@indigoai-us/hq-cli 5.108.19 → 5.108.21

package/CHANGELOG.md

@@ -2,6 +2,42 @@
 
 ## [Unreleased]
 
+## [5.108.21] — 2026-09-07
+
+### Fixed
+
+- A large `hq files cat`/`hq files get`/`hq files browse`/`hq files search`
+  download no longer dies part-way through with an unexplained crash (Sentry
+  HQ-CLI-5 — 7596554539). Every company-mode vault read goes through a presigned
+  GET, and the CLI handed the caller the download's response body *before anyone
+  started reading it*. Node's bundled `undici` builds that body stream with a
+  zero high-water mark, so the first chunk pauses its HTTP parser until a
+  consumer pulls — and the download loop ran a synchronous `mkdirSync` before it
+  began pulling. When S3 closed the connection inside that gap, undici's
+  socket-end handler tripped an internal `assert(!this.paused)` and threw an
+  `AssertionError` from a background tick that no `try/catch` around the download
+  could see, so `@sentry/node` filed it as a fatal and the process exited
+  mid-download. The presigned GET is now drained into memory before its body is
+  handed on whenever the response declares a length at or below 32 MiB (which
+  covers every object the CLI reads today), removing the paused-parser window
+  entirely; larger or unmeasured responses keep streaming, and the destination
+  directory is now created *before* the download is issued so no synchronous
+  filesystem call sits inside the read window on that path either. The observable
+  output of every `hq files` subcommand is unchanged.
+
+## [5.108.20] — 2026-09-07
+
+### Fixed
+
+- `hq mesh session <kind> --enqueue` and the Work Mesh Live daemon's transcript
+  watcher no longer fail with `ENOENT … session-event.schema.json` on installed
+  copies of the CLI. The session-event validator reads its JSON schema from disk
+  next to the compiled module, but the build only ran `tsc`, which does not emit
+  JSON files that are not imported, so no published package since Work Mesh
+  Live shipped contained the schema (unit tests run against `src/` and never
+  noticed). The build now copies every `src/**/*.schema.json` into `dist/`, and a
+  CI guard test keeps it that way.
+
 ## [5.108.19] — 2026-09-07
 
 ## [5.108.18] — 2026-09-07

package/dist/commands/files-browse.d.ts

@@ -403,6 +403,28 @@ export interface RunGetResult {
  * HQ root itself, which is too broad to do implicitly.
  */
 export declare function runGet(input: RunGetInput): Promise<RunGetResult>;
+/**
+ * Upper bound (bytes) on a presigned download we drain into memory before
+ * handing the caller a Body (HQ-CLI-5).
+ *
+ * fetch()'s response body is an undici ReadableStream with a zero high-water
+ * mark: the first chunk drives desiredSize to 0 and undici PAUSES its llhttp
+ * parser until a consumer pulls. `getObject` used to hand that still-paused
+ * stream straight to the orchestrators, which each run a synchronous fs call
+ * before they start pulling. If S3 sends its connection FIN inside that gap,
+ * undici's socket-end handler trips `assert(!this.paused)` in Parser.finish and
+ * throws an AssertionError from a process tick — outside any try/catch — that
+ * @sentry/node files as an uncaught fatal and that kills the CLI mid-download.
+ *
+ * Draining the body up front removes the pause entirely (the same
+ * buffer-then-rewrap posture peekPlanLimitStatus uses in vault-api.ts). We cap
+ * it so a very large object still streams and never buffers into a small agent
+ * box's memory; a response above the ceiling (or with no declared length) keeps
+ * the streaming path, whose residual window is narrowed by the mkdirSync hoist
+ * in runGet/runCat. 32 MiB comfortably covers every object hq-cli reads today
+ * (vault JSON + images) while staying well under a 4 GB host's headroom.
+ */
+export declare const PRESIGN_BUFFER_MAX_BYTES: number;
 /**
  * Build a COMPANY-mode browse client backed by the list + presign API. The
  * access token + companyUid are captured here; the orchestrator just calls

