@wrongstack/core 0.291.1 → 0.292.0

package/dist/execution/intelligent-compactor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"intelligent-compactor.d.ts","sourceRoot":"","sources":["../../src/execution/intelligent-compactor.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAGlD,OAAO,KAAK,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAEtE,OAAO,KAAK,EAAE,QAAQ,EAAW,MAAM,sBAAsB,CAAC;AAC9D,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAY7D;;GAEG;AACH,MAAM,WAAW,2BAA2B;IAC1C,gEAAgE;IAChE,QAAQ,EAAE,QAAQ,CAAC;IACnB,oEAAoE;IACpE,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC,2EAA2E;IAC3E,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC,0EAA0E;IAC1E,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC,4EAA4E;IAC5E,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,6EAA6E;IAC7E,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,6EAA6E;IAC7E,cAAc,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,gDAAgD;IAChD,gBAAgB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC;;;;;OAKG;IACH,eAAe,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACrC;;;;OAIG;IACH,mBAAmB,CAAC,EAAE,mBAAmB,GAAG,SAAS,CAAC;CACvD;AAED;;GAEG;AACH;;;;;;;;;GASG;AACH,qBAAa,oBAAqB,YAAW,SAAS;IACpD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAW;IACpC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAS;IACvC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAS;IACvC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAS;IACvC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAS;IACxC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAS;IAC1C,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAqB;IACtD,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAkC;IAEvE,YAAY,IAAI,EAAE,2BAA2B,EAa5C;IAEK,OAAO,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,GAAE;QAAE,UAAU,CAAC,EAAE,OAAO,GAAG,SAAS,CAAA;KAAO,GAAG,OAAO,CAAC,aAAa,CAAC,CAmDnG;IAED;;;OAGG;IACH,OAAO,CAAC,mBAAmB;IAI3B,2EAA2E;IAC3E,OAAO,CAAC,KAAK;YASC,qBAAqB;YA6CrB,cAAc;IAmD5B,OAAO,CAAC,cAAc;IAgBtB,iEAAiE;IACjE,OAAO,CAAC,iBAAiB;CAe1B"}
+{"version":3,"file":"intelligent-compactor.d.ts","sourceRoot":"","sources":["../../src/execution/intelligent-compactor.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAGlD,OAAO,KAAK,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAEtE,OAAO,KAAK,EAAE,QAAQ,EAAW,MAAM,sBAAsB,CAAC;AAC9D,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAkB7D;;GAEG;AACH,MAAM,WAAW,2BAA2B;IAC1C,gEAAgE;IAChE,QAAQ,EAAE,QAAQ,CAAC;IACnB,oEAAoE;IACpE,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC,2EAA2E;IAC3E,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC,0EAA0E;IAC1E,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC,4EAA4E;IAC5E,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,6EAA6E;IAC7E,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,6EAA6E;IAC7E,cAAc,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,gDAAgD;IAChD,gBAAgB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC;;;;;OAKG;IACH,eAAe,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACrC;;;;OAIG;IACH,mBAAmB,CAAC,EAAE,mBAAmB,GAAG,SAAS,CAAC;CACvD;AAED;;GAEG;AACH;;;;;;;;;GASG;AACH,qBAAa,oBAAqB,YAAW,SAAS;IACpD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAW;IACpC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAS;IACvC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAS;IACvC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAS;IACvC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAS;IACxC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAS;IAC1C,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAqB;IACtD,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAkC;IAEvE,YAAY,IAAI,EAAE,2BAA2B,EAa5C;IAEK,OAAO,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,GAAE;QAAE,UAAU,CAAC,EAAE,OAAO,GAAG,SAAS,CAAA;KAAO,GAAG,OAAO,CAAC,aAAa,CAAC,CAsEnG;IAED;;;OAGG;IACH,OAAO,CAAC,mBAAmB;IAI3B,2EAA2E;IAC3E,OAAO,CAAC,KAAK;YASC,qBAAqB;YA6CrB,cAAc;IAmD5B,OAAO,CAAC,cAAc;IAgBtB,iEAAiE;IACjE,OAAO,CAAC,iBAAiB;CAe1B"}

package/dist/execution/model-runtime.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"model-runtime.d.ts","sourceRoot":"","sources":["../../src/execution/model-runtime.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,EACV,YAAY,EACZ,eAAe,EAEf,OAAO,EAER,MAAM,sBAAsB,CAAC;AAC9B,OAAO,KAAK,EAAE,kBAAkB,EAAE,4BAA4B,EAAE,MAAM,oBAAoB,CAAC;AAE3F,MAAM,WAAW,oBAAoB;IACnC,SAAS,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;IAChC,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IACxB,qEAAqE;IACrE,UAAU,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,SAAS,CAAC;IACzC,6EAA6E;IAC7E,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,kBAAkB,GAAG,SAAS,EACpC,QAAQ,EAAE,kBAAkB,GAAG,SAAS,GACvC,kBAAkB,GAAG,SAAS,CAmBhC;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,kBAAkB,GAAG,SAAS,EACxC,SAAS,EAAE,eAAe,GAAG,SAAS,EACtC,YAAY,CAAC,EAAE,YAAY,GAAG,SAAS,GACtC,oBAAoB,CAgBtB;AAED,wBAAgB,0BAA0B,CACxC,QAAQ,EAAE,kBAAkB,EAC5B,EAAE,EAAE,eAAe,GAAG,SAAS,EAC/B,QAAQ,EAAE,MAAM,EAAE,GACjB,OAAO,CAAC,WAAW,CAAC,CAmEtB;AAED,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,kBAAkB,EAC5B,SAAS,EAAE,MAAM,EAAE,GAClB,OAAO,CAAC,OAAO,CAAC,CAKlB;AAED;;;;;GAKG;AACH,wBAAgB,2BAA2B,CACzC,MAAM,EAAE,4BAA4B,GAAG,SAAS,EAChD,IAAI,EAAE,YAAY,GAAG,SAAS,EAC9B,SAAS,EAAE,MAAM,EAAE,GAClB,OAAO,CAAC,OAAO,CAAC,GAAG,SAAS,CA4B9B;AAED,MAAM,WAAW,6BAA6B;IAC5C,qEAAqE;IACrE,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,kEAAkE;IAClE,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,0EAA0E;IAC1E,WAAW,IAAI,kBAAkB,GAAG,SAAS,CAAC;IAC9C,4DAA4D;IAC5D,kBAAkB,IAAI,eAAe,GAAG,SAAS,CAAC;IAClD,2EAA2E;IAC3E,eAAe,CAAC,IAAI,YAAY,GAAG,SAAS,CAAC;IAC7C,8EAA8E;IAC9E,SAAS,CAAC,EAAE,CAAC,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC,GAAG,SAAS,CAAC;CACrD;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAC/B,GAAG,EAAE,OAAO,EACZ,IAAI,EAAE,6BAA6B,GAClC,OAAO,CAmBT"}
+{"version":3,"file":"model-runtime.d.ts","sourceRoot":"","sources":["../../src/execution/model-runtime.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,EACV,YAAY,EACZ,eAAe,EAEf,OAAO,EAER,MAAM,sBAAsB,CAAC;AAC9B,OAAO,KAAK,EAAE,kBAAkB,EAAE,4BAA4B,EAAE,MAAM,oBAAoB,CAAC;AAE3F,MAAM,WAAW,oBAAoB;IACnC,SAAS,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;IAChC,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IACxB,qEAAqE;IACrE,UAAU,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,SAAS,CAAC;IACzC,6EAA6E;IAC7E,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,kBAAkB,GAAG,SAAS,EACpC,QAAQ,EAAE,kBAAkB,GAAG,SAAS,GACvC,kBAAkB,GAAG,SAAS,CAmBhC;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,kBAAkB,GAAG,SAAS,EACxC,SAAS,EAAE,eAAe,GAAG,SAAS,EACtC,YAAY,CAAC,EAAE,YAAY,GAAG,SAAS,GACtC,oBAAoB,CAgBtB;AAED,wBAAgB,0BAA0B,CACxC,QAAQ,EAAE,kBAAkB,EAC5B,EAAE,EAAE,eAAe,GAAG,SAAS,EAC/B,QAAQ,EAAE,MAAM,EAAE,GACjB,OAAO,CAAC,WAAW,CAAC,CAmEtB;AAED,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,kBAAkB,EAC5B,SAAS,EAAE,MAAM,EAAE,GAClB,OAAO,CAAC,OAAO,CAAC,CAKlB;AAED;;;;;GAKG;AACH,wBAAgB,2BAA2B,CACzC,MAAM,EAAE,4BAA4B,GAAG,SAAS,EAChD,IAAI,EAAE,YAAY,GAAG,SAAS,EAC9B,SAAS,EAAE,MAAM,EAAE,GAClB,OAAO,CAAC,OAAO,CAAC,GAAG,SAAS,CA4B9B;AAED,MAAM,WAAW,6BAA6B;IAC5C,qEAAqE;IACrE,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,kEAAkE;IAClE,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,0EAA0E;IAC1E,WAAW,IAAI,kBAAkB,GAAG,SAAS,CAAC;IAC9C,4DAA4D;IAC5D,kBAAkB,IAAI,eAAe,GAAG,SAAS,CAAC;IAClD,2EAA2E;IAC3E,eAAe,CAAC,IAAI,YAAY,GAAG,SAAS,CAAC;IAC7C,8EAA8E;IAC9E,SAAS,CAAC,EAAE,CAAC,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC,GAAG,SAAS,CAAC;CACrD;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAC/B,GAAG,EAAE,OAAO,EACZ,IAAI,EAAE,6BAA6B,GAClC,OAAO,CAsBT"}

