';
+    /** Target agent address: a unique id (`leader@<tag>`), an alias (`leader`), or `*` for all. */
+    to: string;
+    subject: string;
+    body: string;
+    priority?: 'low' | 'normal' | 'high';
+}
+/**
+ * Post a non-urgent FYI (`btw`) into a target agent's mailbox. Unlike a steer,
+ * a btw is absorbed as context — it does not demand the agent change course.
+ * Same wire shape as steer; only the emitted mailbox `type` differs.
+ */
+export interface HqBtwCommand {
+    type: 'btw';
+    /** Target agent address: a unique id (`leader@<tag>`), an alias (`leader`), or `*` for all. */
+    to: string;
+    subject: string;
+    body: string;
+    priority?: 'low' | 'normal' | 'high';
+}
+/**
+ * Queue a prompt/note (`queue`) for a target agent. Delivered as a plain
+ * `note` mailbox message the agent picks up before its next step — used when
+ * the prompt should wait its turn rather than steer the current operation.
+ */
+export interface HqQueueCommand {
+    type: 'queue';
+    /** Target agent address: a unique id (`leader@<tag>`), an alias (`leader`), or `*` for all. */
+    to: string;
+    subject: string;
+    body: string;
+    priority?: 'low' | 'normal' | 'high';
+}
+/** Abort a running agent run or fleet. */
+export interface HqAbortCommand {
+    type: 'abort';
+    /** `'leader'` aborts the session leader; a subagentId aborts one agent; `'fleet'` stops all. */
+    target: 'leader' | 'fleet' | string;
+}
+/** Spawn a subagent of the given role. */
+export interface HqSpawnCommand {
+    type: 'spawn';
+    role: string;
+    /** Optional task description for dispatch routing. */
+    task?: string;
+    maxIterations?: number;
+}
+/** Broadcast a mailbox message to all agents on the target's project. */
+export interface HqBroadcastCommand {
+    type: 'broadcast';
+    subject: string;
+    body: string;
+    priority?: 'low' | 'normal' | 'high';
+}
+/** Run a shell command on the target machine. GATED by `control.execute`. */
+export interface HqRunCommandCommand {
+    type: 'run-command';
+    command: string;
+    /** Optional working directory (defaults to the agent's project root). */
+    cwd?: string;
+}
+export type HqCommand = HqSteerCommand | HqBtwCommand | HqQueueCommand | HqAbortCommand | HqSpawnCommand | HqBroadcastCommand | HqRunCommandCommand;
+/**
+ * Validate that an inbound `HqQueuedCommand` has a recognized `type` and a
+ * minimally well-formed payload. Returns the narrowed command on success, or
+ * `null` when the command should be rejected.
+ *
+ * This is a shape check, not a security gate — capability enforcement happens
+ * at enqueue time (browser token must have `control.enqueue`) and at execute
+ * time (`run-command` requires `control.execute`).
+ */
+export declare function validateHqCommand(queued: HqQueuedCommand): HqCommand | null;
+export interface HqCommandAuditEntry {
+    commandId: string;
+    type: HqCommandType;
+    clientId: string;
+    /** Who enqueued the command (browser token id, or 'anonymous' in open mode). */
+    enqueuedBy: string;
+    enqueuedAt: string;
+    status: 'queued' | 'delivered' | 'acked';
+    /** Ack status when the client has responded. */
+    ackStatus?: 'accepted' | 'completed' | 'failed' | 'rejected';
+    ackMessage?: string;
+    ackedAt?: string;
+}
+/**
+ * In-memory command audit ring. Capped; the Phase 2 persistence layer can
+ * sink entries to disk when wired (future). For now this gives the server a
+ * queryable history for `/api/commands` and snapshot enrichment.
+ */
+export declare class HqCommandAuditLog {
+    private readonly entries;
+    private readonly max;
+    constructor(max?: number);
+    record(entry: HqCommandAuditEntry): void;
+    update(commandId: string, patch: Partial<HqCommandAuditEntry>): void;
+    /** Update only when the command belongs to the authenticated client. */
+    updateForClient(commandId: string, clientId: string, patch: Partial<HqCommandAuditEntry>): boolean;
+    recent(limit?: number): HqCommandAuditEntry[];
+}
+//# sourceMappingURL=commands.d.ts.map

