@indigoai-us/hq-cli 5.275.0 → 5.276.0

package/dist/utils/hq-root-resolver.js

@@ -0,0 +1,103 @@
+/** Lightweight HQ-root resolver shared by cloud commands and fast flag scope. */
+import * as fs from "node:fs";
+import * as os from "node:os";
+import * as path from "node:path";
+import * as yaml from "js-yaml";
+/**
+ * Resolve the HQ tree root using the same precedence as the Cognito helpers:
+ * explicit HQ_ROOT, nearest cwd root, installer records, known locations, then
+ * the historical ~/hq fallback (or an error when requested).
+ */
+export function resolveDefaultHqRoot(opts = {}) {
+    const env = opts.env ?? process.env;
+    const home = opts.home ?? os.homedir();
+    if (env.HQ_ROOT)
+        return path.resolve(env.HQ_ROOT);
+    let cur = path.resolve(opts.cwd ?? process.cwd());
+    while (cur !== path.dirname(cur)) {
+        if (isHqRoot(cur))
+            return cur;
+        cur = path.dirname(cur);
+    }
+    const fromConfig = readHqRootFromHqConfig(path.join(home, ".hq"));
+    if (fromConfig)
+        return path.resolve(fromConfig);
+    const discovered = discoverHqRootViaCoreYaml(home);
+    if (discovered)
+        return discovered;
+    if (opts.onMissing === "throw") {
+        throw new Error("Could not find HQ root. Run this command from within your HQ directory " +
+            "(must contain core.yaml AND a companies/ subdirectory), set $HQ_ROOT, " +
+            "or install HQ via the installer/menubar so ~/.hq/menubar.json records " +
+            "its location.");
+    }
+    return path.join(home, "hq");
+}
+function readHqRootFromHqConfig(hqConfigDir) {
+    const fromMenubar = readJsonStringField(path.join(hqConfigDir, "menubar.json"), "hqPath");
+    if (fromMenubar)
+        return fromMenubar;
+    return readJsonStringField(path.join(hqConfigDir, "config.json"), "hqFolderPath");
+}
+function readJsonStringField(file, field) {
+    try {
+        const parsed = JSON.parse(fs.readFileSync(file, "utf-8"));
+        const value = parsed[field];
+        return typeof value === "string" && value.length > 0 ? value : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+function hqDiscoveryCandidates(home) {
+    return [
+        path.join(home, "HQ"),
+        path.join(home, "hq"),
+        path.join(home, "Documents", "HQ"),
+        path.join(home, "Documents", "hq"),
+        path.join(home, "Desktop", "HQ"),
+        path.join(home, "Desktop", "hq"),
+    ];
+}
+function discoverHqRootViaCoreYaml(home) {
+    return hqDiscoveryCandidates(home).find(isValidHqRootSignature);
+}
+function isValidHqRootSignature(dir) {
+    const canonical = path.join(dir, "core", "core.yaml");
+    const legacy = path.join(dir, "core.yaml");
+    let file;
+    if (fileExists(canonical))
+        file = canonical;
+    else if (fileExists(legacy))
+        file = legacy;
+    else
+        return false;
+    try {
+        const parsed = yaml.load(fs.readFileSync(file, "utf-8"));
+        return !!parsed && typeof parsed === "object" && "version" in parsed && "hqVersion" in parsed;
+    }
+    catch {
+        return false;
+    }
+}
+function fileExists(file) {
+    try {
+        return fs.statSync(file).isFile();
+    }
+    catch {
+        return false;
+    }
+}
+function isHqRoot(dir) {
+    const hasCoreYaml = fileExists(path.join(dir, "core", "core.yaml")) ||
+        fileExists(path.join(dir, "core.yaml"));
+    if (!hasCoreYaml)
+        return false;
+    try {
+        return fs.statSync(path.join(dir, "companies")).isDirectory();
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=hq-root-resolver.js.map

package/dist/utils/scaffold-fast-import-guard.js

@@ -4,6 +4,8 @@ export function forbiddenFastPathModules(loadedModules, distDirectory) {
     const dist = path.resolve(distDirectory);
     const main = path.join(dist, "main.js");
     const commands = `${path.join(dist, "commands")}${path.sep}`;
+    const flagRegistry = path.join(dist, "lib", "flag-registry.js");
+    const coreCommand = path.join(dist, "commands", "core.js");
     return [...new Set(loadedModules.map((loaded) => {
             if (loaded.startsWith("file:")) {
                 try {
@@ -16,7 +18,10 @@ export function forbiddenFastPathModules(loadedModules, distDirectory) {
             return path.resolve(loaded);
         }))]
         .filter((loaded) => path.resolve(loaded) === main ||
-        path.resolve(loaded).startsWith(commands))
+        path.resolve(loaded).startsWith(commands) ||
+        path.resolve(loaded) === flagRegistry ||
+        path.resolve(loaded) === coreCommand ||
+        path.resolve(loaded).includes(`${path.sep}node_modules${path.sep}@sentry${path.sep}node${path.sep}`))
         .sort();
 }
 export function assertFastPathStaysCommandGraphFree(loadedModules, distDirectory) {

package/dist/utils/vault-api.d.ts

@@ -47,6 +47,13 @@ export declare function rewritePathForApiKey(path: string): string | null;
  * authorization or request signing depends on it.
  */
 export declare const HQ_CLIENT_NAME = "@indigoai-us/hq-cli";
+type VaultApiRequestTargetOptions = Pick<VaultApiOptions, "baseUrl" | "token" | "path" | "query">;
+/**
+ * Run vaultApiFetch's synchronous, client-side request checks without sending
+ * the request. Commands with prior uploads use this to fail before creating
+ * objects that a later local refusal would leave orphaned.
+ */
+export declare function assertVaultApiRequestSupported(opts: VaultApiRequestTargetOptions): void;
 export declare function vaultApiFetch(opts: VaultApiOptions): Promise<Response>;
 /**
  * Public (NONE-auth) GET against the vault API — no bearer token. The
@@ -77,4 +84,5 @@ export declare function getEntityUid(token: string, opts: {
 }, options?: {
     allowOfflineScopeFallback?: boolean;
 }): Promise<string>;
+export {};
 //# sourceMappingURL=vault-api.d.ts.map

package/dist/utils/vault-api.js

@@ -155,7 +155,7 @@ export function rewritePathForApiKey(path) {
  * authorization or request signing depends on it.
  */
 export const HQ_CLIENT_NAME = "@indigoai-us/hq-cli";
-export async function vaultApiFetch(opts) {
+function resolveVaultApiRequestTarget(opts) {
     let path = opts.path;
     if (opts.token.startsWith("hqk_")) {
         const rewritten = rewritePathForApiKey(path);
@@ -172,6 +172,18 @@ export async function vaultApiFetch(opts) {
             url.searchParams.set(k, v);
         }
     }
+    return { path, url };
+}
+/**
+ * Run vaultApiFetch's synchronous, client-side request checks without sending
+ * the request. Commands with prior uploads use this to fail before creating
+ * objects that a later local refusal would leave orphaned.
+ */
+export function assertVaultApiRequestSupported(opts) {
+    resolveVaultApiRequestTarget(opts);
+}
+export async function vaultApiFetch(opts) {
+    const { path, url } = resolveVaultApiRequestTarget(opts);
     const method = opts.method ?? 'GET';
     const safeUrl = url.search ? `${url.origin}${url.pathname}?<redacted>` : `${url.origin}${url.pathname}`;
     Sentry.addBreadcrumb({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.275.0",
+  "version": "5.276.0",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {