@indigoai-us/hq-cli 5.24.0 → 5.25.1

package/.github/workflows/publish.yml

@@ -80,9 +80,29 @@ jobs:
             echo "published=true" >> "$GITHUB_OUTPUT"
           fi
 
+      # Sentry sourcemap upload runs on every tag push regardless of whether
+      # this run was the one that actually published to npm. The previous
+      # `if: steps.publish.outputs.published == 'true'` gate made re-runs
+      # useless when only the Sentry upload failed — the publish step's
+      # short-circuit (`npm view @ver already published`) zeroed out the
+      # output, so the upload step was skipped on every re-run. dist/ is
+      # rebuilt by the Build + Inject steps each run, so the upload is
+      # always operating on fresh, debug-id-stamped artifacts.
       - name: Upload sourcemaps to Sentry
-        if: steps.publish.outputs.published == 'true'
         run: |
+          # Defang paste-time whitespace in SENTRY_AUTH_TOKEN. Sentry's
+          # auth-header parser returns HTTP 401 "Token string should not
+          # contain spaces" when the secret has a trailing \n or any
+          # embedded whitespace — observed on the v5.25.0 release after a
+          # copy-paste into the GH repo secret carried a literal \n. `tr -d`
+          # is the cheap structural guard so the workflow doesn't blow up
+          # on the next dirty paste.
+          SENTRY_AUTH_TOKEN=$(printf %s "$SENTRY_AUTH_TOKEN" | tr -d '[:space:]')
+          if [ -z "$SENTRY_AUTH_TOKEN" ]; then
+            echo "::error::SENTRY_AUTH_TOKEN secret is empty (or all whitespace) after sanitization — cannot upload sourcemaps"
+            exit 1
+          fi
+          export SENTRY_AUTH_TOKEN
           VER=$(jq -r .version package.json)
           npx -y @sentry/cli@^2 sourcemaps upload --release "hq-cli@$VER" dist/
         env:

package/CHANGELOG.md

@@ -2,6 +2,33 @@
 
 ## [Unreleased]
 
+## [5.25.0] — 2026-05-26
+
+### Added
+
+- **`hq members invite --send-email` (default true).** Passes
+  `sendEmail: true` to hq-pro's `/membership/invite`, which renders
+  and sends the invite email via Resend server-side. Pre-resend hq-pro
+  versions ignore the field; the CLI falls back to the legacy
+  manual-notify printout. `--no-send-email` opts out for scripted
+  bulk invites. Consumes hq-pro PR #140.
+- **`hq members invite --groups <ids>`.** Comma-separated secret-group
+  ids forwarded as `groupIds[]`; invitee is added atomically on first
+  sign-in. Server already supported the field as `pendingGroupIds`;
+  this surfaces it on the CLI. CLI-side guard rejects the personUid
+  + groupIds combo before the wire call.
+- **`hq members invite <email> --resend`.** Short-circuits to hq-pro's
+  `resend: true` path (no DDB write, re-fires Resend email against the
+  existing pending row). New `resendInvite()` helper; email target only.
+  Surfaces 404 `INVITE_NOT_PENDING` via `InviteHttpError`.
+
+### Notes
+
+- Version skips 5.21.x–5.24.x because the hq-cloud-bump release train
+  (5.21.0, 5.22.0, 5.23.0, 5.24.0) shipped while this PR was open and
+  consumed those slots. Original branch bumped to 5.21.0; rebased twice
+  and rebumped to 5.25.0 just before merge.
+
 ## [5.22.0] — 2026-05-25
 
