@indigoai-us/hq-cli 5.3.0 → 5.4.0

package/dist/commands/pkg-install.js

@@ -0,0 +1,144 @@
+/**
+ * hq packages install <slug> — download, verify, and extract a package (US-005)
+ *
+ * Flow:
+ * 1. Check auth (prompt login if needed)
+ * 2. Check entitlement via API
+ * 3. Download tarball via presigned URL
+ * 4. Verify SHA256 hash
+ * 5. Verify RSA signature (if provided)
+ * 6. Extract to packages/installed/<slug>/
+ * 7. Validate extracted package.yaml slug matches
+ * 8. Update packages/registry.yaml
+ * 9. Print next-step message
+ */
+import * as fs from 'fs';
+import * as os from 'os';
+import * as path from 'path';
+import * as yaml from 'js-yaml';
+import { execSync } from 'child_process';
+import chalk from 'chalk';
+import { getAuthToken } from '../utils/auth.js';
+import { findHqRoot } from '../utils/hq-root.js';
+import { getRegistryUrl, RegistryClient, } from '../utils/registry-client.js';
+import { verifySha256, verifyRsaSignature } from '../utils/integrity.js';
+import { addToRegistry } from '../utils/registry.js';
+export function registerPackageInstallCommand(parent) {
+    parent
+        .command('install <slug>')
+        .description('Install a package from the registry')
+        .option('--company <co>', 'Scope the package to a specific company')
+        .action(async (slug, opts) => {
+        try {
+            await installPackage(slug, opts.company);
+        }
+        catch (error) {
+            console.error(chalk.red('Install failed:'), error instanceof Error ? error.message : 'Unknown error');
+            process.exit(1);
+        }
+    });
+}
+async function installPackage(slug, company) {
+    // 1. Auth
+    const token = await getAuthToken();
+    const registryUrl = getRegistryUrl();
+    const client = new RegistryClient(registryUrl, token.clerk_session_token);
+    // 2. Check entitlement
+    console.log(chalk.dim(`Checking entitlement for ${slug}...`));
+    const entitlement = await client.checkEntitlement(slug);
+    if (!entitlement.entitled) {
+        throw new Error(`You are not entitled to package "${slug}". Visit the registry to purchase or request access.`);
+    }
+    // 3. Get download URL
+    console.log(chalk.dim('Fetching download URL...'));
+    const download = await client.getDownloadUrl(slug);
+    // 4. Download to temp file
+    const tmpDir = os.tmpdir();
+    const tmpFile = path.resolve(tmpDir, `hq-pkg-${slug}-${Date.now()}.tar.gz`);
+    try {
+        console.log(chalk.dim('Downloading package...'));
+        const response = await fetch(download.url, {
+            signal: AbortSignal.timeout(120_000),
+        });
+        if (!response.ok) {
+            throw new Error(`Download failed (${response.status})`);
+        }
+        const buffer = Buffer.from(await response.arrayBuffer());
+        fs.writeFileSync(tmpFile, buffer);
+        // 5. Verify SHA256
+        console.log(chalk.dim('Verifying integrity...'));
+        const hashValid = await verifySha256(tmpFile, download.sha256);
+        if (!hashValid) {
