@indigoai-us/hq-cli 5.12.4 → 5.12.5

package/dist/commands/secrets.js

@@ -1,5 +1,5 @@
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="217ceadb-01cd-5778-9cc0-6f6d895d8d67")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="b75c8495-7e0e-53f8-a0d2-c92a993e6492")}catch(e){}}();
 import chalk from "chalk";
 import * as readline from "node:readline";
 import { spawn } from "node:child_process";
@@ -467,7 +467,6 @@ export function registerSecretsCommand(program) {
         .option("--expires <duration>", "Token expiry duration (e.g. 24h, 2d, 30m)", "24h")
         .action(async (name, opts) => {
         try {
-            rejectIfPersonal(secrets.opts(), "generate-link");
             if (!SECRET_NAME_PATTERN.test(name)) {
                 console.error(chalk.red(`Invalid secret name '${name}': must match ^[A-Z][A-Z0-9_]*(/[A-Z][A-Z0-9_]+)*$ (e.g. MY_API_KEY or DEV/MY_KEY)`));
                 process.exit(1);
@@ -713,4 +712,4 @@ export function registerSecretsCommand(program) {
     });
 }
 //# sourceMappingURL=secrets.js.map
-//# debugId=217ceadb-01cd-5778-9cc0-6f6d895d8d67
+//# debugId=b75c8495-7e0e-53f8-a0d2-c92a993e6492

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.12.4",
+  "version": "5.12.5",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {

package/src/commands/secrets.test.ts

@@ -0,0 +1,96 @@
+import {
+  afterEach,
+  beforeEach,
+  describe,
+  expect,
+  it,
+  vi,
+  type MockInstance,
+} from "vitest";
+
+vi.mock("../utils/cognito-session.js", async (importOriginal) => {
+  const original = (await importOriginal()) as Record<string, unknown>;
+  return {
+    ...original,
+    ensureCognitoToken: vi.fn(async () => "test-token"),
+  };
+});
+
+vi.mock("../utils/vault-api.js", async (importOriginal) => {
+  const original = (await importOriginal()) as Record<string, unknown>;
+  return {
+    ...original,
+    getEntityUid: vi.fn(async () => "prs_alice"),
+    vaultApiFetch: vi.fn(async () =>
+      new Response(
+        JSON.stringify({
+          url: "https://hq.example/secrets-input/tok_secret",
+          expiresAt: "2026-05-12T12:00:00.000Z",
+          secretName: "MY_KEY",
+        }),
+        { status: 200, headers: { "Content-Type": "application/json" } },
+      ),
+    ),
+  };
+});
+
+import { Command } from "commander";
+import { registerSecretsCommand } from "./secrets.js";
+import { getEntityUid, vaultApiFetch } from "../utils/vault-api.js";
+
+let logSpy: MockInstance<typeof console.log>;
+let errSpy: MockInstance<typeof console.error>;
+
+beforeEach(() => {
+  vi.clearAllMocks();
+  logSpy = vi.spyOn(console, "log").mockImplementation(() => undefined);
+  errSpy = vi.spyOn(console, "error").mockImplementation(() => undefined);
+});
+
+afterEach(() => {
+  vi.restoreAllMocks();
+});
+
+function buildProgram(): Command {
+  const program = new Command();
+  program.exitOverride();
+  program.configureOutput({
+    writeOut: () => undefined,
+    writeErr: () => undefined,
+  });
+  registerSecretsCommand(program);
+  return program;
+}
+
+describe("secrets generate-link", () => {
+  it("mints one-time submission links for personal secrets", async () => {
+    const program = buildProgram();
+
+    await program.parseAsync([
+      "node",
+      "hq",
+      "secrets",
+      "--personal",
+      "generate-link",
+      "MY_KEY",
+      "--expires",
+      "30m",
+    ]);
+
+    expect(getEntityUid).toHaveBeenCalledWith("test-token", {
+      personal: true,
+      companySlug: undefined,
+    });
+    expect(vaultApiFetch).toHaveBeenCalledWith({
+      token: "test-token",
+      path: "/secrets/prs_alice/name/MY_KEY",
+      method: "POST",
+      body: { expiresInMs: 30 * 60 * 1000 },
+      query: { action: "generate-token" },
+    });
+    expect(logSpy).toHaveBeenCalledWith(
+      expect.stringContaining("Secret input link generated"),
+    );
+    expect(errSpy).not.toHaveBeenCalled();
+  });
+});

package/src/commands/secrets.ts

@@ -615,8 +615,6 @@ export function registerSecretsCommand(program: Command): void {
     .option("--expires <duration>", "Token expiry duration (e.g. 24h, 2d, 30m)", "24h")
     .action(async (name: string, opts: { expires: string }) => {
       try {
-        rejectIfPersonal(secrets.opts(), "generate-link");
-
         if (!SECRET_NAME_PATTERN.test(name)) {
           console.error(chalk.red(`Invalid secret name '${name}': must match ^[A-Z][A-Z0-9_]*(/[A-Z][A-Z0-9_]+)*$ (e.g. MY_API_KEY or DEV/MY_KEY)`));
           process.exit(1);