package/dist/commands/files-browse.js

@@ -318,6 +318,15 @@ export async function runCat(input) {
         // COMPANY mode (HQ-59): GetObject → presign GET. No STS vend, no direct S3.
         s3 = requireCompanyClient(input.companyClient)({ companyUid: entity.uid });
     }
+    // HQ-CLI-5: when writing to --out, create the parent directory BEFORE issuing
+    // the presigned GET, so no synchronous filesystem call sits between receiving
+    // the body and the nextTick resume that starts pulling it — that gap is what
+    // left undici's HTTP parser paused into the socket FIN. The guard above
+    // already validated absOut is outside the protected companies/ tree, so its
+    // parent is outside too.
+    if (absOut !== undefined) {
+        fs.mkdirSync(path.dirname(absOut), { recursive: true });
+    }
     const resp = (await s3.send(new GetObjectCommand({ Bucket: bucket, Key: s3Key })));
     if (!resp.Body) {
         throw new Error(`GetObject for '${key}' returned no body.`);
@@ -331,10 +340,6 @@ export async function runCat(input) {
         bytesWritten += Buffer.isBuffer(chunk) ? chunk.length : Buffer.byteLength(chunk);
     });
     if (absOut !== undefined) {
-        // Ensure the parent directory exists — but ONLY if it's also outside
-        // the protected tree (the guard already validated absOut itself; the
-        // parent of an outside-tree path is by definition outside too).
-        fs.mkdirSync(path.dirname(absOut), { recursive: true });
         await pipeline(body, fs.createWriteStream(absOut));
         return {
             bytesWritten,
@@ -536,12 +541,17 @@ export async function runGet(input) {
         else {
             destAbs = path.join(hqRoot, "companies", slug, key);
         }
+        // HQ-CLI-5: create the destination directory BEFORE issuing the presigned
+        // GET, so no synchronous filesystem call sits between receiving the body
+        // and starting to pull it — that gap is what left undici's HTTP parser
+        // paused into the socket FIN. Buffered downloads no longer keep a live
+        // socket at all; this also closes the window on the streaming branch.
+        fs.mkdirSync(path.dirname(destAbs), { recursive: true });
         const resp = (await s3.send(new GetObjectCommand({ Bucket: bucket, Key: key })));
         if (!resp.Body) {
             throw new Error(`GetObject for '${key}' returned no body.`);
         }
         const body = resp.Body;
-        fs.mkdirSync(path.dirname(destAbs), { recursive: true });
         await pipeline(body, fs.createWriteStream(destAbs));
         bytesWritten += fs.statSync(destAbs).size;
         destinations.push(destAbs);
@@ -557,6 +567,28 @@ export async function runGet(input) {
 }
 // ── CLI registration ────────────────────────────────────────────────────────
 const defaultS3Factory = ({ region, credentials }) => new S3Client({ region, credentials });
+/**
+ * Upper bound (bytes) on a presigned download we drain into memory before
+ * handing the caller a Body (HQ-CLI-5).
+ *
+ * fetch()'s response body is an undici ReadableStream with a zero high-water
+ * mark: the first chunk drives desiredSize to 0 and undici PAUSES its llhttp
+ * parser until a consumer pulls. `getObject` used to hand that still-paused
+ * stream straight to the orchestrators, which each run a synchronous fs call
+ * before they start pulling. If S3 sends its connection FIN inside that gap,
+ * undici's socket-end handler trips `assert(!this.paused)` in Parser.finish and
+ * throws an AssertionError from a process tick — outside any try/catch — that
+ * @sentry/node files as an uncaught fatal and that kills the CLI mid-download.
+ *
+ * Draining the body up front removes the pause entirely (the same
+ * buffer-then-rewrap posture peekPlanLimitStatus uses in vault-api.ts). We cap
+ * it so a very large object still streams and never buffers into a small agent
+ * box's memory; a response above the ceiling (or with no declared length) keeps
+ * the streaming path, whose residual window is narrowed by the mkdirSync hoist
+ * in runGet/runCat. 32 MiB comfortably covers every object hq-cli reads today
+ * (vault JSON + images) while staying well under a 4 GB host's headroom.
+ */
+export const PRESIGN_BUFFER_MAX_BYTES = 32 * 1024 * 1024;
 /**
  * Build a COMPANY-mode browse client backed by the list + presign API. The
  * access token + companyUid are captured here; the orchestrator just calls
@@ -616,9 +648,31 @@ export function createCompanyPresignClient(input) {
         if (!dl.ok) {
             throw new Error(`Failed to download '${key}' (HTTP ${dl.status})`);
         }
-        // fetch() yields a web ReadableStream; the orchestrators consume Body as a
-        // Node Readable (body.on('data') + stream pipeline), so adapt it. An empty
-        // body (no stream) becomes an empty Readable.
+        // HQ-CLI-5: when the response declares a length at or below the ceiling,
+        // DRAIN it here — read the whole body before send() resolves and replay it
+        // from memory. That removes undici's paused-parser window entirely: by the
+        // time the orchestrators pull, there is no live socket left to hit
+        // `assert(!this.paused)` on its FIN. `Number(null)` is 0, so guard the
+        // absent header explicitly (NaN) — an unmeasured body must keep streaming,
+        // never look like a zero-length buffer.
+        const declaredLengthHeader = dl.headers.get("content-length");
+        const declaredLength = declaredLengthHeader === null ? NaN : Number(declaredLengthHeader);
+        const canBuffer = Number.isFinite(declaredLength) &&
+            declaredLength >= 0 &&
+            declaredLength <= PRESIGN_BUFFER_MAX_BYTES;
+        if (canBuffer) {
+            const buf = Buffer.from(await dl.arrayBuffer());
+            return {
+                Body: Readable.from(buf),
+                $metadata: {},
+            };
+        }
+        // Above the ceiling, or no declared length: keep streaming so a very large
+        // object is never buffered whole. fetch() yields a web ReadableStream; the
+        // orchestrators consume Body as a Node Readable (body.on('data') + stream
+        // pipeline), so adapt it. An empty body (no stream) becomes an empty
+        // Readable. The mkdirSync hoist in runGet/runCat narrows the residual
+        // paused-parser window on this branch.
         const nodeBody = dl.body
             ? Readable.fromWeb(dl.body)
             : Readable.from([]);