+            throw new Error('SHA256 hash mismatch — the downloaded file may be corrupted or tampered with.');
+        }
+        // 6. Verify RSA signature (if provided)
+        if (download.signature) {
+            const sigValid = verifyRsaSignature(download.sha256, download.signature);
+            if (!sigValid) {
+                throw new Error('RSA signature verification failed — the package may have been tampered with or the public key is missing/invalid. Aborting install.');
+            }
+        }
+        // 7. Extract
+        const hqRoot = findHqRoot();
+        const installDir = path.resolve(hqRoot, 'packages', 'installed', slug);
+        // Clean existing installation
+        if (fs.existsSync(installDir)) {
+            fs.rmSync(installDir, { recursive: true, force: true });
+        }
+        fs.mkdirSync(installDir, { recursive: true });
+        execSync(`tar -xzf "${tmpFile}" -C "${installDir}"`, {
+            stdio: 'pipe',
+        });
+        // 8. Validate package.yaml slug
+        const packageYamlPath = path.resolve(installDir, 'package.yaml');
+        if (fs.existsSync(packageYamlPath)) {
+            const pkgContent = fs.readFileSync(packageYamlPath, 'utf-8');
+            const pkgMeta = yaml.load(pkgContent);
+            if (pkgMeta?.slug && pkgMeta.slug !== slug) {
+                // Mismatch — clean up and abort
+                fs.rmSync(installDir, { recursive: true, force: true });
+                throw new Error(`Package slug mismatch: expected "${slug}", got "${pkgMeta.slug}"`);
+            }
+        }
+        // 9. Get package info for registry entry
+        let version = 'unknown';
+        let name = slug;
+        try {
+            const pkgInfo = await client.getPackage(slug);
+            version = pkgInfo.package.latest_version;
+            name = pkgInfo.package.name;
+        }
+        catch {
+            // Best-effort — fall back to package.yaml if present
+            const packageYaml = path.resolve(installDir, 'package.yaml');
+            if (fs.existsSync(packageYaml)) {
+                const content = fs.readFileSync(packageYaml, 'utf-8');
+                const meta = yaml.load(content);
+                if (meta?.version)
+                    version = meta.version;
+                if (meta?.name)
+                    name = meta.name;
+            }
+        }
+        // 10. Update registry.yaml
+        const now = new Date().toISOString();
+        addToRegistry(hqRoot, {
+            name,
+            slug,
+            version,
+            source: registryUrl,
+            scope: company,
+            installed_at: now,
+            updated_at: now,
+        });
+        console.log(chalk.green(`\nInstalled ${slug}@${version} to packages/installed/${slug}/`));
+        console.log(chalk.cyan('Run /package-install ' + slug + ' in Claude to merge into your HQ.'));
+    }
+    finally {
+        // Clean up temp file — never leave partial downloads
+        if (fs.existsSync(tmpFile)) {
+            fs.unlinkSync(tmpFile);
+        }
+    }
+}
+//# sourceMappingURL=pkg-install.js.map