 ### Changed

package/dist/commands/members.d.ts

@@ -16,6 +16,17 @@ export interface InviteOptions {
     target: string;
     role: string;
     paths?: string;
+    /** Email-keyed invites only — secret-group ids to attach on claim. */
+    groupIds?: string[];
+    /**
+     * Opt the server-side Resend send in/out. When `true`, hq-pro renders +
+     * sends the invitation email server-side and returns `emailSent` /
+     * `emailSkipped` / `emailError`. When `false` or unset, the legacy
+     * no-email path runs and the CLI prints the manual sign-in instructions.
+     * Requires hq-pro that supports `sendEmail` (older servers ignore the
+     * field; CLI falls back to the legacy printout in that case).
+     */
+    sendEmail?: boolean;
     companyUid: string;
     callerUid: string;
     token: string;
@@ -33,6 +44,10 @@ export interface InviteOptions {
  *    instructions instead.
  *
  * `membership` is always populated when the server returned 2xx.
+ *
+ * Email-related fields are populated only when hq-pro performed a
+ * server-side Resend send (caller passed `sendEmail: true` AND the
+ * server supports it). Pre-resend servers omit them entirely.
  */
 export interface InviteResult {
     inviteToken?: string;
@@ -44,6 +59,29 @@ export interface InviteResult {
         inviteToken?: string;
         inviteeEmail?: string;
     };
+    /** Resend send actually fired and accepted by Resend. */
+    emailSent?: boolean;
+    /** Resend skipped because the server has no RESEND_API_KEY configured. */
+    emailSkipped?: boolean;
+    /** Resend was attempted but failed — human-readable reason. */
+    emailError?: string;
+}
+export interface ResendInviteOptions {
+    inviteeEmail: string;
+    companyUid: string;
+    callerUid: string;
+    token: string;
+}
+/**
+ * Outcome of `hq members invite --resend`. No new membership row was
+ * created — the server's `resend: true` short-circuit just re-fires the
+ * Resend email against the existing pending row.
+ */
+export interface ResendInviteResult {
+    resent: true;
+    emailSent: boolean;
+    emailSkipped: boolean;
+    emailError?: string;
 }
 export interface DetectedTarget {
     type: "email" | "person";
@@ -59,6 +97,16 @@ export declare function shortDate(iso: string): string;
 export declare function getCallerPersonUid(token: string): Promise<string>;
 /** Send a `/membership/invite` request and return the magic link. */
 export declare function inviteMember(options: InviteOptions): Promise<InviteResult>;
+/**
+ * Re-fire the invite email against an existing pending row without
+ * creating a new membership row. Maps to hq-pro `/membership/invite`
+ * with `{ resend: true }` (see hq-pro PR #140). Server gates on the
+ * caller's admin/owner role.
+ *
+ * Returns the email-send status. 404 here means "no pending row exists
+ * for this email+company pair — re-invite without --resend first."
+ */
+export declare function resendInvite(options: ResendInviteOptions): Promise<ResendInviteResult>;
 export declare class InviteHttpError extends Error {
     status: number;
     code?: string | undefined;