package/dist/hq/commands.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"commands.d.ts","sourceRoot":"","sources":["../../src/hq/commands.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAIrD,4EAA4E;AAC5E,eAAO,MAAM,gBAAgB,YAC3B,OAAO,EACP,KAAK,EACL,OAAO,EACP,OAAO,EACP,OAAO,EACP,WAAW,EACX,aAAa,CACL,CAAC;AAEX,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE9D,8DAA8D;AAC9D,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,OAAO,CAAC;IACd,+FAA+F;IAC/F,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAC;CACtC;AAED;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,KAAK,CAAC;IACZ,+FAA+F;IAC/F,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAC;CACtC;AAED;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,OAAO,CAAC;IACd,+FAA+F;IAC/F,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAC;CACtC;AAED,0CAA0C;AAC1C,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,OAAO,CAAC;IACd,gGAAgG;IAChG,MAAM,EAAE,QAAQ,GAAG,OAAO,GAAG,MAAM,CAAC;CACrC;AAED,0CAA0C;AAC1C,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,OAAO,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,sDAAsD;IACtD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,yEAAyE;AACzE,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,WAAW,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAC;CACtC;AAED,6EAA6E;AAC7E,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,aAAa,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,yEAAyE;IACzE,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,MAAM,SAAS,GACjB,cAAc,GACd,YAAY,GACZ,cAAc,GACd,cAAc,GACd,cAAc,GACd,kBAAkB,GAClB,mBAAmB,CAAC;AAMxB;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,eAAe,GAAG,SAAS,GAAG,IAAI,CA8D3E;AAID,MAAM,WAAW,mBAAmB;IAClC,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,aAAa,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,gFAAgF;IAChF,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,QAAQ,GAAG,WAAW,GAAG,OAAO,CAAC;IACzC,gDAAgD;IAChD,SAAS,CAAC,EAAE,UAAU,GAAG,WAAW,GAAG,QAAQ,GAAG,UAAU,CAAC;IAC7D,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;GAIG;AACH,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA6B;IACrD,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAS;IAE7B,YAAY,GAAG,SAAO,EAErB;IAED,MAAM,CAAC,KAAK,EAAE,mBAAmB,GAAG,IAAI,CAKvC;IAED,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,mBAAmB,CAAC,GAAG,IAAI,CAGnE;IAED,wEAAwE;IACxE,eAAe,CACb,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,OAAO,CAAC,mBAAmB,CAAC,GAClC,OAAO,CAOT;IAED,MAAM,CAAC,KAAK,SAAM,GAAG,mBAAmB,EAAE,CAEzC;CACF"}

package/dist/hq/cost-bridge.d.ts

@@ -0,0 +1,36 @@
+/**
+ * CostTelemetryBridge — forwards local token/cost accounting events to the HQ
+ * publisher as `session.usage` envelopes, giving the command center the
+ * granular per-call cost signal it needs to render live cost trends and
+ * roll-ups across every connected machine.
+ *
+ * Source: the `token.accounted` EventBus event, emitted by the TokenCounter
+ * (`infrastructure/token-counter.ts`) after every provider call. The payload
+ * is plain serializable data (usage counts + a cost breakdown) — no closures.
+ *
+ * This is the high-frequency cost feed; HQ's persistence layer (Phase 2)
+ * time-buckets these into trend series.
+ *
+ * @module hq/cost-bridge
+ */
+import type { EventBus } from '../kernel/events.js';
+import type { HqEventEnvelope } from './protocol.js';
+import type { HqPublisher } from './publisher.js';
+export interface CostTelemetryBridgeOptions {
+    /** Local EventBus emitting `token.accounted`. */
+    events: EventBus;
+    /** HQ publisher to forward envelopes to. */
+    publisher: HqPublisher;
+    /** Optional sessionId to tag envelopes with (overrides the event's, when set). */
+    sessionId?: string;
+    /** Override `now()` for deterministic tests. */
+    now?: () => string;
+}
+/**
+ * Start forwarding token/cost events to HQ. Returns a disposer that
+ * unsubscribes the listener — call on shutdown.
+ */
+export declare function startCostTelemetryBridge(opts: CostTelemetryBridgeOptions): () => void;
+/** Re-export for type-only consumers. */
+export type { HqEventEnvelope };
+//# sourceMappingURL=cost-bridge.d.ts.map

package/dist/hq/cost-bridge.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cost-bridge.d.ts","sourceRoot":"","sources":["../../src/hq/cost-bridge.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAEpD,OAAO,KAAK,EAAE,eAAe,EAAkB,MAAM,eAAe,CAAC;AACrE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAElD,MAAM,WAAW,0BAA0B;IACzC,iDAAiD;IACjD,MAAM,EAAE,QAAQ,CAAC;IACjB,4CAA4C;IAC5C,SAAS,EAAE,WAAW,CAAC;IACvB,kFAAkF;IAClF,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,gDAAgD;IAChD,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAQD;;;GAGG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,0BAA0B,GAAG,MAAM,IAAI,CA2BrF;AAED,yCAAyC;AACzC,YAAY,EAAE,eAAe,EAAE,CAAC"}