package/dist/commands/pkg-install.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pkg-install.js","sourceRoot":"","sources":["../../src/commands/pkg-install.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,KAAK,IAAI,MAAM,SAAS,CAAC;AAChC,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAEzC,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACjD,OAAO,EACL,cAAc,EACd,cAAc,GACf,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AACzE,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAErD,MAAM,UAAU,6BAA6B,CAAC,MAAe;IAC3D,MAAM;SACH,OAAO,CAAC,gBAAgB,CAAC;SACzB,WAAW,CAAC,qCAAqC,CAAC;SAClD,MAAM,CAAC,gBAAgB,EAAE,yCAAyC,CAAC;SACnE,MAAM,CAAC,KAAK,EAAE,IAAY,EAAE,IAA0B,EAAE,EAAE;QACzD,IAAI,CAAC;YACH,MAAM,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QAC3C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CACX,KAAK,CAAC,GAAG,CAAC,iBAAiB,CAAC,EAC5B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CACzD,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC;AAED,KAAK,UAAU,cAAc,CAC3B,IAAY,EACZ,OAAgB;IAEhB,UAAU;IACV,MAAM,KAAK,GAAG,MAAM,YAAY,EAAE,CAAC;IACnC,MAAM,WAAW,GAAG,cAAc,EAAE,CAAC;IACrC,MAAM,MAAM,GAAG,IAAI,cAAc,CAAC,WAAW,EAAE,KAAK,CAAC,mBAAmB,CAAC,CAAC;IAE1E,uBAAuB;IACvB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,4BAA4B,IAAI,KAAK,CAAC,CAAC,CAAC;IAC9D,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACxD,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CACb,oCAAoC,IAAI,sDAAsD,CAC/F,CAAC;IACJ,CAAC;IAED,sBAAsB;IACtB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAC,CAAC;IACnD,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;IAEnD,2BAA2B;IAC3B,MAAM,MAAM,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC;IAC3B,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,UAAU,IAAI,IAAI,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IAE5E,IAAI,CAAC;QACH,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC,CAAC;QACjD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,GAAG,EAAE;YACzC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC;SACrC,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,oBAAoB,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;QAC1D,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;QACzD,EAAE,CAAC,aAAa,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAElC,mBAAmB;QACnB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC,CAAC;QACjD,MAAM,SAAS,GAAG,MAAM,YAAY,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC/D,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CACb,+EAA+E,CAChF,CAAC;QACJ,CAAC;QAED,wCAAwC;QACxC,IAAI,QAAQ,CAAC,SAAS,EAAE,CAAC;YACvB,MAAM,QAAQ,GAAG,kBAAkB,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC;YACzE,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,IAAI,KAAK,CACb,qIAAqI,CACtI,CAAC;YACJ,CAAC;QACH,CAAC;QAED,aAAa;QACb,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;QAC5B,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,UAAU,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC;QAEvE,8BAA8B;QAC9B,IAAI,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAC9B,EAAE,CAAC,MAAM,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1D,CAAC;QACD,EAAE,CAAC,SAAS,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAE9C,QAAQ,CAAC,aAAa,OAAO,SAAS,UAAU,GAAG,EAAE;YACnD,KAAK,EAAE,MAAM;SACd,CAAC,CAAC;QAEH,gCAAgC;QAChC,MAAM,eAAe,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC;QACjE,IAAI,EAAE,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;YACnC,MAAM,UAAU,GAAG,EAAE,CAAC,YAAY,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;YAC7D,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,CAA6B,CAAC;YAClE,IAAI,OAAO,EAAE,IAAI,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;gBAC3C,gCAAgC;gBAChC,EAAE,CAAC,MAAM,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;gBACxD,MAAM,IAAI,KAAK,CACb,oCAAoC,IAAI,WAAW,OAAO,CAAC,IAAI,GAAG,CACnE,CAAC;YACJ,CAAC;QACH,CAAC;QAED,yCAAyC;QACzC,IAAI,OAAO,GAAG,SAAS,CAAC;QACxB,IAAI,IAAI,GAAG,IAAI,CAAC;QAChB,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;YAC9C,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC;YACzC,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC;QAC9B,CAAC;QAAC,MAAM,CAAC;YACP,qDAAqD;YACrD,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC;YAC7D,IAAI,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;gBAC/B,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;gBACtD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAGtB,CAAC;gBACT,IAAI,IAAI,EAAE,OAAO;oBAAE,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;gBAC1C,IAAI,IAAI,EAAE,IAAI;oBAAE,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;YACnC,CAAC;QACH,CAAC;QAED,2BAA2B;QAC3B,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACrC,aAAa,CAAC,MAAM,EAAE;YACpB,IAAI;YACJ,IAAI;YACJ,OAAO;YACP,MAAM,EAAE,WAAW;YACnB,KAAK,EAAE,OAAO;YACd,YAAY,EAAE,GAAG;YACjB,UAAU,EAAE,GAAG;SAChB,CAAC,CAAC;QAEH,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,eAAe,IAAI,IAAI,OAAO,0BAA0B,IAAI,GAAG,CAAC,CAAC,CAAC;QAC1F,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,IAAI,CACR,uBAAuB,GAAG,IAAI,GAAG,mCAAmC,CACrE,CACF,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,qDAAqD;QACrD,IAAI,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3B,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QACzB,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/commands/pkg-list.d.ts