package/dist/lib/mesh/live/session-event.schema.json

@@ -0,0 +1,144 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://hq.getindigo.ai/schemas/work-mesh-live/session-event.schema.json",
+  "title": "Work Mesh Live Session Event",
+  "description": "Metadata-only spool / batch-ingest session event (contractVersion 1). Local-only fields are permitted on the spool line and MUST be stripped by the daemon before any network call. There is no free-text intent field and no prompt-derived content.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "v",
+    "eventId",
+    "kind",
+    "sessionId",
+    "harness",
+    "adapterVersion",
+    "at",
+    "seq"
+  ],
+  "properties": {
+    "v": {
+      "type": "integer",
+      "const": 1,
+      "description": "Schema version. Always 1 for this contract."
+    },
+    "eventId": {
+      "type": "string",
+      "pattern": "^[0-9A-HJKMNP-TV-Z]{26}$",
+      "description": "ULID (Crockford base32, 26 chars). Idempotency key for batch ingest."
+    },
+    "kind": {
+      "type": "string",
+      "enum": [
+        "session_start",
+        "turn_start",
+        "turn_end",
+        "session_end",
+        "task_status",
+        "blocked",
+        "note"
+      ]
+    },
+    "sessionId": {
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 128,
+      "description": "Stable runtime session identifier."
+    },
+    "harness": {
+      "type": "string",
+      "enum": [
+        "claude-code",
+        "claude-desktop",
+        "codex",
+        "grok",
+        "hq-sessions",
+        "agent-box"
+      ]
+    },
+    "adapterVersion": {
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 64,
+      "description": "Hook / adapter package version that emitted the event."
+    },
+    "runtimeVersion": {
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 64,
+      "description": "Optional host runtime version (claude, codex, etc.)."
+    },
+    "source": {
+      "type": "string",
+      "enum": ["hooks", "transcript"],
+      "description": "Origin of the event stream: hooks (default) or the transcript-watch fallback (US-018)."
+    },
+    "at": {
+      "type": "string",
+      "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}(?:\\.\\d+)?(?:Z|[+-]\\d{2}:\\d{2})$",
+      "description": "ISO-8601 timestamp when the event occurred."
+    },
+    "seq": {
+      "type": "integer",
+      "minimum": 1,
+      "description": "Monotonic per-session sequence number, starting at 1."
+    },
+    "taskId": {
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 128,
+      "description": "Canonical task identifier. storyId is an ingress alias normalized to taskId by the resolver; it is never a field on this schema."
+    },
+    "status": {
+      "type": "string",
+      "enum": [
+        "queued",
+        "in_progress",
+        "review",
+        "done"
+      ],
+      "description": "Task status; used with kind=task_status."
+    },
+    "reason": {
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 500,
+      "description": "Blocked reason or similar short machine-safe note. Never prompt text."
+    },
+    "summary": {
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 280,
+      "description": "Optional short summary allowed only on note, blocked, and task_status. Never prompt-derived content."
+    },
+    "cwd": {
+      "type": "string",
+      "maxLength": 1024,
+      "description": "LOCAL-ONLY. Working directory at emit time. Stripped by the daemon before any network call."
+    },
+    "hqRoot": {
+      "type": "string",
+      "maxLength": 1024,
+      "description": "LOCAL-ONLY. Absolute path to the HQ tree root. Stripped before network."
+    },
+    "companySlug": {
+      "type": "string",
+      "maxLength": 128,
+      "description": "LOCAL-ONLY. Hint slug from local context. Never used as tenant authority. Stripped before network."
+    },
+    "project": {
+      "type": "string",
+      "maxLength": 256,
+      "description": "LOCAL-ONLY. Local project name/path hint. Stripped before network."
+    },
+    "task": {
+      "type": "string",
+      "maxLength": 256,
+      "description": "LOCAL-ONLY. Local task label hint. Stripped before network. Distinct from canonical taskId."
+    },
+    "toolWrites": {
+      "type": "integer",
+      "minimum": 0,
+      "description": "LOCAL-ONLY. Count of tool file writes observed this session. Stripped before network."
+    }
+  }
+}