package/dist/hq/factory.d.ts

@@ -0,0 +1,69 @@
+import { GlobalMailbox } from '../coordination/global-mailbox.js';
+import type { EventBus } from '../kernel/events.js';
+import type { HqClientConfig } from '../types/config.js';
+import type { Logger } from '../types/logger.js';
+import type { HqClientCapability, HqClientIdentity, HqRedactionPolicy } from './protocol.js';
+import { HqPublisher, type HqPublisherCommandHandler, type HqSocketFactory } from './publisher.js';
+export interface HqPublisherEnvConfig {
+    url: string;
+    token?: string;
+    enabled?: boolean;
+    rawContent?: boolean;
+    projectAlias?: string;
+    /**
+     * Same-machine auto-discovery mode: no explicit URL was configured, so the
+     * publisher should re-resolve the endpoint from `<dataDir>/runtime.json`
+     * (+ the first client token in `auth.json`) before every connect attempt.
+     * This lets every client on the machine attach to a `wstack --hq` that is
+     * already running, starts later, or restarts on a different port.
+     */
+    discover?: boolean;
+    /** Resolved HQ data dir the discovery reads from. */
+    dataDir?: string;
+}
+/**
+ * Discover a locally running `wstack --hq` endpoint: reads the runtime
+ * marker (pid-liveness-checked) and the first client token. Returns
+ * `undefined` when no live HQ is advertised on this machine.
+ */
+export declare function discoverLocalHqEndpoint(options?: {
+    dataDir?: string | undefined;
+    env?: NodeJS.ProcessEnv | undefined;
+}): {
+    url: string;
+    token?: string | undefined;
+} | undefined;
+export declare function resolveHqConfigFromEnv(env?: NodeJS.ProcessEnv): HqPublisherEnvConfig | undefined;
+export declare function resolveHqConfig(options?: {
+    env?: NodeJS.ProcessEnv | undefined;
+    config?: HqClientConfig | undefined;
+}): HqPublisherEnvConfig | undefined;
+export interface CreateHqPublisherOptions {
+    clientKind: HqClientIdentity['kind'];
+    projectRoot: string;
+    projectName?: string;
+    machineId?: string;
+    hostnameOverride?: string;
+    socketFactory?: HqSocketFactory;
+    config?: HqPublisherEnvConfig;
+    appConfig?: {
+        hq?: HqClientConfig | undefined;
+    } | undefined;
+    redactionPolicy?: Partial<HqRedactionPolicy>;
+    /** Forwarded to the HqPublisher constructor (Phase 4 control plane). */
+    capabilities?: readonly HqClientCapability[];
+    /** Forwarded to the HqPublisher constructor (Phase 4 control plane). */
+    onCommand?: HqPublisherCommandHandler;
+    /** Dormant discovery re-check interval override (tests / tight loops). */
+    discoveryPollMs?: number;
+    /** Logger for structured connect-failure diagnostics. */
+    logger?: Logger | undefined;
+}
+export declare function createHqPublisherFromEnv(options: CreateHqPublisherOptions): HqPublisher | undefined;
+export interface CreateGlobalMailboxOptions {
+    projectDir: string;
+    events?: EventBus;
+    hqPublisher?: HqPublisher;
+}
+export declare function createGlobalMailbox(options: CreateGlobalMailboxOptions): GlobalMailbox;
+//# sourceMappingURL=factory.d.ts.map