@@ -0,0 +1,8 @@
+/**
+ * hq packages list — show installed packages and available entitlements (US-005)
+ *
+ * Graceful offline: if registry is unreachable, show cached data with a note.
+ */
+import { Command } from 'commander';
+export declare function registerPackageListCommand(parent: Command): void;
+//# sourceMappingURL=pkg-list.d.ts.map

package/dist/commands/pkg-list.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pkg-list.d.ts","sourceRoot":"","sources":["../../src/commands/pkg-list.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAWpC,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,OAAO,GAAG,IAAI,CAgBhE"}

package/dist/commands/pkg-list.js

@@ -0,0 +1,70 @@
+/**
+ * hq packages list — show installed packages and available entitlements (US-005)
+ *
+ * Graceful offline: if registry is unreachable, show cached data with a note.
+ */
+import chalk from 'chalk';
+import { findHqRoot } from '../utils/hq-root.js';
+import { readRegistry } from '../utils/registry.js';
+import { loadToken, isTokenExpired } from '../utils/token-store.js';
+import { getRegistryUrl, RegistryClient, } from '../utils/registry-client.js';
+export function registerPackageListCommand(parent) {
+    parent
+        .command('list')
+        .alias('ls')
+        .description('List installed and available packages')
+        .action(async () => {
+        try {
+            await listPackages();
+        }
+        catch (error) {
+            console.error(chalk.red('List failed:'), error instanceof Error ? error.message : 'Unknown error');
+            process.exit(1);
+        }
+    });
+}
+async function listPackages() {
+    const hqRoot = findHqRoot();
+    const installed = readRegistry(hqRoot);
+    // Print installed packages
+    if (installed.length > 0) {
+        console.log(chalk.bold('Installed packages:\n'));
+        for (const pkg of installed) {
+            const scope = pkg.scope ? chalk.dim(` (${pkg.scope})`) : '';
+            console.log(`  ${chalk.green(pkg.slug)}@${pkg.version}${scope}`);
+            console.log(chalk.dim(`    Installed: ${pkg.installed_at.slice(0, 10)}  Updated: ${pkg.updated_at.slice(0, 10)}`));
+        }
+        console.log();
+    }
+    else {
+        console.log(chalk.dim('No packages installed.\n'));
+    }
+    // Try to show available (but not installed) packages from entitlements
+    let entitlements = [];
+    let offline = false;
+    try {
+        const token = await loadToken();
+        if (token && !isTokenExpired(token)) {
+            const registryUrl = getRegistryUrl();
+            const client = new RegistryClient(registryUrl, token.clerk_session_token);
+            const result = await client.getMyEntitlements();
+            entitlements = result.entitlements;
+        }
+    }
+    catch {
+        offline = true;
+    }
+    const installedSlugs = new Set(installed.map((p) => p.slug));
+    const available = entitlements.filter((e) => !installedSlugs.has(e.slug));
+    if (available.length > 0) {
+        console.log(chalk.bold('Available (not installed):\n'));
+        for (const ent of available) {
+            console.log(`  ${chalk.cyan(ent.slug)} ${chalk.dim(`[${ent.tier}]`)}  ${chalk.yellow('available')}`);
+        }
+        console.log(chalk.dim('\nRun "hq packages install <slug>" to install.\n'));
+    }
+    if (offline) {
+        console.log(chalk.yellow('Note: Could not reach registry — showing cached data only.'));
+    }
+}
+//# sourceMappingURL=pkg-list.js.map

package/dist/commands/pkg-list.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pkg-list.js","sourceRoot":"","sources":["../../src/commands/pkg-list.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACpE,OAAO,EACL,cAAc,EACd,cAAc,GAEf,MAAM,6BAA6B,CAAC;AAErC,MAAM,UAAU,0BAA0B,CAAC,MAAe;IACxD,MAAM;SACH,OAAO,CAAC,MAAM,CAAC;SACf,KAAK,CAAC,IAAI,CAAC;SACX,WAAW,CAAC,uCAAuC,CAAC;SACpD,MAAM,CAAC,KAAK,IAAI,EAAE;QACjB,IAAI,CAAC;YACH,MAAM,YAAY,EAAE,CAAC;QACvB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CACX,KAAK,CAAC,GAAG,CAAC,cAAc,CAAC,EACzB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CACzD,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC;AAED,KAAK,UAAU,YAAY;IACzB,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAC5B,MAAM,SAAS,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;IAEvC,2BAA2B;IAC3B,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC,CAAC;QACjD,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;YAC5B,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,GAAG,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5D,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,OAAO,GAAG,KAAK,EAAE,CAAC,CAAC;YACjE,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,GAAG,CACP,kBAAkB,GAAG,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAC3F,CACF,CAAC;QACJ,CAAC;QACD,OAAO,CAAC,GAAG,EAAE,CAAC;IAChB,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAC,CAAC;IACrD,CAAC;IAED,uEAAuE;IACvE,IAAI,YAAY,GAAuB,EAAE,CAAC;IAC1C,IAAI,OAAO,GAAG,KAAK,CAAC;IAEpB,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,SAAS,EAAE,CAAC;QAChC,IAAI,KAAK,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC;YACpC,MAAM,WAAW,GAAG,cAAc,EAAE,CAAC;YACrC,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,WAAW,EACX,KAAK,CAAC,mBAAmB,CAC1B,CAAC;YACF,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,iBAAiB,EAAE,CAAC;YAChD,YAAY,GAAG,MAAM,CAAC,YAAY,CAAC;QACrC,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,IAAI,CAAC;IACjB,CAAC;IAED,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAC7D,MAAM,SAAS,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAE1E,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC,CAAC;QACxD,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;YAC5B,OAAO,CAAC,GAAG,CACT,KAAK,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,IAAI,GAAG,CAAC,KAAK,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CACxF,CAAC;QACJ,CAAC;QACD,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,GAAG,CAAC,kDAAkD,CAAC,CAC9D,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,MAAM,CACV,4DAA4D,CAC7D,CACF,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/commands/pkg-remove.d.ts