package/dist/lib/work-context/contract.schema.json

@@ -0,0 +1,107 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://hq.getindigo.ai/schemas/work-context/contract.schema.json",
+  "title": "Work Context Reconciliation Contract",
+  "description": "Recreated 2026-09-03 from work-context-resolver architectural-decisions.md (US-001A) because feature/work-context-resolver-cli was not on origin.",
+  "oneOf": [
+    { "$ref": "#/$defs/SessionObservation" },
+    { "$ref": "#/$defs/ContextResult" }
+  ],
+  "$defs": {
+    "ClassificationState": {
+      "type": "string",
+      "enum": [
+        "unresolved",
+        "needs_company",
+        "company_conflict",
+        "needs_project",
+        "needs_task",
+        "bound",
+        "untracked",
+        "migration_pending"
+      ]
+    },
+    "DeliveryState": {
+      "type": "string",
+      "enum": ["clean", "queued", "acked", "quarantined"]
+    },
+    "LifecycleState": {
+      "type": "string",
+      "enum": ["open", "terminal"]
+    },
+    "ContextResultKind": {
+      "type": "string",
+      "enum": [
+        "bound",
+        "needs_company",
+        "company_conflict",
+        "needs_project",
+        "needs_task",
+        "queued",
+        "untracked",
+        "migration_pending",
+        "incompatible",
+        "error"
+      ]
+    },
+    "SessionObservation": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["contractVersion", "identity", "clientOperationId"],
+      "properties": {
+        "contractVersion": { "type": "integer", "const": 1 },
+        "identity": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["sessionId"],
+          "properties": {
+            "sessionId": { "type": "string", "minLength": 1, "maxLength": 128 },
+            "providerSessionId": { "type": "string", "maxLength": 128 },
+            "harness": { "type": "string", "maxLength": 64 },
+            "adapterVersion": { "type": "string", "maxLength": 64 },
+            "runtimeVersion": { "type": "string", "maxLength": 64 }
+          }
+        },
+        "explicit": {
+          "type": "object",
+          "additionalProperties": false,
+          "properties": {
+            "companyUid": { "type": "string", "maxLength": 64 },
+            "projectId": { "type": "string", "maxLength": 128 },
+            "taskId": { "type": "string", "maxLength": 128 },
+            "storyId": { "type": "string", "maxLength": 128 }
+          }
+        },
+        "clientOperationId": { "type": "string", "minLength": 1, "maxLength": 128 },
+        "untrackedOrigin": { "type": "string", "const": "user" }
+      }
+    },
+    "ContextResult": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "contractVersion",
+        "kind",
+        "classification",
+        "delivery",
+        "lifecycle",
+        "sessionId",
+        "clientOperationId"
+      ],
+      "properties": {
+        "contractVersion": { "type": "integer", "const": 1 },
+        "kind": { "$ref": "#/$defs/ContextResultKind" },
+        "classification": { "$ref": "#/$defs/ClassificationState" },
+        "delivery": { "$ref": "#/$defs/DeliveryState" },
+        "lifecycle": { "$ref": "#/$defs/LifecycleState" },
+        "sessionId": { "type": "string", "minLength": 1, "maxLength": 128 },
+        "companyUid": { "type": "string", "maxLength": 64 },
+        "projectId": { "type": "string", "maxLength": 128 },
+        "taskId": { "type": "string", "maxLength": 128 },
+        "bindingEpisodeId": { "type": "string", "maxLength": 128 },
+        "clientOperationId": { "type": "string", "minLength": 1, "maxLength": 128 },
+        "errorCode": { "type": "string", "maxLength": 64 }
+      }
+    }
+  }
+}

package/dist/schemas/hq-package.schema.json

@@ -0,0 +1,155 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "title": "hq-package.yaml",
+  "description": "Manifest schema for HQ packages — versioned bundles of workers, commands, skills, and knowledge installable via hq install.",
+  "type": "object",
+  "required": ["name", "type", "version", "description", "author", "exposes"],
+  "additionalProperties": false,
+  "properties": {
+    "name": {
+      "type": "string",
+      "description": "Package slug — lowercase alphanumeric with hyphens. Used as the registry identifier and install target directory name.",
+      "pattern": "^[a-z0-9][a-z0-9-]*[a-z0-9]$|^[a-z0-9]$",
+      "minLength": 1
+    },
+    "type": {
+      "type": "string",
+      "description": "Package type. Controls install target routing for all exposes entries.",
+      "enum": ["worker-pack", "command-set", "skill-bundle", "knowledge-base", "company-template"]
+    },
+    "version": {
+      "type": "string",
+      "description": "Semver version string for this release.",
+      "pattern": "^(0|[1-9]\\d*)\\.(0|[1-9]\\d*)\\.(0|[1-9]\\d*)(?:-((?:0|[1-9]\\d*|\\d*[a-zA-Z-][0-9a-zA-Z-]*)(?:\\.(?:0|[1-9]\\d*|\\d*[a-zA-Z-][0-9a-zA-Z-]*))*))?(?:\\+([0-9a-zA-Z-]+(?:\\.[0-9a-zA-Z-]+)*))?$"
+    },
+    "minHQVersion": {
+      "type": "string",
+      "description": "Minimum HQ version required to install this package. Installer aborts if installed HQ version is below this value.",
+      "pattern": "^(0|[1-9]\\d*)\\.(0|[1-9]\\d*)\\.(0|[1-9]\\d*)(?:-((?:0|[1-9]\\d*|\\d*[a-zA-Z-][0-9a-zA-Z-]*)(?:\\.(?:0|[1-9]\\d*|\\d*[a-zA-Z-][0-9a-zA-Z-]*))*))?(?:\\+([0-9a-zA-Z-]+(?:\\.[0-9a-zA-Z-]+)*))?$"
+    },
+    "description": {
+      "type": "string",
+      "description": "Short human-readable description of what this package provides.",
+      "minLength": 1,
+      "maxLength": 500
+    },
+    "author": {
+      "type": "string",
+      "description": "Author name or organization that created and maintains this package.",
+      "minLength": 1
+    },
+    "repo": {
+      "type": "string",
+      "description": "Git repository URL for the package source. Used as offline fallback when the registry is unavailable.",
+      "pattern": "^(https?://|git@|ssh://).+"
+    },
+    "requires": {
+      "type": "object",
+      "description": "External dependencies this package needs at runtime.",
+      "additionalProperties": false,
+      "properties": {
+        "packages": {
+          "type": "array",
+          "description": "HQ package slugs this package depends on. Installed before this package.",
+          "items": {
+            "type": "string",
+            "pattern": "^[a-z0-9][a-z0-9-]*[a-z0-9]$|^[a-z0-9]$"
+          },
+          "uniqueItems": true
+        },
+        "services": {
+          "type": "array",
+          "description": "Service slugs required at runtime. Installer warns if not configured in the target HQ installation.",
+          "items": {
+            "type": "string",
+            "minLength": 1
+          },
+          "uniqueItems": true
+        }
+      }
+    },
+    "exposes": {
+      "type": "object",
+      "description": "Declares what this package installs into the HQ workspace. At least one sub-array must be non-empty.",
+      "additionalProperties": false,
+      "properties": {
+        "workers": {
+          "type": "array",
+          "description": "Paths within the tarball to worker.yaml files to install.",
+          "items": {
+            "type": "string",
+            "minLength": 1