package/dist/execution/selective-compactor.d.ts

@@ -55,6 +55,13 @@ export declare class SelectiveCompactor implements Compactor {
     compact(ctx: Context, opts?: {
         aggressive?: boolean | undefined;
     }): Promise<CompactReport>;
+    /**
+     * Compute after-tokens, run the shared quality check, inject the evidence
+     * floor when compaction dropped the intent/path anchor, and assemble the
+     * report — shared by both exit paths so every SelectiveCompactor run reports
+     * quality and carries a `[context_state]` evidence digest like the others.
+     */
+    private finalize;
     /**
      * Estimate the full API request token count: messages + systemPrompt + toolDefs.
      * This is the accurate figure for context-window pressure monitoring.
@@ -73,6 +80,7 @@ export declare class SelectiveCompactor implements Compactor {
     private executePlan;
     private summarizeRange;
     private messagePreview;
+    private toolEvidence;
     /**
      * Fallback when selector fails: aggressively trim from the oldest end
      * until we hit targetBudget.
@@ -80,6 +88,8 @@ export declare class SelectiveCompactor implements Compactor {
     private aggressiveRecencyTrim;
     private computeTargetBudget;
     private eliseOldToolResults;
+    /** Collapse superseded repeated reads that slipped under the elise threshold. */
+    private dedupStaleReads;
     private hasTextContent;
     /**
      * Estimate message-array tokens via the shared `estimateMessages` primitive

package/dist/execution/selective-compactor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"selective-compactor.d.ts","sourceRoot":"","sources":["../../src/execution/selective-compactor.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAGlD,OAAO,KAAK,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAEtE,OAAO,KAAK,EAAE,QAAQ,EAAW,MAAM,sBAAsB,CAAC;AAC9D,OAAO,KAAK,EAAE,eAAe,EAAkB,MAAM,sBAAsB,CAAC;AAS5E;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACxC,gEAAgE;IAChE,QAAQ,EAAE,QAAQ,CAAC;IACnB,mDAAmD;IACnD,QAAQ,CAAC,EAAE,eAAe,GAAG,SAAS,CAAC;IACvC,oEAAoE;IACpE,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC,2EAA2E;IAC3E,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC,0EAA0E;IAC1E,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC,uEAAuE;IACvE,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,6EAA6E;IAC7E,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,6EAA6E;IAC7E,cAAc,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,wEAAwE;IACxE,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC,mEAAmE;IACnE,uBAAuB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7C,8EAA8E;IAC9E,eAAe,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACrC,yCAAyC;IACzC,gBAAgB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACvC;AAED;;;;;;;;GAQG;AACH,qBAAa,kBAAmB,YAAW,SAAS;IAClD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAW;IACpC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAkB;IAC3C,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAS;IACvC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAS;IACvC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAS;IACvC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAS;IACxC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAqB;IACrD,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAS;IAE1C,YAAY,IAAI,EAAE,yBAAyB,EA0B1C;IAEK,OAAO,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,GAAE;QAAE,UAAU,CAAC,EAAE,OAAO,GAAG,SAAS,CAAA;KAAO,GAAG,OAAO,CAAC,aAAa,CAAC,CAkDnG;IAED;;;OAGG;IACH,OAAO,CAAC,mBAAmB;IAK3B,OAAO,CAAC,uBAAuB;IAY/B;;;OAGG;YACW,WAAW;IAkBzB;;;OAGG;YACW,WAAW;YA6BX,cAAc;IA6B5B,OAAO,CAAC,cAAc;IAStB;;;OAGG;IACH,OAAO,CAAC,qBAAqB;IA8B7B,OAAO,CAAC,mBAAmB;IAU3B,OAAO,CAAC,mBAAmB;IAa3B,OAAO,CAAC,cAAc;IAKtB;;;;;;;OAOG;IACH,OAAO,CAAC,cAAc;CAGvB"}
+{"version":3,"file":"selective-compactor.d.ts","sourceRoot":"","sources":["../../src/execution/selective-compactor.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAGlD,OAAO,KAAK,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAEtE,OAAO,KAAK,EAAE,QAAQ,EAAW,MAAM,sBAAsB,CAAC;AAC9D,OAAO,KAAK,EAAE,eAAe,EAAkB,MAAM,sBAAsB,CAAC;AAiB5E;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACxC,gEAAgE;IAChE,QAAQ,EAAE,QAAQ,CAAC;IACnB,mDAAmD;IACnD,QAAQ,CAAC,EAAE,eAAe,GAAG,SAAS,CAAC;IACvC,oEAAoE;IACpE,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC,2EAA2E;IAC3E,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC,0EAA0E;IAC1E,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC,uEAAuE;IACvE,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,6EAA6E;IAC7E,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,6EAA6E;IAC7E,cAAc,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,wEAAwE;IACxE,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC,mEAAmE;IACnE,uBAAuB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7C,8EAA8E;IAC9E,eAAe,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACrC,yCAAyC;IACzC,gBAAgB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACvC;AAED;;;;;;;;GAQG;AACH,qBAAa,kBAAmB,YAAW,SAAS;IAClD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAW;IACpC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAkB;IAC3C,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAS;IACvC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAS;IACvC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAS;IACvC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAS;IACxC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAqB;IACrD,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAS;IAE1C,YAAY,IAAI,EAAE,yBAAyB,EA0B1C;IAEK,OAAO,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,GAAE;QAAE,UAAU,CAAC,EAAE,OAAO,GAAG,SAAS,CAAA;KAAO,GAAG,OAAO,CAAC,aAAa,CAAC,CAoCnG;IAED;;;;;OAKG;IACH,OAAO,CAAC,QAAQ;IA8BhB;;;OAGG;IACH,OAAO,CAAC,mBAAmB;IAK3B,OAAO,CAAC,uBAAuB;IAY/B;;;OAGG;YACW,WAAW;IAkBzB;;;OAGG;YACW,WAAW;YA2CX,cAAc;IA6B5B,OAAO,CAAC,cAAc;IAItB,OAAO,CAAC,YAAY;IAapB;;;OAGG;IACH,OAAO,CAAC,qBAAqB;IA8B7B,OAAO,CAAC,mBAAmB;IAU3B,OAAO,CAAC,mBAAmB;IAa3B,iFAAiF;IACjF,OAAO,CAAC,eAAe;IAQvB,OAAO,CAAC,cAAc;IAKtB;;;;;;;OAOG;IACH,OAAO,CAAC,cAAc;CAGvB"}

package/dist/execution/subagent-compaction.d.ts

@@ -0,0 +1,24 @@
+import type { AgentPipelines } from '../core/agent-types.js';
+import type { Context } from '../core/context.js';
+import type { EventBus } from '../kernel/events.js';
+import { type ContextWindowConfigLike } from '../types/context-window.js';
+import { AutoCompactionMiddleware } from './auto-compaction-middleware.js';
+/**
+ * Install proactive auto-compaction into a subagent's context-window pipeline.
+ *
+ * Subagents (CLI fleet host, the light webui/SDD factory) build their pipelines
+ * with `createDefaultPipelines()` and historically registered nothing on
+ * `contextWindow`, so they had **no proactive compaction** — they grew until a
+ * provider rejected the request and only then recovered reactively. This wires
+ * the same rule-based `HybridCompactor` + `AutoCompactionMiddleware` the leader
+ * uses, so a subagent shrinks on the warn/soft/hard thresholds (and gets the
+ * last-resort emergency trim) exactly like the leader.
+ *
+ * No custom estimator is passed: the middleware's internal
+ * `estimateRequestTokensCalibrated` default already applies per-(provider,model)
+ * calibration, which is what a subagent wants. Returns the middleware (so the
+ * caller could toggle it) or `undefined` when the provider window is unknown
+ * (0), in which case compaction is skipped rather than guessing a denominator.
+ */
+export declare function installSubagentAutoCompaction(pipelines: AgentPipelines, ctx: Context, contextConfig: ContextWindowConfigLike | undefined, events?: EventBus | undefined): AutoCompactionMiddleware | undefined;
+//# sourceMappingURL=subagent-compaction.d.ts.map

package/dist/execution/subagent-compaction.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"subagent-compaction.d.ts","sourceRoot":"","sources":["../../src/execution/subagent-compaction.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EACL,KAAK,uBAAuB,EAE7B,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,wBAAwB,EAAE,MAAM,iCAAiC,CAAC;AAG3E;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,6BAA6B,CAC3C,SAAS,EAAE,cAAc,EACzB,GAAG,EAAE,OAAO,EACZ,aAAa,EAAE,uBAAuB,GAAG,SAAS,EAClD,MAAM,CAAC,EAAE,QAAQ,GAAG,SAAS,GAC5B,wBAAwB,GAAG,SAAS,CAuCtC"}

package/dist/hq/alerts.d.ts

@@ -30,6 +30,11 @@ export interface HqAlertRuleConfig {
     staleMachineSeconds?: number;
     /** Minimum number of active agents before concurrency alert fires. Default: disabled (0). */
     maxAgents?: number;
+    /**
+     * Hours before expiry at which the `token-expiry-imminent` warning fires.
+     * Default 24. Set to 0 to disable the warning entirely (expired-only alert remains).
+     */
+    tokenExpiryWarningHours?: number;
 }
 /**
  * In-memory alert state. Tracks which rules are currently firing so the same

package/dist/hq/alerts.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"alerts.d.ts","sourceRoot":"","sources":["../../src/hq/alerts.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAEhE,oEAAoE;AACpE,MAAM,MAAM,eAAe,GAAG,cAAc,CAAC,UAAU,CAAC,CAAC;AAEzD,MAAM,WAAW,OAAO;IACtB,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,eAAe,CAAC;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,kEAAkE;IAClE,YAAY,EAAE,MAAM,CAAC;IACrB,uEAAuE;IACvE,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,iBAAiB;IAChC,6EAA6E;IAC7E,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,oFAAoF;IACpF,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,6FAA6F;IAC7F,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AA8ED;;;;GAIG;AACH,qBAAa,aAAa;IACxB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA8B;IACrD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAiB;IACzC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,KAAK,CAA+C;IAC5D,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA2B;IACnD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAyC;IAEpE,YAAY,IAAI,EAAE;QAChB,OAAO,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,CAAC;QAClC,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,yEAAyE;QACzE,SAAS,CAAC,EAAE,CAAC,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,CAAC,GAAG,SAAS,CAAC;KACpD,EAIA;IAED;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,EAAE,UAAU,GAAG,IAAI,EAAE,MAAM,CAAC,EAAE,iBAAiB,EAAE,GAAG,GAAE,MAAmB,GAAG,OAAO,EAAE,CAyCrG;IAED,wCAAwC;IACxC,YAAY,IAAI,OAAO,EAAE,CAExB;IAED,6DAA6D;IAC7D,YAAY,CAAC,KAAK,SAAM,GAAG,OAAO,EAAE,CAEnC;IAED,gFAAgF;IAChF,IAAI,CAAC,MAAM,EAAE,SAAS,OAAO,EAAE,GAAG,IAAI,CAOrC;IAED;;;OAGG;IACH,aAAa,CACX,WAAW,EAAE,MAAM,UAAU,GAAG,IAAI,EACpC,MAAM,CAAC,EAAE,iBAAiB,GAAG,CAAC,MAAM,iBAAiB,GAAG,SAAS,CAAC,EAClE,UAAU,SAAS,GAClB,MAAM,IAAI,CAkBZ;CACF;AAED,0EAA0E;AAC1E,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,cAAc,CAO7D"}
+{"version":3,"file":"alerts.d.ts","sourceRoot":"","sources":["../../src/hq/alerts.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAEhE,oEAAoE;AACpE,MAAM,MAAM,eAAe,GAAG,cAAc,CAAC,UAAU,CAAC,CAAC;AAEzD,MAAM,WAAW,OAAO;IACtB,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,eAAe,CAAC;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,kEAAkE;IAClE,YAAY,EAAE,MAAM,CAAC;IACrB,uEAAuE;IACvE,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,iBAAiB;IAChC,6EAA6E;IAC7E,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,oFAAoF;IACpF,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,6FAA6F;IAC7F,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;OAGG;IACH,uBAAuB,CAAC,EAAE,MAAM,CAAC;CAClC;AAoGD;;;;GAIG;AACH,qBAAa,aAAa;IACxB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA8B;IACrD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAiB;IACzC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,KAAK,CAA+C;IAC5D,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA2B;IACnD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAyC;IAEpE,YAAY,IAAI,EAAE;QAChB,OAAO,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,CAAC;QAClC,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,yEAAyE;QACzE,SAAS,CAAC,EAAE,CAAC,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,CAAC,GAAG,SAAS,CAAC;KACpD,EAIA;IAED;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,EAAE,UAAU,GAAG,IAAI,EAAE,MAAM,CAAC,EAAE,iBAAiB,EAAE,GAAG,GAAE,MAAmB,GAAG,OAAO,EAAE,CAyCrG;IAED,wCAAwC;IACxC,YAAY,IAAI,OAAO,EAAE,CAExB;IAED,6DAA6D;IAC7D,YAAY,CAAC,KAAK,SAAM,GAAG,OAAO,EAAE,CAEnC;IAED,gFAAgF;IAChF,IAAI,CAAC,MAAM,EAAE,SAAS,OAAO,EAAE,GAAG,IAAI,CAOrC;IAED;;;OAGG;IACH,aAAa,CACX,WAAW,EAAE,MAAM,UAAU,GAAG,IAAI,EACpC,MAAM,CAAC,EAAE,iBAAiB,GAAG,CAAC,MAAM,iBAAiB,GAAG,SAAS,CAAC,EAClE,UAAU,SAAS,GAClB,MAAM,IAAI,CAkBZ;CACF;AAED,0EAA0E;AAC1E,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,cAAc,CAO7D"}