@@ -0,0 +1,10 @@
+/**
+ * hq packages remove <slug> — archive and unregister a package (US-005)
+ *
+ * 1. Archive packages/installed/<slug>/ to packages/.archive/<slug>-<timestamp>/
+ * 2. Remove entry from packages/registry.yaml
+ * 3. Print next-step message
+ */
+import { Command } from 'commander';
+export declare function registerPackageRemoveCommand(parent: Command): void;
+//# sourceMappingURL=pkg-remove.d.ts.map

package/dist/commands/pkg-remove.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pkg-remove.d.ts","sourceRoot":"","sources":["../../src/commands/pkg-remove.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAKpC,wBAAgB,4BAA4B,CAAC,MAAM,EAAE,OAAO,GAAG,IAAI,CAelE"}

package/dist/commands/pkg-remove.js

@@ -0,0 +1,53 @@
+/**
+ * hq packages remove <slug> — archive and unregister a package (US-005)
+ *
+ * 1. Archive packages/installed/<slug>/ to packages/.archive/<slug>-<timestamp>/
+ * 2. Remove entry from packages/registry.yaml
+ * 3. Print next-step message
+ */
+import * as fs from 'fs';
+import * as path from 'path';
+import chalk from 'chalk';
+import { findHqRoot } from '../utils/hq-root.js';
+import { removeFromRegistry, readRegistry } from '../utils/registry.js';
+export function registerPackageRemoveCommand(parent) {
+    parent
+        .command('remove <slug>')
+        .description('Remove an installed package (archives it first)')
+        .action(async (slug) => {
+        try {
+            await removePackage(slug);
+        }
+        catch (error) {
+            console.error(chalk.red('Remove failed:'), error instanceof Error ? error.message : 'Unknown error');
+            process.exit(1);
+        }
+    });
+}
+async function removePackage(slug) {
+    const hqRoot = findHqRoot();
+    const installDir = path.resolve(hqRoot, 'packages', 'installed', slug);
+    // Verify it is actually installed
+    const entries = readRegistry(hqRoot);
+    const entry = entries.find((e) => e.slug === slug);
+    if (!entry && !fs.existsSync(installDir)) {
+        throw new Error(`Package "${slug}" is not installed.`);
+    }
+    // 1. Archive
+    if (fs.existsSync(installDir)) {
+        const timestamp = new Date()
+            .toISOString()
+            .replace(/[:.]/g, '-')
+            .replace('T', '_')
+            .slice(0, 19);
+        const archiveDir = path.resolve(hqRoot, 'packages', '.archive', `${slug}-${timestamp}`);
+        fs.mkdirSync(path.dirname(archiveDir), { recursive: true });
+        fs.renameSync(installDir, archiveDir);
+        console.log(chalk.dim(`Archived to packages/.archive/${slug}-${timestamp}/`));
+    }
+    // 2. Remove from registry.yaml
+    removeFromRegistry(hqRoot, slug);
+    console.log(chalk.green(`\nRemoved ${slug}.`));
+    console.log(chalk.cyan('Run /package-remove ' + slug + ' in Claude to clean up merged content.'));
+}
+//# sourceMappingURL=pkg-remove.js.map

package/dist/commands/pkg-remove.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pkg-remove.js","sourceRoot":"","sources":["../../src/commands/pkg-remove.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAE7B,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACjD,OAAO,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAExE,MAAM,UAAU,4BAA4B,CAAC,MAAe;IAC1D,MAAM;SACH,OAAO,CAAC,eAAe,CAAC;SACxB,WAAW,CAAC,iDAAiD,CAAC;SAC9D,MAAM,CAAC,KAAK,EAAE,IAAY,EAAE,EAAE;QAC7B,IAAI,CAAC;YACH,MAAM,aAAa,CAAC,IAAI,CAAC,CAAC;QAC5B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CACX,KAAK,CAAC,GAAG,CAAC,gBAAgB,CAAC,EAC3B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CACzD,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,IAAY;IACvC,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAC5B,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,UAAU,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC;IAEvE,kCAAkC;IAClC,MAAM,OAAO,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;IACrC,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IACnD,IAAI,CAAC,KAAK,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CAAC,YAAY,IAAI,qBAAqB,CAAC,CAAC;IACzD,CAAC;IAED,aAAa;IACb,IAAI,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC9B,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE;aACzB,WAAW,EAAE;aACb,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC;aACrB,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC;aACjB,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAChB,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAC7B,MAAM,EACN,UAAU,EACV,UAAU,EACV,GAAG,IAAI,IAAI,SAAS,EAAE,CACvB,CAAC;QACF,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5D,EAAE,CAAC,UAAU,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;QACtC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,iCAAiC,IAAI,IAAI,SAAS,GAAG,CAAC,CAAC,CAAC;IAChF,CAAC;IAED,+BAA+B;IAC/B,kBAAkB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAEjC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,aAAa,IAAI,GAAG,CAAC,CAAC,CAAC;IAC/C,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,IAAI,CACR,sBAAsB,GAAG,IAAI,GAAG,wCAAwC,CACzE,CACF,CAAC;AACJ,CAAC"}