package/dist/commands/members.js

@@ -1,5 +1,5 @@
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="c06b812a-ee4a-5701-a64b-cee2fcfef523")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="83c39bc9-e532-580d-bc3a-5f176eb5cba6")}catch(e){}}();
 import chalk from "chalk";
 import { ensureCognitoToken } from "../utils/cognito-session.js";
 import { vaultApiFetch, getCompanyUid } from "../utils/vault-api.js";
@@ -47,6 +47,9 @@ export async function inviteMember(options) {
     if (!detected) {
         throw new Error(`Invalid target '${options.target}': must be an email address or a personUid matching prs_<alphanumeric>`);
     }
+    if (options.groupIds && options.groupIds.length > 0 && detected.type === "person") {
+        throw new Error("--groups is only valid on email-keyed invites (server rejects personUid + groupIds with 400)");
+    }
     const allowedPrefixes = options.paths
         ? options.paths.split(",").map((p) => p.trim()).filter(Boolean)
         : undefined;
@@ -61,6 +64,11 @@ export async function inviteMember(options) {
         body.personUid = detected.value;
     if (allowedPrefixes)
         body.allowedPrefixes = allowedPrefixes;
+    if (options.groupIds && options.groupIds.length > 0) {
+        body.groupIds = options.groupIds;
+    }
+    if (options.sendEmail === true)
+        body.sendEmail = true;
     const res = await vaultApiFetch({
         token: options.token,
         path: "/membership/invite",
@@ -92,6 +100,58 @@ export async function inviteMember(options) {
             ? { inviteToken, magicLink: `hq://accept/${inviteToken}` }
             : {}),
         membership: data.membership,
+        // Pre-resend hq-pro versions omit these fields entirely — leave the
+        // result fields undefined so the caller's "is server-side email
+        // supported?" check works via `typeof result.emailSent === 'boolean'`.
+        ...(typeof data.emailSent === "boolean" ? { emailSent: data.emailSent } : {}),
+        ...(typeof data.emailSkipped === "boolean"
+            ? { emailSkipped: data.emailSkipped }
+            : {}),
+        ...(data.emailError ? { emailError: data.emailError } : {}),
+    };
+}
+/**
+ * Re-fire the invite email against an existing pending row without
+ * creating a new membership row. Maps to hq-pro `/membership/invite`
+ * with `{ resend: true }` (see hq-pro PR #140). Server gates on the
+ * caller's admin/owner role.
+ *
+ * Returns the email-send status. 404 here means "no pending row exists
+ * for this email+company pair — re-invite without --resend first."
+ */
+export async function resendInvite(options) {
+    const detected = detectTarget(options.inviteeEmail);
+    if (!detected || detected.type !== "email") {
+        throw new Error("--resend requires an email target (the resend path is email-keyed-row only)");
+    }
+    const res = await vaultApiFetch({
+        token: options.token,
+        path: "/membership/invite",
+        method: "POST",
+        body: {
+            companyUid: options.companyUid,
+            // Server's invite handler still requires `role` even on the resend
+            // short-circuit. Pass the safe default — server ignores it on this
+            // path (the pending row already has its real role).
+            role: "member",
+            inviteeEmail: detected.value,
+            invitedBy: options.callerUid,
+            resend: true,
+        },
+    });
+    if (!res.ok) {
+        const err = (await res.json().catch(() => ({})));
+        throw new InviteHttpError(res.status, err.message ?? err.error ?? res.statusText, err.code);
+    }
+    const data = (await res.json());
+    if (data.resent !== true) {
+        throw new Error("Resend endpoint returned 2xx without `resent: true` — the connected hq-pro likely doesn't support `resend: true` yet. Upgrade hq-pro or re-invite without --resend.");
+    }
+    return {
+        resent: true,
+        emailSent: data.emailSent === true,
+        emailSkipped: data.emailSkipped === true,
+        ...(data.emailError ? { emailError: data.emailError } : {}),
     };
 }
 export class InviteHttpError extends Error {
@@ -163,6 +223,21 @@ export function resolveRevokeTargetToMembershipKey(arg, companyUid) {
     }
     return arg;
 }
+function printEmailStatus(opts) {
+    if (opts.sent) {
+        console.log(chalk.green(`✓ Invitation email sent to ${opts.recipient.toLowerCase()}`));
+        return;
+    }
+    if (opts.skipped) {
+        console.log(chalk.yellow(`⚠ Email send skipped — hq-pro has no RESEND_API_KEY configured for this stage.`));
+        return;
+    }
+    if (opts.error) {
+        console.log(chalk.yellow(`⚠ Email send failed: ${opts.error}`));
+        return;
+    }
+    console.log(chalk.yellow(`⚠ Email status unknown — hq-pro returned no email fields (likely a pre-resend deploy).`));
+}
 export async function revokeInvite(token, tokenOrKey, companyUid) {
     const res = await vaultApiFetch({
         token,
@@ -182,19 +257,46 @@ export function registerMembersCommand(program) {
         .option("--company <slug>", "Company slug (resolves to companyUid)");
     members
         .command("invite <target>")
-        .description("Invite a person to the company by email or personUid (prints a magic link)")
+        .description("Invite a person to the company by email or personUid (sends an invitation email by default)")
         .option("--role <role>", "Role for the invitee: owner, admin, member, or guest", "member")
         .option("--paths <prefixes>", "Comma-separated allowed prefixes (only valid with --role guest)")
+        .option("--groups <ids>", "Comma-separated secret-group ids the invitee will be added to on claim (email-keyed invites only)")
+        .option("--send-email", "Have hq-pro send an invitation email via Resend (default true for email-keyed invites). Pre-resend hq-pro versions ignore this and the legacy 'no email sent' instructions print instead.", true)
+        .option("--no-send-email", "Skip the server-side Resend send — only create the pending DDB row. Useful when you're scripting bulk invites and will send the announcement out-of-band.")
+        .option("--resend", "Re-fire the invitation email against an existing pending row without creating a new row. Maps to hq-pro `resend: true` short-circuit. Email-keyed invites only.")
         .action(async (target, opts) => {
         try {
             const token = await ensureCognitoToken();
             const companySlug = members.opts().company;
             const companyUid = await getCompanyUid(token, companySlug);
             const callerUid = await getCallerPersonUid(token);