+          },
+          "uniqueItems": true
+        },
+        "commands": {
+          "type": "array",
+          "description": "Paths within the tarball to command .md files to install.",
+          "items": {
+            "type": "string",
+            "minLength": 1
+          },
+          "uniqueItems": true
+        },
+        "skills": {
+          "type": "array",
+          "description": "Paths within the tarball to skill .md files to install.",
+          "items": {
+            "type": "string",
+            "minLength": 1
+          },
+          "uniqueItems": true
+        },
+        "knowledge": {
+          "type": "array",
+          "description": "Paths within the tarball to knowledge directories or files to install.",
+          "items": {
+            "type": "string",
+            "minLength": 1
+          },
+          "uniqueItems": true
+        }
+      }
+    },
+    "hooks": {
+      "type": "object",
+      "description": "Shell scripts run at install lifecycle events. Each value is a path within the tarball to an executable shell script.",
+      "additionalProperties": false,
+      "properties": {
+        "on-install": {
+          "type": "string",
+          "description": "Path to shell script run after all files are installed.",
+          "minLength": 1
+        },
+        "on-update": {
+          "type": "string",
+          "description": "Path to shell script run after an existing installation is updated.",
+          "minLength": 1
+        },
+        "on-remove": {
+          "type": "string",
+          "description": "Path to shell script run before files are removed from the HQ workspace.",
+          "minLength": 1
+        }
+      }
+    },
+    "initialization": {
+      "type": "object",
+      "description": "Optional post-install onboarding. `entrypoint` is the pack's primary get-started action (a skill or command that must resolve to one of this package's exposes.skills / exposes.commands entries); HQ surfaces a safe auto-generated 'get started' line from it after install. `prompt` is optional free-text the user can copy/paste into their agent to begin setup — treated as UNTRUSTED instruction text, surfaced only after marketplace injection-scan/moderation (suppressed for non-marketplace installs).",
+      "additionalProperties": false,
+      "properties": {
+        "entrypoint": {
+          "type": "string",
+          "minLength": 1,
+          "description": "Primary get-started action — a skill or command name (with or without a leading slash) that must resolve to a declared exposes.skills / exposes.commands entry."
+        },
+        "prompt": {
+          "type": "string",
+          "maxLength": 2000,
+          "description": "Optional copy/paste setup prompt. Untrusted; surfaced only after moderation for marketplace packs, suppressed for local/git installs."
+        }
+      },
+      "required": ["entrypoint"]
+    }
+  }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.108.19",
+  "version": "5.108.21",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {
@@ -15,7 +15,7 @@
     "CHANGELOG.md"
   ],
   "scripts": {
-    "build": "node scripts/generate-dsn.mjs && tsc && node scripts/chmod-bins.mjs",
+    "build": "node scripts/generate-dsn.mjs && tsc && node scripts/copy-schemas.mjs && node scripts/chmod-bins.mjs",
     "prepublishOnly": "npm run build",
     "typecheck": "tsc --noEmit",
     "gen:scan-golden": "node scripts/generate-scan-packages-table.mjs > src/utils/__fixtures__/scan-packages.generated-block.sh",