package/dist/commands/pkg-update.d.ts

@@ -0,0 +1,9 @@
+/**
+ * hq packages update [slug] — check for and apply package updates (US-005)
+ *
+ * If no slug: check all installed packages for updates.
+ * If slug given: update only that package.
+ */
+import { Command } from 'commander';
+export declare function registerPackageUpdateCommand(parent: Command): void;
+//# sourceMappingURL=pkg-update.d.ts.map

package/dist/commands/pkg-update.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pkg-update.d.ts","sourceRoot":"","sources":["../../src/commands/pkg-update.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAOH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAepC,wBAAgB,4BAA4B,CAAC,MAAM,EAAE,OAAO,GAAG,IAAI,CAelE"}

package/dist/commands/pkg-update.js

@@ -0,0 +1,124 @@
+/**
+ * hq packages update [slug] — check for and apply package updates (US-005)
+ *
+ * If no slug: check all installed packages for updates.
+ * If slug given: update only that package.
+ */
+import * as fs from 'fs';
+import * as os from 'os';
+import * as path from 'path';
+import * as yaml from 'js-yaml';
+import { execSync } from 'child_process';
+import chalk from 'chalk';
+import { getAuthToken } from '../utils/auth.js';
+import { findHqRoot } from '../utils/hq-root.js';
+import { getRegistryUrl, RegistryClient, } from '../utils/registry-client.js';
+import { verifySha256, verifyRsaSignature } from '../utils/integrity.js';
+import { readRegistry, addToRegistry, } from '../utils/registry.js';
+export function registerPackageUpdateCommand(parent) {
+    parent
+        .command('update [slug]')
+        .description('Check for and apply package updates')
+        .action(async (slug) => {
+        try {
+            await updatePackages(slug);
+        }
+        catch (error) {
+            console.error(chalk.red('Update failed:'), error instanceof Error ? error.message : 'Unknown error');
+            process.exit(1);
+        }
+    });
+}
+async function updatePackages(slug) {
+    const hqRoot = findHqRoot();
+    const entries = readRegistry(hqRoot);
+    if (entries.length === 0) {
+        console.log('No packages installed. Use "hq packages install <slug>" to install one.');
+        return;
+    }
+    const token = await getAuthToken();
+    const registryUrl = getRegistryUrl();
+    const client = new RegistryClient(registryUrl, token.clerk_session_token);
+    const toCheck = slug
+        ? entries.filter((e) => e.slug === slug)
+        : entries;
+    if (slug && toCheck.length === 0) {
+        throw new Error(`Package "${slug}" is not installed.`);
+    }
+    let updatedCount = 0;
+    for (const entry of toCheck) {
+        try {
+            const pkgInfo = await client.getPackage(entry.slug);
+            const latestVersion = pkgInfo.package.latest_version;
+            if (latestVersion === entry.version) {
+                console.log(chalk.dim(`${entry.slug}@${entry.version} — up to date`));
+                continue;
+            }
+            console.log(chalk.yellow(`${entry.slug}: ${entry.version} → ${latestVersion}`));
+            // Download new version
+            const download = await client.getDownloadUrl(entry.slug, latestVersion);
+            const tmpFile = path.resolve(os.tmpdir(), `hq-pkg-${entry.slug}-${Date.now()}.tar.gz`);
+            try {
+                const response = await fetch(download.url, {
+                    signal: AbortSignal.timeout(120_000),
+                });
+                if (!response.ok) {
+                    throw new Error(`Download failed (${response.status})`);
+                }
+                const buffer = Buffer.from(await response.arrayBuffer());
+                fs.writeFileSync(tmpFile, buffer);
+                // Verify SHA256
+                const hashValid = await verifySha256(tmpFile, download.sha256);
+                if (!hashValid) {
+                    throw new Error('SHA256 hash mismatch');
+                }
+                // Verify RSA signature (if provided)
+                if (download.signature) {
+                    const sigValid = verifyRsaSignature(download.sha256, download.signature);
+                    if (!sigValid) {
+                        console.warn(chalk.yellow(`  Warning: RSA signature verification failed for ${entry.slug}. Proceeding with SHA256-only.`));
+                    }
+                }
+                // Extract over existing
+                const installDir = path.resolve(hqRoot, 'packages', 'installed', entry.slug);
+                if (fs.existsSync(installDir)) {
+                    fs.rmSync(installDir, { recursive: true, force: true });
+                }
+                fs.mkdirSync(installDir, { recursive: true });
+                execSync(`tar -xzf "${tmpFile}" -C "${installDir}"`, {
+                    stdio: 'pipe',
+                });
+                // Validate package.yaml slug
+                const packageYamlPath = path.resolve(installDir, 'package.yaml');
+                if (fs.existsSync(packageYamlPath)) {
+                    const pkgContent = fs.readFileSync(packageYamlPath, 'utf-8');
+                    const pkgMeta = yaml.load(pkgContent);
+                    if (pkgMeta?.slug && pkgMeta.slug !== entry.slug) {
+                        fs.rmSync(installDir, { recursive: true, force: true });
+                        throw new Error(`Package slug mismatch: expected "${entry.slug}", got "${pkgMeta.slug}"`);
+                    }
+                }
+                // Update registry entry — preserve scope
+                const now = new Date().toISOString();
+                const updated = {
+                    ...entry,
+                    version: latestVersion,
+                    updated_at: now,
+                };
+                addToRegistry(hqRoot, updated);
+                console.log(chalk.green(`  Updated ${entry.slug} to ${latestVersion}`));
+                updatedCount++;
+            }
+            finally {
+                if (fs.existsSync(tmpFile)) {
+                    fs.unlinkSync(tmpFile);
+                }
+            }
+        }
+        catch (error) {
+            console.error(chalk.red(`  Error updating ${entry.slug}:`), error instanceof Error ? error.message : 'Unknown error');
+        }
+    }
+    console.log(`\n${updatedCount} package(s) updated${updatedCount > 0 ? '.' : ' — everything is current.'}`);
+}
+//# sourceMappingURL=pkg-update.js.map