+            // --resend short-circuits to the server's re-fire path. No new row.
+            if (opts.resend === true) {
+                const resendResult = await resendInvite({
+                    inviteeEmail: target,
+                    companyUid,
+                    callerUid,
+                    token,
+                });
+                console.log(chalk.green(`Re-fired invite email for ${target.toLowerCase()} (existing pending row left untouched)`));
+                console.log();
+                printEmailStatus({
+                    recipient: target,
+                    sent: resendResult.emailSent,
+                    skipped: resendResult.emailSkipped,
+                    error: resendResult.emailError,
+                });
+                return;
+            }
+            const groupIds = opts.groups
+                ? opts.groups.split(",").map((g) => g.trim()).filter(Boolean)
+                : undefined;
             const result = await inviteMember({
                 target,
                 role: opts.role,
                 paths: opts.paths,
+                groupIds,
+                sendEmail: opts.sendEmail,
                 companyUid,
                 callerUid,
                 token,
@@ -207,34 +309,60 @@ export function registerMembersCommand(program) {
                 console.log(`  ${result.magicLink}`);
                 console.log();
                 console.log(chalk.dim("Share this link with the invitee. They can run `hq onboard join --invite-token <token>` to accept."));
+                return;
             }
-            else {
-                // schemaVersion 2+ — email-keyed authoritative membership row.
-                // No magic link to share; invitee accepts by signing into HQ.
-                //
-                // CRITICAL UX NOTE: this CLI command does NOT send any email.
-                // hq-pro only writes the DDB pending row; only the hq-console UI
-                // path triggers Resend. Operators who run `hq members invite`
-                // expecting an email to fly out get silently broken flows. The
-                // output below uses chalk.yellow + an explicit "no email sent"
-                // line so this never sneaks past again.
-                const inviteeEmail = result.membership.inviteeEmail ??
-                    (typeof target === "string" && target.includes("@")
-                        ? target
-                        : undefined);
-                console.log(chalk.yellow("⚠ No email was sent. `hq members invite` only creates the pending membership row."));
-                console.log();
-                console.log(chalk.bold("To complete the invite, do ONE of:"));
-                console.log(`  1. Manually notify ${inviteeEmail ?? "the invitee"}: ask them to sign into HQ`);
-                console.log(`     at https://hq.getindigo.ai with that email address.`);
-                console.log(`  2. Or use the hq-console UI at https://hq.getindigo.ai to issue the`);
-                console.log(`     invite instead — the UI path triggers an automated email via Resend.`);
-                console.log();
-                console.log(chalk.dim("The pending membership row claims itself on the invitee's first sign-in."));
+            // schemaVersion 2+ — email-keyed authoritative membership row.
+            // Three output branches depending on whether the server-side
+            // Resend send fired:
+            //   (a) emailSent === true  → "email sent" success line
+            //   (b) emailSkipped === true → server has no RESEND_API_KEY;
+            //       fall back to the manual-notify instructions
+            //   (c) emailSent/emailSkipped both undefined → pre-resend
+            //       hq-pro, doesn't understand `sendEmail` at all; fall
+            //       back to the manual-notify instructions
+            const inviteeEmail = result.membership.inviteeEmail ??
+                (typeof target === "string" && target.includes("@")
+                    ? target
+                    : undefined);
+            const emailDelivered = result.emailSent === true;
+            if (emailDelivered) {
+                printEmailStatus({
+                    recipient: inviteeEmail ?? target,
+                    sent: true,
+                    skipped: false,
+                    error: undefined,
+                });
                 if (result.membership.membershipKey) {
                     console.log();
                     console.log(chalk.dim(`Membership key: ${result.membership.membershipKey}`));
                 }
+                return;
+            }
+            // Email-send failed or wasn't attempted — surface the manual path.
+            if (result.emailError) {
+                console.log(chalk.yellow(`⚠ Email send failed: ${result.emailError}`));
+                console.log();
+            }
+            console.log(chalk.yellow("⚠ No email was sent. The pending membership row exists; the invitee needs to sign in manually to claim it."));
+            console.log();
+            console.log(chalk.bold("To complete the invite, do ONE of:"));
+            console.log(`  1. Manually notify ${inviteeEmail ?? "the invitee"}: ask them to sign into HQ`);
+            console.log(`     at https://hq.getindigo.ai with that email address.`);
+            console.log(`  2. Or use the hq-console UI at https://hq.getindigo.ai to issue the`);
+            console.log(`     invite instead — the UI path triggers an automated email via Resend.`);
+            if (result.emailSkipped !== true && result.emailSent === undefined) {
+                console.log();
+                console.log(chalk.dim("Tip: this hq-pro deploy doesn't support server-side email yet (`sendEmail` ignored). Ask an operator to ship hq-pro PR #140 + provision the ResendApiKey SST secret."));
+            }
+            else if (result.emailSkipped === true) {
+                console.log();
+                console.log(chalk.dim("Tip: hq-pro reported `emailSkipped: true` — its `RESEND_API_KEY` SST secret isn't set for this stage."));
+            }
+            console.log();
+            console.log(chalk.dim("The pending membership row claims itself on the invitee's first sign-in."));
+            if (result.membership.membershipKey) {
+                console.log();
+                console.log(chalk.dim(`Membership key: ${result.membership.membershipKey}`));
             }
         }
         catch (err) {
@@ -323,4 +451,4 @@ export function registerMembersCommand(program) {
     });
 }
 //# sourceMappingURL=members.js.map
-//# debugId=c06b812a-ee4a-5701-a64b-cee2fcfef523
+//# debugId=83c39bc9-e532-580d-bc3a-5f176eb5cba6