package/dist/hq/auth-audit.d.ts

@@ -0,0 +1,115 @@
+/**
+ * HQ auth audit log — append-only JSONL record of token lifecycle events.
+ *
+ * Stored at `<dataDir>/auth-audit.jsonl`. One entry per token create /
+ * revoke / first-run mint / live-reload-driven expiry sweep. Never holds
+ * raw token strings — only the token id, label, scope, and actor.
+ *
+ * Design:
+ * - **Append-only.** Nothing ever rewrites or deletes lines. Rotation is
+ *   a separate operator concern (the file is bounded only by disk).
+ * - **Synchronous append** via `appendFileSync` so a power loss between
+ *   the CLI's mutate call and the audit write loses at most the audit
+ *   entry, never the auth state. Errors are swallowed (best-effort).
+ * - **Ring in memory** is intentionally NOT kept — this log is for
+ *   long-term forensic review, not for live UI rendering. The HQ server
+ *   doesn't load it; only the CLI mutators write to it.
+ * - **No PII.** `actor` is a free-form string the caller fills with
+ *   whatever identity context it has (CLI user, env var, machine id).
+ *   The token `id` is a UUID — safe to log. The token `token` string
+ *   is NEVER recorded.
+ *
+ * @module hq/auth-audit
+ */
+/** Scope of the token the event is about. */
+export type HqAuthAuditScope = 'browser' | 'client';
+/** Kind of event recorded. */
+export type HqAuthAuditKind = 
+/** Token created via `wstack hq token create` (or first-run mint). */
+'create'
+/** Token revoked via `wstack hq token revoke`. */
+ | 'revoke'
+/**
+ * First-run bootstrap — both browser and client tokens minted by
+ * `ensureHqFirstRunAuthFile`. Recorded once per fresh data dir;
+ * subsequent calls (existing auth.json) do not log.
+ */
+ | 'first-run'
+/**
+ * Operator edited `auth.json` directly and the HQ server's
+ * live-reload watcher pruned one or more tokens whose `expiresAt`
+ * had already passed. The entry records how many were pruned.
+ */
+ | 'expired-prune'
+/**
+ * Password rotation — the operator changed the browser password, which
+ * also rotated the cookie secret (invalidating all active sessions).
+ * Recorded by `ensureHqFirstRunAuthFile` for the password-change path.
+ */
+ | 'password-rotate';
+export interface HqAuthAuditEntry {
+    /** Epoch milliseconds when the event was recorded. */
+    at: number;
+    kind: HqAuthAuditKind;
+    scope: HqAuthAuditScope;
+    /** Token id (UUID) — safe to log. Never the token string. */
+    tokenId: string;
+    /** Human-readable label, when the token carried one. */
+    label?: string;
+    /** Capabilities granted to the token, when known. */
+    capabilities?: readonly string[];
+    /** Optional expiresAt timestamp on the token (ISO). */
+    expiresAt?: string;
+    /**
+     * Who performed the action. Free-form string — the CLI fills this with
+     * the OS user + hostname when available. Never contains the token string.
+     */
+    actor?: string;
+    /**
+     * For `expired-prune`: how many tokens were filtered out by the
+     * live-reload watcher in this reload. For other kinds: undefined.
+     */
+    prunedCount?: number;
+    /**
+     * SHA-256 hash (hex) of the redacted `auth.json` contents at the
+     * moment of the event — lets an operator reviewing the audit log tie
+     * an entry back to the exact on-disk state that produced it without
+     * the log ever holding derivable token material. Computed by
+     * `hqAuthContentHash` over a projection of the `HqAuthFile` with the
+     * raw token strings, `passwordHash`, and `cookieSecret` replaced by
+     * the constant sentinel `HQ_AUTH_CONTENT_HASH_REDACTED` (exported
+     * from `@wrongstack/core`) — so two files that differ only in secrets
+     * hash identically. Absent on entries emitted before the hash landed
+     * and when the file is unreadable at emit time. Re-derivable from the
+     * current `auth.json` via `hqAuthContentHash(await readHqAuthFile(dir))`.
+     */
+    contentHash?: string;
+}
+/** Path to `auth-audit.jsonl` under the given data dir. */
+export declare function hqAuthAuditPath(dataDir: string): string;
+/**
+ * Append a single audit entry to `<dataDir>/auth-audit.jsonl`.
+ *
+ * Best-effort: errors are swallowed and the optional `onError` callback
+ * is invoked instead. The caller's mutation (auth.json write, token
+ * mint, etc.) has already succeeded by the time this is called, so a
+ * failed audit append must never roll it back.
+ *
+ * The data dir is created if missing. The file is opened in append mode
+ * so concurrent writers (e.g. two CLI invocations) do not clobber each
+ * other — JSONL append is the safe granularity.
+ */
+export declare function appendHqAuthAudit(dataDir: string, entry: HqAuthAuditEntry, options?: {
+    onError?: (err: Error) => void;
+}): void;
+/**
+ * Convenience: build an entry with a sensible default `at` (now) and
+ * append it. The `at` field can still be overridden via the partial.
+ */
+export declare function logHqAuthAudit(dataDir: string, partial: Omit<HqAuthAuditEntry, 'at'> & {
+    at?: number;
+}, options?: {
+    onError?: (err: Error) => void;
+    now?: () => number;
+}): void;
+//# sourceMappingURL=auth-audit.d.ts.map