package/dist/commands/pkg-update.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pkg-update.js","sourceRoot":"","sources":["../../src/commands/pkg-update.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,KAAK,IAAI,MAAM,SAAS,CAAC;AAChC,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAEzC,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACjD,OAAO,EACL,cAAc,EACd,cAAc,GACf,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AACzE,OAAO,EACL,YAAY,EACZ,aAAa,GAEd,MAAM,sBAAsB,CAAC;AAE9B,MAAM,UAAU,4BAA4B,CAAC,MAAe;IAC1D,MAAM;SACH,OAAO,CAAC,eAAe,CAAC;SACxB,WAAW,CAAC,qCAAqC,CAAC;SAClD,MAAM,CAAC,KAAK,EAAE,IAAa,EAAE,EAAE;QAC9B,IAAI,CAAC;YACH,MAAM,cAAc,CAAC,IAAI,CAAC,CAAC;QAC7B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CACX,KAAK,CAAC,GAAG,CAAC,gBAAgB,CAAC,EAC3B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CACzD,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,IAAa;IACzC,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAC5B,MAAM,OAAO,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;IAErC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,CAAC,GAAG,CAAC,yEAAyE,CAAC,CAAC;QACvF,OAAO;IACT,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,YAAY,EAAE,CAAC;IACnC,MAAM,WAAW,GAAG,cAAc,EAAE,CAAC;IACrC,MAAM,MAAM,GAAG,IAAI,cAAc,CAAC,WAAW,EAAE,KAAK,CAAC,mBAAmB,CAAC,CAAC;IAE1E,MAAM,OAAO,GAAG,IAAI;QAClB,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC;QACxC,CAAC,CAAC,OAAO,CAAC;IAEZ,IAAI,IAAI,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,YAAY,IAAI,qBAAqB,CAAC,CAAC;IACzD,CAAC;IAED,IAAI,YAAY,GAAG,CAAC,CAAC;IAErB,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACpD,MAAM,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC;YAErD,IAAI,aAAa,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC;gBACpC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC,CAAC;gBACtE,SAAS;YACX,CAAC;YAED,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,MAAM,CACV,GAAG,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,OAAO,MAAM,aAAa,EAAE,CACrD,CACF,CAAC;YAEF,uBAAuB;YACvB,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,cAAc,CAC1C,KAAK,CAAC,IAAI,EACV,aAAa,CACd,CAAC;YAEF,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAC1B,EAAE,CAAC,MAAM,EAAE,EACX,UAAU,KAAK,CAAC,IAAI,IAAI,IAAI,CAAC,GAAG,EAAE,SAAS,CAC5C,CAAC;YAEF,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,GAAG,EAAE;oBACzC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC;iBACrC,CAAC,CAAC;gBAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;oBACjB,MAAM,IAAI,KAAK,CAAC,oBAAoB,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;gBAC1D,CAAC;gBAED,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;gBACzD,EAAE,CAAC,aAAa,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;gBAElC,gBAAgB;gBAChB,MAAM,SAAS,GAAG,MAAM,YAAY,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;gBAC/D,IAAI,CAAC,SAAS,EAAE,CAAC;oBACf,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;gBAC1C,CAAC;gBAED,qCAAqC;gBACrC,IAAI,QAAQ,CAAC,SAAS,EAAE,CAAC;oBACvB,MAAM,QAAQ,GAAG,kBAAkB,CACjC,QAAQ,CAAC,MAAM,EACf,QAAQ,CAAC,SAAS,CACnB,CAAC;oBACF,IAAI,CAAC,QAAQ,EAAE,CAAC;wBACd,OAAO