package/dist/commands/pkg-install.js

@@ -13,7 +13,7 @@
  * 9. Print next-step message
  */
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="874fe8a4-2348-5f03-8600-c545cac13fc9")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="c6ab4668-f147-5612-bbfc-e1e80b2f018a")}catch(e){}}();
 import * as fs from 'fs';
 import * as os from 'os';
 import * as path from 'path';
@@ -21,7 +21,7 @@ import * as yaml from 'js-yaml';
 import { execSync } from 'child_process';
 import chalk from 'chalk';
 import { ensureCognitoToken } from '../utils/cognito-session.js';
-import { findHqRoot } from '../utils/hq-root.js';
+import { resolveDefaultHqRoot } from '../utils/cognito-session.js';
 import { getRegistryUrl, RegistryClient, } from '../utils/registry-client.js';
 import { verifySha256, verifyRsaSignature } from '../utils/integrity.js';
 import { addToRegistry } from '../utils/registry.js';
@@ -93,7 +93,7 @@ async function installPackage(slug, company) {
             }
         }
         // 7. Extract
-        const hqRoot = findHqRoot();
+        const hqRoot = resolveDefaultHqRoot({ onMissing: 'throw' });
         const installDir = path.resolve(hqRoot, 'packages', 'installed', slug);
         // Clean existing installation
         if (fs.existsSync(installDir)) {
@@ -156,4 +156,4 @@ async function installPackage(slug, company) {
     }
 }
 //# sourceMappingURL=pkg-install.js.map
-//# debugId=874fe8a4-2348-5f03-8600-c545cac13fc9
+//# debugId=c6ab4668-f147-5612-bbfc-e1e80b2f018a

package/dist/commands/pkg-list.js

@@ -4,9 +4,9 @@
  * Graceful offline: if registry is unreachable, show cached data with a note.
  */
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="ce4886ce-109a-5ace-b8d9-4e5bed61978a")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="2ca922cd-1115-5059-850d-3927226eb9ee")}catch(e){}}();
 import chalk from 'chalk';
-import { findHqRoot } from '../utils/hq-root.js';
+import { resolveDefaultHqRoot } from '../utils/cognito-session.js';
 import { readRegistry } from '../utils/registry.js';
 import { loadCachedTokens, isExpiring } from '@indigoai-us/hq-cloud';
 import { getRegistryUrl, RegistryClient, } from '../utils/registry-client.js';
@@ -26,7 +26,7 @@ export function registerPackageListCommand(parent) {
     });
 }
 async function listPackages() {
-    const hqRoot = findHqRoot();
+    const hqRoot = resolveDefaultHqRoot({ onMissing: 'throw' });
     const installed = readRegistry(hqRoot);
     // Print installed packages
     if (installed.length > 0) {
@@ -70,4 +70,4 @@ async function listPackages() {
     }
 }
 //# sourceMappingURL=pkg-list.js.map
-//# debugId=ce4886ce-109a-5ace-b8d9-4e5bed61978a
+//# debugId=2ca922cd-1115-5059-850d-3927226eb9ee