package/dist/hq/auth-audit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-audit.d.ts","sourceRoot":"","sources":["../../src/hq/auth-audit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAKH,6CAA6C;AAC7C,MAAM,MAAM,gBAAgB,GAAG,SAAS,GAAG,QAAQ,CAAC;AAEpD,8BAA8B;AAC9B,MAAM,MAAM,eAAe;AACzB,sEAAsE;AACpE,QAAQ;AACV,kDAAkD;GAChD,QAAQ;AACV;;;;GAIG;GACD,WAAW;AACb;;;;GAIG;GACD,eAAe;AACjB;;;;GAIG;GACD,iBAAiB,CAAC;AAEtB,MAAM,WAAW,gBAAgB;IAC/B,sDAAsD;IACtD,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,eAAe,CAAC;IACtB,KAAK,EAAE,gBAAgB,CAAC;IACxB,6DAA6D;IAC7D,OAAO,EAAE,MAAM,CAAC;IAChB,wDAAwD;IACxD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,qDAAqD;IACrD,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,uDAAuD;IACvD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;;;;;;;;OAYG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,2DAA2D;AAC3D,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAEvD;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,gBAAgB,EACvB,OAAO,CAAC,EAAE;IAAE,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,KAAK,KAAK,IAAI,CAAA;CAAE,GAC3C,IAAI,CAQN;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAC5B,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,IAAI,CAAC,gBAAgB,EAAE,IAAI,CAAC,GAAG;IAAE,EAAE,CAAC,EAAE,MAAM,CAAA;CAAE,EACvD,OAAO,CAAC,EAAE;IAAE,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,KAAK,KAAK,IAAI,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;CAAE,GAC/D,IAAI,CAKN"}

package/dist/hq/auth-store.d.ts

@@ -42,11 +42,37 @@ export interface HqToken {
      * granted.
      */
     capabilities?: string[];
+    /**
+     * Optional ISO timestamp after which the token is refused. When absent
+     * (the pre-TTL default), the token never expires. The HQ server rejects
+     * an expired token at both the HTTP and the WS-upgrade auth boundary,
+     * so TTL rotation is enforced even for long-lived browser sessions.
+     *
+     * The timestamp is wall-clock (`new Date().toISOString()`) — clock skew
+     * between the issuing HQ and the client just shifts the effective window
+     * slightly, which is acceptable for an operator-set rotation cadence.
+     */
+    expiresAt?: string;
 }
+/**
+ * True when a token has a wall-clock expiry that has already passed.
+ * Returns `false` when `expiresAt` is absent (the pre-TTL default).
+ *
+ * The check is fail-open for malformed values: an unparseable timestamp
+ * is treated as "no expiry" rather than "already expired", because the
+ * latter would lock the operator out of their own HQ on a bad file edit.
+ * Use {@link tokenHasCapability} at the auth boundary to also deny
+ * capabilities for expired tokens.
+ *
+ * @param at - epoch milliseconds; defaults to `Date.now()`. Exposed so
+ *   tests can inject a fixed clock.
+ */
+export declare function isTokenExpired(token: Pick<HqToken, 'expiresAt'> | undefined, at?: number): boolean;
 /**
  * Check whether a token grants a capability. A token with no `capabilities`
  * field is unrestricted (backward-compat). Otherwise the capability must be
- * explicitly listed.
+ * explicitly listed. **Expired tokens are refused regardless of capability**
+ * — call this at the auth boundary so TTL rotation is enforced uniformly.
  */
 export declare function tokenHasCapability(token: HqToken | undefined, capability: string): boolean;
 /**
@@ -86,6 +112,36 @@ export interface HqAuthFile {
 }
 /** An empty auth file — what a brand-new HQ install starts with. */
 export declare function emptyHqAuthFile(): HqAuthFile;
+/**
+ * Sentinel value `hqAuthContentHash` substitutes for every raw secret
+ * (`HqToken.token`, `HqAuthFile.passwordHash`, `HqAuthFile.cookieSecret`)
+ * before hashing. Exported so downstream consumers of the audit log can
+ * recognize the redaction shape without hardcoding the literal — e.g. a
+ * forensic tool that re-derives a `contentHash` from a known on-disk
+ * `auth.json` can substitute this same sentinel and compare.
+ */
+export declare const HQ_AUTH_CONTENT_HASH_REDACTED = "<redacted>";
+/**
+ * Compute a SHA-256 content hash over a *redacted* projection of an
+ * `HqAuthFile`. The projection replaces every raw token string, the
+ * `passwordHash`, and the `cookieSecret` with constant sentinels, so:
+ *
+ *   - the audit log never holds derivable token material (a hash of a
+ *     redacted projection can't be reversed to recover the originals),
+ *   - two files that differ only in their secrets hash identically
+ *     (reissuing a token without changing its id/label/expiry does not
+ *     change the hash), and
+ *   - the hash still flips whenever the structural state the operator
+ *     cares about (version, token ids/labels/capabilities/expiries,
+ *     alert rules, redaction policy) changes.
+ *
+ * Returns `undefined` when hashing or serialization throws (e.g. a
+ * future schema addition that isn't JSON-serializable) — callers
+ * should pass that through as an absent `contentHash` field rather
+ * than failing the audit append, matching the audit module's
+ * best-effort contract.
+ */
+export declare function hqAuthContentHash(file: HqAuthFile): string | undefined;
 /** Path to `auth.json` under the given data directory. */
 export declare function hqAuthFilePath(dataDir: string): string;
 /** Path to the best-effort runtime endpoint marker under the given data directory. */
@@ -117,6 +173,22 @@ export interface EnsureHqFirstRunAuthOptions {
     warn?: (msg: string) => void;
     /** Optional browser password login. Hashed with scrypt before storage. */
     password?: string;
+    /**
+     * Optional time-to-live (milliseconds) stamped on the first-run browser
+     * and client tokens. When set, both tokens carry an `expiresAt` and the
+     * HQ server will refuse them once it passes. Default: no expiry.
+     *
+     * Only affects tokens minted by THIS call (the first run). Tokens added
+     * later via `wstack hq token create` choose their own TTL.
+     */
+    tokenTtlMs?: number | undefined;
+    /**
+     * Optional `actor` string recorded in `auth-audit.jsonl` for the two
+     * `first-run` entries this function emits (one per minted token). The
+     * CLI fills this with `user@host`; when omitted the entry carries no
+     * `actor` field. Never contains the token string.
+     */
+    actor?: string | undefined;
 }
 export interface EnsureHqFirstRunAuthResult {
     authFile: HqAuthFile;
@@ -128,6 +200,13 @@ export interface EnsureHqFirstRunAuthResult {
  * Ensure a brand-new HQ data directory has the auth required for safe
  * first-run operation. Only a missing auth.json is bootstrapped; an existing
  * file, including one with empty token arrays, is treated as operator intent.
+ *
+ * Caller surface: the sole production caller is `startHqServer` in
+ * `packages/cli/src/hq-server.ts`, which threads `actor: resolveAuditActor()`
+ * so both first-run audit entries carry `user@host`. Test callers live under
+ * `packages/core/tests/hq/` (token-ttl, first-run-audit, auth-store). Any
+ * new production caller MUST pass `actor` for the audit log to carry
+ * forensic identity — see `EnsureHqFirstRunAuthOptions.actor`.
  */
 export declare function ensureHqFirstRunAuthFile(dataDir: string, opts?: EnsureHqFirstRunAuthOptions): Promise<EnsureHqFirstRunAuthResult>;
 /**
@@ -154,11 +233,28 @@ export declare function hashHqPassword(password: string): Promise<string>;
 export declare function verifyHqPassword(password: string, hash: string): Promise<boolean>;
 /** Mint a secret used to sign browser session cookies. */
 export declare function mintHqCookieSecret(): string;
+/**
+ * Options for {@link mintHqToken}.
+ *
+ * - `label` — human-readable identifier persisted alongside the token.
+ * - `ttlMs` — when set, the token is stamped with `expiresAt = now + ttlMs`.
+ *   Absent (the default) means the token never expires, preserving the
+ *   pre-TTL contract.
+ * - `now` — epoch milliseconds override for deterministic tests.
+ */
+export interface MintHqTokenOptions {
+    label?: string | undefined;
+    ttlMs?: number | undefined;
+    now?: number | undefined;
+}
 /**
  * Mint a fresh token. Used for both browser and client tokens; the caller
  * decides which list to append to.
+ *
+ * Pass an options object to stamp an `expiresAt`; the bare-string overload
+ * (`mintHqToken('my-label')`) is preserved for backward-compat.
  */
-export declare function mintHqToken(label?: string): HqToken;
+export declare function mintHqToken(labelOrOptions?: string | MintHqTokenOptions): HqToken;
 /**
  * Backward-compat alias for `mintHqToken`. Phase 3 callers/tests use this.
  */