,CAAC,IAAI,CACV,KAAK,CAAC,MAAM,CACV,oDAAoD,KAAK,CAAC,IAAI,gCAAgC,CAC/F,CACF,CAAC;oBACJ,CAAC;gBACH,CAAC;gBAED,wBAAwB;gBACxB,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAC7B,MAAM,EACN,UAAU,EACV,WAAW,EACX,KAAK,CAAC,IAAI,CACX,CAAC;gBAEF,IAAI,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;oBAC9B,EAAE,CAAC,MAAM,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC1D,CAAC;gBACD,EAAE,CAAC,SAAS,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;gBAE9C,QAAQ,CAAC,aAAa,OAAO,SAAS,UAAU,GAAG,EAAE;oBACnD,KAAK,EAAE,MAAM;iBACd,CAAC,CAAC;gBAEH,6BAA6B;gBAC7B,MAAM,eAAe,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC;gBACjE,IAAI,EAAE,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;oBACnC,MAAM,UAAU,GAAG,EAAE,CAAC,YAAY,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;oBAC7D,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,CAE5B,CAAC;oBACT,IAAI,OAAO,EAAE,IAAI,IAAI,OAAO,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,EAAE,CAAC;wBACjD,EAAE,CAAC,MAAM,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;wBACxD,MAAM,IAAI,KAAK,CACb,oCAAoC,KAAK,CAAC,IAAI,WAAW,OAAO,CAAC,IAAI,GAAG,CACzE,CAAC;oBACJ,CAAC;gBACH,CAAC;gBAED,yCAAyC;gBACzC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;gBACrC,MAAM,OAAO,GAAkB;oBAC7B,GAAG,KAAK;oBACR,OAAO,EAAE,aAAa;oBACtB,UAAU,EAAE,GAAG;iBAChB,CAAC;gBACF,aAAa,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;gBAE/B,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,KAAK,CAAC,aAAa,KAAK,CAAC,IAAI,OAAO,aAAa,EAAE,CAAC,CAC3D,CAAC;gBACF,YAAY,EAAE,CAAC;YACjB,CAAC;oBAAS,CAAC;gBACT,IAAI,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;oBAC3B,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;gBACzB,CAAC;YACH,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CACX,KAAK,CAAC,GAAG,CAAC,oBAAoB,KAAK,CAAC,IAAI,GAAG,CAAC,EAC5C,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CACzD,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,CAAC,GAAG,CACT,KAAK,YAAY,sBAAsB,YAAY,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,2BAA2B,EAAE,CAC9F,CAAC;AACJ,CAAC"}

package/dist/commands/team-sync.d.ts

@@ -0,0 +1,14 @@
+/**
+ * hq team-sync — pull latest team content with entitlement refresh (US-006)
+ *
+ * For each companies/{slug}/ directory that has a team.json:
+ * 1. Re-authenticate if token is expired (Cognito → device code flow)
+ * 2. Fetch current entitlements from API and update sparse checkout if changed
+ * 3. Configure git credentials for the pull
+ * 4. Git pull latest content
+ * 5. Report what changed (new, updated, removed files)
+ * 6. Gracefully handle conflicts (warn, don't force overwrite)
+ */
+import { Command } from 'commander';
+export declare function registerTeamSyncCommand(program: Command): void;
+//# sourceMappingURL=team-sync.d.ts.map

package/dist/commands/team-sync.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"team-sync.d.ts","sourceRoot":"","sources":["../../src/commands/team-sync.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAKH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AA4ZpC,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAyM9D"}