package/dist/commands/pkg-remove.js

@@ -6,11 +6,11 @@
  * 3. Print next-step message
  */
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="b54529d6-de12-595e-b1c7-ab50b9f22eb5")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="e44da498-3e38-5643-b124-49aa2e91f42b")}catch(e){}}();
 import * as fs from 'fs';
 import * as path from 'path';
 import chalk from 'chalk';
-import { findHqRoot } from '../utils/hq-root.js';
+import { resolveDefaultHqRoot } from '../utils/cognito-session.js';
 import { removeFromRegistry, readRegistry } from '../utils/registry.js';
 export function registerPackageRemoveCommand(parent) {
     parent
@@ -27,7 +27,7 @@ export function registerPackageRemoveCommand(parent) {
     });
 }
 async function removePackage(slug) {
-    const hqRoot = findHqRoot();
+    const hqRoot = resolveDefaultHqRoot({ onMissing: 'throw' });
     const installDir = path.resolve(hqRoot, 'packages', 'installed', slug);
     // Verify it is actually installed
     const entries = readRegistry(hqRoot);
@@ -53,4 +53,4 @@ async function removePackage(slug) {
     console.log(chalk.cyan('Run /package-remove ' + slug + ' in Claude to clean up merged content.'));
 }
 //# sourceMappingURL=pkg-remove.js.map
-//# debugId=b54529d6-de12-595e-b1c7-ab50b9f22eb5
+//# debugId=e44da498-3e38-5643-b124-49aa2e91f42b

package/dist/commands/pkg-update.js

@@ -5,7 +5,7 @@
  * If slug given: update only that package.
  */
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="3ef2968d-eb65-594b-a506-4314b70dd3dc")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="35fae6a0-f8e1-5fde-90d8-34ae4adb3c1c")}catch(e){}}();
 import * as fs from 'fs';
 import * as os from 'os';
 import * as path from 'path';
@@ -13,7 +13,7 @@ import * as yaml from 'js-yaml';
 import { execSync } from 'child_process';
 import chalk from 'chalk';
 import { ensureCognitoToken } from '../utils/cognito-session.js';
-import { findHqRoot } from '../utils/hq-root.js';
+import { resolveDefaultHqRoot } from '../utils/cognito-session.js';
 import { getRegistryUrl, RegistryClient, } from '../utils/registry-client.js';
 import { verifySha256, verifyRsaSignature } from '../utils/integrity.js';
 import { readRegistry, addToRegistry, } from '../utils/registry.js';
@@ -32,7 +32,7 @@ export function registerPackageUpdateCommand(parent) {
     });
 }
 async function updatePackages(slug) {
-    const hqRoot = findHqRoot();
+    const hqRoot = resolveDefaultHqRoot({ onMissing: 'throw' });
     const entries = readRegistry(hqRoot);
     if (entries.length === 0) {
         console.log('No packages installed. Use "hq packages install <slug>" to install one.');
@@ -124,4 +124,4 @@ async function updatePackages(slug) {
     console.log(`\n${updatedCount} package(s) updated${updatedCount > 0 ? '.' : ' — everything is current.'}`);
 }
 //# sourceMappingURL=pkg-update.js.map
-//# debugId=3ef2968d-eb65-594b-a506-4314b70dd3dc
+//# debugId=35fae6a0-f8e1-5fde-90d8-34ae4adb3c1c

package/dist/commands/team-sync.js

@@ -10,13 +10,13 @@
  * 6. Gracefully handle conflicts (warn, don't force overwrite)
  */
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="4c9a650e-05ed-5e33-b5de-b6d521ecdf4f")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="2b2504c1-06d5-59f8-a9b3-41d1af7f745f")}catch(e){}}();
 import * as fs from 'fs';
 import * as path from 'path';
 import { execSync } from 'child_process';
 import chalk from 'chalk';
 import simpleGit from 'simple-git';
-import { findHqRoot } from '../utils/hq-root.js';
+import { resolveDefaultHqRoot } from '../utils/cognito-session.js';
 import { ensureCognitoToken } from '../utils/cognito-session.js';
 // ─── API helpers ────────────────────────────────────────────────────────────
 const API_BASE = 'https://example.com/api';
@@ -308,7 +308,7 @@ export function registerTeamSyncCommand(program) {
         .option('--dry-run', 'Show what would be synced without making changes')
         .action(async (options) => {
         try {
-            const hqRoot = findHqRoot();
+            const hqRoot = resolveDefaultHqRoot({ onMissing: 'throw' });
             // 1. Discover team directories
             let teamDirs = discoverTeamDirs(hqRoot);
             if (teamDirs.length === 0) {
@@ -422,4 +422,4 @@ export function registerTeamSyncCommand(program) {
     });
 }
 //# sourceMappingURL=team-sync.js.map
-//# debugId=4c9a650e-05ed-5e33-b5de-b6d521ecdf4f
+//# debugId=2b2504c1-06d5-59f8-a9b3-41d1af7f745f