package/dist/hq/auth-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-store.d.ts","sourceRoot":"","sources":["../../src/hq/auth-store.ts"],"names":[],"mappings":"AA8BA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAEvD,wEAAwE;AACxE,eAAO,MAAM,oBAAoB,EAAG,CAAU,CAAC;AAE/C,8EAA8E;AAC9E,wBAAgB,gBAAgB,IAAI,MAAM,CAEzC;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAIhG;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,OAAO;IACtB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;CACzB;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,SAAS,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAI1F;AAED;;;GAGG;AACH,MAAM,MAAM,cAAc,GAAG,OAAO,CAAC;AAErC,8CAA8C;AAC9C,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,OAAO,oBAAoB,CAAC;IACrC,SAAS,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,eAAe,CAAC,EAAE,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAC7C,sEAAsE;IACtE,aAAa,CAAC,EAAE,OAAO,EAAE,CAAC;IAC1B,oEAAoE;IACpE,YAAY,CAAC,EAAE,OAAO,EAAE,CAAC;IACzB,0DAA0D;IAC1D,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,mDAAmD;IACnD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,UAAU,CAAC,EAAE,iBAAiB,CAAC;CAChC;AAED,oEAAoE;AACpE,wBAAgB,eAAe,IAAI,UAAU,CAK5C;AAED,0DAA0D;AAC1D,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAEtD;AAED,sFAAsF;AACtF,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAEzD;AAED,wBAAsB,kBAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAM/G;AAYD,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS,CAahF;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,cAAc,CAClC,OAAO,EAAE,MAAM,EACf,KAAK,GAAE;IAAE,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAA;CAAO,GAC3C,OAAO,CAAC,UAAU,CAAC,CA8BrB;AAED;;;;GAIG;AACH,wBAAsB,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAQtF;AAED,MAAM,WAAW,2BAA2B;IAC1C,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7B,0EAA0E;IAC1E,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,EAAE,UAAU,CAAC;IACrB,OAAO,EAAE,OAAO,CAAC;IACjB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED;;;;GAIG;AACH,wBAAsB,wBAAwB,CAC5C,OAAO,EAAE,MAAM,EACf,IAAI,GAAE,2BAAgC,GACrC,OAAO,CAAC,0BAA0B,CAAC,CAgDrC;AAED;;;;;;;;;GASG;AACH,wBAAsB,gBAAgB,CACpC,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,CAAC,OAAO,EAAE,UAAU,KAAK,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,EAClE,IAAI,GAAE;IAAE,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAA;CAAO,GAC1C,OAAO,CAAC,UAAU,CAAC,CAKrB;AAMD;;;GAGG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAShE;AAED;;GAEG;AACH,wBAAsB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAmBvF;AAED,0DAA0D;AAC1D,wBAAgB,kBAAkB,IAAI,MAAM,CAE3C;AAED;;;GAGG;AACH,wBAAgB,WAAW,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAQnD;AAED;;GAEG;AACH,eAAO,MAAM,kBAAkB,oBAAc,CAAC;AAE9C;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,eAAe,CAC7B,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,CAAC,IAAI,EAAE,UAAU,KAAK,IAAI,EACpC,IAAI,GAAE;IAAE,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAO,GAC/D;IAAE,KAAK,EAAE,MAAM,IAAI,CAAA;CAAE,CAyDvB"}
+{"version":3,"file":"auth-store.d.ts","sourceRoot":"","sources":["../../src/hq/auth-store.ts"],"names":[],"mappings":"AA8BA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAErD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAEvD,wEAAwE;AACxE,eAAO,MAAM,oBAAoB,EAAG,CAAU,CAAC;AAE/C,8EAA8E;AAC9E,wBAAgB,gBAAgB,IAAI,MAAM,CAEzC;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAIhG;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,OAAO;IACtB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB;;;;;;;;;OASG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,GAAG,SAAS,EAAE,EAAE,GAAE,MAAmB,GAAG,OAAO,CAO9G;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,SAAS,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAK1F;AAED;;;GAGG;AACH,MAAM,MAAM,cAAc,GAAG,OAAO,CAAC;AAErC,8CAA8C;AAC9C,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,OAAO,oBAAoB,CAAC;IACrC,SAAS,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,eAAe,CAAC,EAAE,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAC7C,sEAAsE;IACtE,aAAa,CAAC,EAAE,OAAO,EAAE,CAAC;IAC1B,oEAAoE;IACpE,YAAY,CAAC,EAAE,OAAO,EAAE,CAAC;IACzB,0DAA0D;IAC1D,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,mDAAmD;IACnD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,UAAU,CAAC,EAAE,iBAAiB,CAAC;CAChC;AAED,oEAAoE;AACpE,wBAAgB,eAAe,IAAI,UAAU,CAK5C;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,6BAA6B,eAAe,CAAC;AAE1D;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,UAAU,GAAG,MAAM,GAAG,SAAS,CA6BtE;AAED,0DAA0D;AAC1D,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAEtD;AAED,sFAAsF;AACtF,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAEzD;AAED,wBAAsB,kBAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAM/G;AAYD,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS,CAahF;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,cAAc,CAClC,OAAO,EAAE,MAAM,EACf,KAAK,GAAE;IAAE,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAA;CAAO,GAC3C,OAAO,CAAC,UAAU,CAAC,CA8BrB;AAED;;;;GAIG;AACH,wBAAsB,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAQtF;AAED,MAAM,WAAW,2BAA2B;IAC1C,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7B,0EAA0E;IAC1E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;;;OAOG;IACH,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC;;;;;OAKG;IACH,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC5B;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,EAAE,UAAU,CAAC;IACrB,OAAO,EAAE,OAAO,CAAC;IACjB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,wBAAwB,CAC5C,OAAO,EAAE,MAAM,EACf,IAAI,GAAE,2BAAgC,GACrC,OAAO,CAAC,0BAA0B,CAAC,CAmHrC;AAED;;;;;;;;;GASG;AACH,wBAAsB,gBAAgB,CACpC,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,CAAC,OAAO,EAAE,UAAU,KAAK,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,EAClE,IAAI,GAAE;IAAE,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAA;CAAO,GAC1C,OAAO,CAAC,UAAU,CAAC,CAKrB;AAMD;;;GAGG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAShE;AAED;;GAEG;AACH,wBAAsB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAmBvF;AAED,0DAA0D;AAC1D,wBAAgB,kBAAkB,IAAI,MAAM,CAE3C;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,kBAAkB;IACjC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC1B;AAED;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,cAAc,CAAC,EAAE,MAAM,GAAG,kBAAkB,GAAG,OAAO,CAcjF;AAED;;GAEG;AACH,eAAO,MAAM,kBAAkB,oBAAc,CAAC;AAE9C;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,eAAe,CAC7B,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,CAAC,IAAI,EAAE,UAAU,KAAK,IAAI,EACpC,IAAI,GAAE;IAAE,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAO,GAC/D;IAAE,KAAK,EAAE,MAAM,IAAI,CAAA;CAAE,CAyDvB"}