package/dist/hq/factory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"factory.d.ts","sourceRoot":"","sources":["../../src/hq/factory.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,aAAa,EAAE,MAAM,mCAAmC,CAAC;AAClE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAOjD,OAAO,KAAK,EACV,kBAAkB,EAClB,gBAAgB,EAEhB,iBAAiB,EAClB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,WAAW,EAAE,KAAK,yBAAyB,EAAE,KAAK,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAEnG,MAAM,WAAW,oBAAoB;IACnC,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,qDAAqD;IACrD,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,GAAE;IAC/C,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,GAAG,SAAS,CAAC;CAChC,GAAG;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,GAAG,SAAS,CAM/D;AA2BD,wBAAgB,sBAAsB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,oBAAoB,GAAG,SAAS,CAE7G;AAED,wBAAgB,eAAe,CAAC,OAAO,GAAE;IACvC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,GAAG,SAAS,CAAC;IACpC,MAAM,CAAC,EAAE,cAAc,GAAG,SAAS,CAAC;CAChC,GAAG,oBAAoB,GAAG,SAAS,CAgExC;AAaD,MAAM,WAAW,wBAAwB;IACvC,UAAU,EAAE,gBAAgB,CAAC,MAAM,CAAC,CAAC;IACrC,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,aAAa,CAAC,EAAE,eAAe,CAAC;IAChC,MAAM,CAAC,EAAE,oBAAoB,CAAC;IAC9B,SAAS,CAAC,EAAE;QAAE,EAAE,CAAC,EAAE,cAAc,GAAG,SAAS,CAAA;KAAE,GAAG,SAAS,CAAC;IAC5D,eAAe,CAAC,EAAE,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAC7C,wEAAwE;IACxE,YAAY,CAAC,EAAE,SAAS,kBAAkB,EAAE,CAAC;IAC7C,wEAAwE;IACxE,SAAS,CAAC,EAAE,yBAAyB,CAAC;IACtC,0EAA0E;IAC1E,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,yDAAyD;IACzD,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC7B;AAED,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,wBAAwB,GAAG,WAAW,GAAG,SAAS,CAmDnG;AAED,MAAM,WAAW,0BAA0B;IACzC,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,QAAQ,CAAC;IAClB,WAAW,CAAC,EAAE,WAAW,CAAC;CAC3B;AAED,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,0BAA0B,GAAG,aAAa,CAEtF"}

package/dist/hq/fleet-bridge.d.ts

@@ -0,0 +1,39 @@
+/**
+ * FleetTelemetryBridge — forwards local multi-agent coordinator stats to the
+ * HQ publisher as `fleet.snapshot` envelopes, so the command center can render
+ * a global fleet roll-up (queued/completed/failed tasks, per-subagent status,
+ * fleet cost) across every connected machine.
+ *
+ * Source: the `coordinator.stats` EventBus event (originating on the FleetBus
+ * and re-emitted onto the host EventBus by `fleet/host.ts`). All payload
+ * fields are plain serializable data — no closures, no decoupled relay needed.
+ *
+ * The snapshot is republished on every `coordinator.stats` change (hash-dedup,
+ * mirroring {@link startSessionTelemetryBridge}) so the HQ browser sees live
+ * fleet counters without polling.
+ *
+ * @module hq/fleet-bridge
+ */
+import type { EventBus } from '../kernel/events.js';
+import type { HqEventEnvelope } from './protocol.js';
+import type { HqPublisher } from './publisher.js';
+export interface FleetTelemetryBridgeOptions {
+    /** Local EventBus emitting `coordinator.stats` (host EventBus after the FleetBus hop). */
+    events: EventBus;
+    /** HQ publisher to forward envelopes to. */
+    publisher: HqPublisher;
+    /** Coordinator run id — identifies this fleet instance. Falls back to a stable per-session id. */
+    runId: string;
+    /** Optional sessionId to tag envelopes with. */
+    sessionId?: string;
+    /** Override `now()` for deterministic tests. */
+    now?: () => string;
+}
+/**
+ * Start forwarding coordinator stats to HQ. Returns a disposer that
+ * unsubscribes the listener — call on shutdown.
+ */
+export declare function startFleetTelemetryBridge(opts: FleetTelemetryBridgeOptions): () => void;
+/** Re-export for type-only consumers. */
+export type { HqEventEnvelope };
+//# sourceMappingURL=fleet-bridge.d.ts.map

package/dist/hq/fleet-bridge.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fleet-bridge.d.ts","sourceRoot":"","sources":["../../src/hq/fleet-bridge.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,KAAK,EAAE,eAAe,EAA6C,MAAM,eAAe,CAAC;AAChG,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAElD,MAAM,WAAW,2BAA2B;IAC1C,0FAA0F;IAC1F,MAAM,EAAE,QAAQ,CAAC;IACjB,4CAA4C;IAC5C,SAAS,EAAE,WAAW,CAAC;IACvB,kGAAkG;IAClG,KAAK,EAAE,MAAM,CAAC;IACd,gDAAgD;IAChD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,gDAAgD;IAChD,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAED;;;GAGG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,2BAA2B,GAAG,MAAM,IAAI,CAiDvF;AAiBD,yCAAyC;AACzC,YAAY,EAAE,eAAe,EAAE,CAAC"}