package/dist/index.js

@@ -3,7 +3,7 @@
  * HQ CLI - Module management, package management, and cloud sync for HQ
  */
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="a9b69c08-39a6-58c3-a4b6-a309d0ab8254")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="0ed956d3-5fde-54aa-96cb-1859a15f7723")}catch(e){}}();
 import { Command } from "commander";
 import { initSentry, Sentry } from "./sentry.js";
 import { registerAddCommand } from "./commands/add.js";
@@ -37,6 +37,7 @@ import { registerSourcesCommand } from "./commands/sources.js";
 import { registerSignalsCommand } from "./commands/signals.js";
 import { sanitizeArgv } from "./utils/feedback-diagnostics.js";
 import { maybeWarnNewVersion, refreshVersionCache, } from "./utils/version-check.js";
+import { enforceVersionGate, shouldSkipGate, } from "./utils/version-gate.js";
 import { CLI_VERSION } from "./cli-version.js";
 // Swallow EPIPE when a downstream reader (e.g. `source <(…)`, `| head`) closes the pipe early.
 const onPipeError = (err) => {
@@ -126,6 +127,14 @@ registerSignalsCommand(program);
             message: sanitizeArgv(process.argv.slice(2)).join(" "),
             level: "info",
         });
+        // Hard version gate: ask hq-pro whether this CLI is below the floor and
+        // auto-update if so (exits the process on update). Skipped for inspection
+        // flags (`--version`, `--help`) so users debugging a broken install can
+        // still introspect what they have. Silent on any failure — never blocks
+        // the CLI on a flaky network or hq-pro hiccup. See `utils/version-gate.ts`.
+        if (!shouldSkipGate(process.argv)) {
+            await enforceVersionGate();
+        }
         await program.parseAsync();
     }
     catch (err) {
@@ -137,4 +146,4 @@ registerSignalsCommand(program);
     }
 })();
 //# sourceMappingURL=index.js.map
-//# debugId=a9b69c08-39a6-58c3-a4b6-a309d0ab8254
+//# debugId=0ed956d3-5fde-54aa-96cb-1859a15f7723

package/dist/utils/cognito-session.d.ts

@@ -45,7 +45,28 @@ export declare const DEFAULT_VAULT_API_URL: string;
  * value at registration time, which matches the user's actual cwd at process
  * start. Re-importable as a function for tests and command-time resolution.
  */
-export declare function resolveDefaultHqRoot(): string;
+/**
+ * Resolve the HQ root directory.
+ *
+ * Resolution order:
+ *   1. $HQ_ROOT env var (treated as an explicit assertion by the caller)
+ *   2. Walk up from cwd looking for `core.yaml` AND `companies/` siblings
+ *   3. Fall back to `~/hq` (or throw, per `opts.onMissing`)
+ *
+ * `opts.onMissing` controls the third arm:
+ *   - `'fallback'` (default) — return `~/hq` if no HQ root is found above cwd.
+ *     This preserves the module-load contract of `DEFAULT_HQ_ROOT`, which
+ *     several commander.js `.option()` callers pin at registration time.
+ *   - `'throw'` — throw with a user-actionable error. Used by module-management
+ *     commands (pkg-install, pkg-remove, pkg-list, pkg-update, team-sync) where
+ *     a silent default-path miss would silently target the wrong directory.
+ *
+ * `$HQ_ROOT` short-circuits both arms — if the env var is set, it's used
+ * as-is regardless of `onMissing`.
+ */
+export declare function resolveDefaultHqRoot(opts?: {
+    onMissing?: "throw" | "fallback";
+}): string;
 export declare const DEFAULT_HQ_ROOT: string;
 /**
  * Return a non-expired Cognito access token, refreshing or browser-logging-in