package/dist/hq/brain-bridge.d.ts

@@ -16,16 +16,10 @@
  */
 import type { EventBus } from '../kernel/events.js';
 import type { HqEventEnvelope } from './protocol.js';
-import type { HqPublisher } from './publisher.js';
-export interface BrainTelemetryBridgeOptions {
+import { type BridgeContextOptions } from './bridge-context.js';
+export interface BrainTelemetryBridgeOptions extends BridgeContextOptions {
     /** Local EventBus emitting `brain.*` events. */
     events: EventBus;
-    /** HQ publisher to forward envelopes to. */
-    publisher: HqPublisher;
-    /** Optional sessionId to tag envelopes with. */
-    sessionId?: string;
-    /** Override `now()` for deterministic tests. */
-    now?: () => string;
 }
 /**
  * Start forwarding brain events to HQ. Returns a disposer that unsubscribes

package/dist/hq/brain-bridge.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"brain-bridge.d.ts","sourceRoot":"","sources":["../../src/hq/brain-bridge.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAEpD,OAAO,KAAK,EAAyC,eAAe,EAAE,MAAM,eAAe,CAAC;AAC5F,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAElD,MAAM,WAAW,2BAA2B;IAC1C,gDAAgD;IAChD,MAAM,EAAE,QAAQ,CAAC;IACjB,4CAA4C;IAC5C,SAAS,EAAE,WAAW,CAAC;IACvB,gDAAgD;IAChD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,gDAAgD;IAChD,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAgCD;;;GAGG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,2BAA2B,GAAG,MAAM,IAAI,CAyEvF;AAED,yCAAyC;AACzC,YAAY,EAAE,eAAe,EAAE,CAAC"}
+{"version":3,"file":"brain-bridge.d.ts","sourceRoot":"","sources":["../../src/hq/brain-bridge.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAEpD,OAAO,KAAK,EAAyC,eAAe,EAAE,MAAM,eAAe,CAAC;AAC5F,OAAO,EAAuB,KAAK,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAErF,MAAM,WAAW,2BAA4B,SAAQ,oBAAoB;IACvE,gDAAgD;IAChD,MAAM,EAAE,QAAQ,CAAC;CAClB;AAgCD;;;GAGG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,2BAA2B,GAAG,MAAM,IAAI,CAoEvF;AAED,yCAAyC;AACzC,YAAY,EAAE,eAAe,EAAE,CAAC"}

package/dist/hq/bridge-context.d.ts

@@ -0,0 +1,74 @@
+/**
+ * Shared context for HQ telemetry bridges.
+ *
+ * Every bridge (`cost-bridge`, `brain-bridge`, `worktree-bridge`,
+ * `fleet-bridge`, `tool-bridge`) repeats the same four pieces of
+ * boilerplate:
+ *
+ *  1. Resolve `now` from options or fall back to `new Date().toISOString()`.
+ *  2. Conditionally spread `{ sessionId }` into every `publishEvent` call.
+ *  3. Wrap every publish in `try / catch` (best-effort) so a transient
+ *     publisher failure never breaks the host's event loop.
+ *  4. Collect unsubscribe handles and return a single disposer.
+ *
+ * This module collapses those four into one factory so each bridge shrinks
+ * to its event-mapping logic.
+ *
+ * @module hq/bridge-context
+ */
+import type { HqPublisher, HqPublishEventOptions } from './publisher.js';
+export interface BridgeContextOptions {
+    /** HQ publisher to forward envelopes to. */
+    publisher: HqPublisher;
+    /** Override `now()` for deterministic tests. */
+    now?: (() => string) | undefined;
+    /** Optional sessionId to tag envelopes with when the event has none. */
+    sessionId?: string | undefined;
+}
+export interface BridgeContext {
+    /** Resolved timestamp function (never undefined). */
+    readonly now: () => string;
+    /**
+     * Build the `{ sessionId } | {}` spread for a `publishEvent` call.
+     * The event-level sessionId (from the event payload) takes precedence
+     * over the bridge-level sessionId (from options).
+     */
+    readonly sessionIdTag: (eventSessionId?: string) => {
+        sessionId?: string;
+    };
+    /**
+     * Wrap a publish in try/catch so a transient publisher failure never
+     * breaks the host. Returns the envelope on success, `undefined` on
+     * failure.
+     */
+    readonly safePublish: (options: HqPublishEventOptions) => void;
+    /** Track an unsubscribe handle for the disposer. */
+    readonly track: (off: () => void) => void;
+    /** Call every tracked unsubscribe handle. */
+    readonly dispose: () => void;
+}
+/**
+ * Create a {@link BridgeContext} from the common bridge options.
+ *
+ * Usage in a bridge:
+ *
+ * ```ts
+ * export function startSomethingBridge(opts: SomethingBridgeOptions): () => void {
+ *   const { events, publisher } = opts;
+ *   const ctx = createBridgeContext(opts);
+ *
+ *   ctx.track(events.on('something.happened', (p) => {
+ *     ctx.safePublish({
+ *       type: 'something.event',
+ *       payload: { ... },
+ *       ...ctx.sessionIdTag(p.sessionId),
+ *       timestamp: ctx.now(),
+ *     });
+ *   }));
+ *
+ *   return ctx.dispose;
+ * }
+ * ```
+ */
+export declare function createBridgeContext(options: BridgeContextOptions): BridgeContext;
+//# sourceMappingURL=bridge-context.d.ts.map

package/dist/hq/bridge-context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bridge-context.d.ts","sourceRoot":"","sources":["../../src/hq/bridge-context.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AAIzE,MAAM,WAAW,oBAAoB;IACnC,4CAA4C;IAC5C,SAAS,EAAE,WAAW,CAAC;IACvB,gDAAgD;IAChD,GAAG,CAAC,EAAE,CAAC,MAAM,MAAM,CAAC,GAAG,SAAS,CAAC;IACjC,wEAAwE;IACxE,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAChC;AAED,MAAM,WAAW,aAAa;IAC5B,qDAAqD;IACrD,QAAQ,CAAC,GAAG,EAAE,MAAM,MAAM,CAAC;IAC3B;;;;OAIG;IACH,QAAQ,CAAC,YAAY,EAAE,CAAC,cAAc,CAAC,EAAE,MAAM,KAAK;QAAE,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC3E;;;;OAIG;IACH,QAAQ,CAAC,WAAW,EAAE,CAAC,OAAO,EAAE,qBAAqB,KAAK,IAAI,CAAC;IAC/D,oDAAoD;IACpD,QAAQ,CAAC,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,IAAI,KAAK,IAAI,CAAC;IAC1C,6CAA6C;IAC7C,QAAQ,CAAC,OAAO,EAAE,MAAM,IAAI,CAAC;CAC9B;AAID;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,oBAAoB,GAAG,aAAa,CAmChF"}

package/dist/hq/cost-bridge.d.ts

@@ -1,6 +1,6 @@
 /**
- * CostTelemetryBridge — forwards local token/cost accounting events to the HQ
- * publisher as `session.usage` envelopes, giving the command center the
+ * CostTelemetryBridge — forwards local token/cost accounting events to the
+ * HQ publisher as `session.usage` envelopes, giving the command center the
  * granular per-call cost signal it needs to render live cost trends and
  * roll-ups across every connected machine.
  *
@@ -17,16 +17,10 @@
  */
 import type { EventBus } from '../kernel/events.js';
 import type { HqEventEnvelope } from './protocol.js';
-import type { HqPublisher } from './publisher.js';
-export interface CostTelemetryBridgeOptions {
+import { type BridgeContextOptions } from './bridge-context.js';
+export interface CostTelemetryBridgeOptions extends BridgeContextOptions {
     /** Local EventBus emitting `token.accounted`. */
     events: EventBus;
-    /** HQ publisher to forward envelopes to. */
-    publisher: HqPublisher;
-    /** Optional sessionId to tag envelopes with (overrides the event's, when set). */
-    sessionId?: string;
-    /** Override `now()` for deterministic tests. */
-    now?: () => string;
 }
 /**
  * Start forwarding token/cost events to HQ. Returns a disposer that

package/dist/hq/cost-bridge.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cost-bridge.d.ts","sourceRoot":"","sources":["../../src/hq/cost-bridge.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAEpD,OAAO,KAAK,EAAE,eAAe,EAAkB,MAAM,eAAe,CAAC;AACrE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAElD,MAAM,WAAW,0BAA0B;IACzC,iDAAiD;IACjD,MAAM,EAAE,QAAQ,CAAC;IACjB,4CAA4C;IAC5C,SAAS,EAAE,WAAW,CAAC;IACvB,kFAAkF;IAClF,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,gDAAgD;IAChD,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAYD;;;GAGG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,0BAA0B,GAAG,MAAM,IAAI,CAiCrF;AAED,yCAAyC;AACzC,YAAY,EAAE,eAAe,EAAE,CAAC"}
+{"version":3,"file":"cost-bridge.d.ts","sourceRoot":"","sources":["../../src/hq/cost-bridge.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAEpD,OAAO,KAAK,EAAE,eAAe,EAAkB,MAAM,eAAe,CAAC;AACrE,OAAO,EAAuB,KAAK,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAErF,MAAM,WAAW,0BAA2B,SAAQ,oBAAoB;IACtE,iDAAiD;IACjD,MAAM,EAAE,QAAQ,CAAC;CAClB;AAaD;;;GAGG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,0BAA0B,GAAG,MAAM,IAAI,CA6BrF;AAED,yCAAyC;AACzC,YAAY,EAAE,eAAe,EAAE,CAAC"}

package/dist/hq/fleet-bridge.d.ts

@@ -16,18 +16,12 @@
  */
 import type { EventBus } from '../kernel/events.js';
 import type { HqEventEnvelope } from './protocol.js';
-import type { HqPublisher } from './publisher.js';
-export interface FleetTelemetryBridgeOptions {
+import { type BridgeContextOptions } from './bridge-context.js';
+export interface FleetTelemetryBridgeOptions extends BridgeContextOptions {
     /** Local EventBus emitting `coordinator.stats` (host EventBus after the FleetBus hop). */
     events: EventBus;
-    /** HQ publisher to forward envelopes to. */
-    publisher: HqPublisher;
     /** Coordinator run id — identifies this fleet instance. Falls back to a stable per-session id. */
     runId: string;
-    /** Optional sessionId to tag envelopes with. */
-    sessionId?: string;
-    /** Override `now()` for deterministic tests. */
-    now?: () => string;
 }
 /**
  * Start forwarding coordinator stats to HQ. Returns a disposer that

package/dist/hq/fleet-bridge.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fleet-bridge.d.ts","sourceRoot":"","sources":["../../src/hq/fleet-bridge.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,KAAK,EAAE,eAAe,EAA6C,MAAM,eAAe,CAAC;AAChG,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAElD,MAAM,WAAW,2BAA2B;IAC1C,0FAA0F;IAC1F,MAAM,EAAE,QAAQ,CAAC;IACjB,4CAA4C;IAC5C,SAAS,EAAE,WAAW,CAAC;IACvB,kGAAkG;IAClG,KAAK,EAAE,MAAM,CAAC;IACd,gDAAgD;IAChD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,gDAAgD;IAChD,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAED;;;GAGG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,2BAA2B,GAAG,MAAM,IAAI,CAkEvF;AAiBD,yCAAyC;AACzC,YAAY,EAAE,eAAe,EAAE,CAAC"}
+{"version":3,"file":"fleet-bridge.d.ts","sourceRoot":"","sources":["../../src/hq/fleet-bridge.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,KAAK,EAAE,eAAe,EAA6C,MAAM,eAAe,CAAC;AAChG,OAAO,EAAuB,KAAK,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAErF,MAAM,WAAW,2BAA4B,SAAQ,oBAAoB;IACvE,0FAA0F;IAC1F,MAAM,EAAE,QAAQ,CAAC;IACjB,kGAAkG;IAClG,KAAK,EAAE,MAAM,CAAC;CACf;AAED;;;GAGG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,2BAA2B,GAAG,MAAM,IAAI,CAiEvF;AAiBD,yCAAyC;AACzC,YAAY,EAAE,eAAe,EAAE,CAAC"}

package/dist/hq/index.d.ts

@@ -1,3 +1,5 @@
+export * from './bridge-context.js';
+export * from './auth-audit.js';
 export * from './protocol.js';
 export * from './redaction.js';
 export * from './mailbox-mapper.js';

package/dist/hq/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/hq/index.ts"],"names":[],"mappings":"AAAA,cAAc,eAAe,CAAC;AAC9B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,qBAAqB,CAAC;AACpC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,cAAc,CAAC;AAC7B,cAAc,iBAAiB,CAAC;AAChC,cAAc,eAAe,CAAC;AAC9B,cAAc,qBAAqB,CAAC;AACpC,cAAc,mBAAmB,CAAC;AAClC,cAAc,mBAAmB,CAAC;AAClC,cAAc,sBAAsB,CAAC;AACrC,cAAc,kBAAkB,CAAC;AACjC,cAAc,kBAAkB,CAAC;AACjC,cAAc,kBAAkB,CAAC;AACjC,cAAc,eAAe,CAAC;AAC9B,cAAc,aAAa,CAAC;AAC5B,cAAc,wBAAwB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/hq/index.ts"],"names":[],"mappings":"AAAA,cAAc,qBAAqB,CAAC;AACpC,cAAc,iBAAiB,CAAC;AAChC,cAAc,eAAe,CAAC;AAC9B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,qBAAqB,CAAC;AACpC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,cAAc,CAAC;AAC7B,cAAc,iBAAiB,CAAC;AAChC,cAAc,eAAe,CAAC;AAC9B,cAAc,qBAAqB,CAAC;AACpC,cAAc,mBAAmB,CAAC;AAClC,cAAc,mBAAmB,CAAC;AAClC,cAAc,sBAAsB,CAAC;AACrC,cAAc,kBAAkB,CAAC;AACjC,cAAc,kBAAkB,CAAC;AACjC,cAAc,kBAAkB,CAAC;AACjC,cAAc,eAAe,CAAC;AAC9B,cAAc,aAAa,CAAC;AAC5B,cAAc,wBAAwB,CAAC"}