@indigoai-us/hq-cli 5.312.2-beta.0 → 5.314.0

package/dist/commands/staff/reset-test-account.js

@@ -1,268 +0,0 @@
-import chalk from "chalk";
-import * as readline from "node:readline";
-import { ensureCognitoToken } from "../../utils/cognito-session.js";
-import { peekIdToken } from "../../utils/id-token.js";
-import { vaultApiFetch } from "../../utils/vault-api.js";
-// ── Local staff-email preflight ─────────────────────────────────────────────
-/**
- * Same predicate the server's admin gate applies at the FIRST layer
- * (`isStaffEmail` in the vault-service admin handler). Duplicated here so a
- * non-staff caller stops before the round trip; the server remains the
- * authorization boundary (this file could not enforce it if it wanted to).
- *
- * Exact suffix match. `foo@getindigo.ai.evil.test` and `bar@xgetindigo.ai`
- * do not qualify.
- */
-export function isStaffEmail(candidate) {
-    if (typeof candidate !== "string")
-        return false;
-    const parts = candidate.trim().toLowerCase().split("@");
-    if (parts.length !== 2 || parts[0].length === 0)
-        return false;
-    const domain = parts[1];
-    return domain === "getindigo.ai" || domain === "hqforwork.com";
-}
-/** Pull the caller email out of a locally cached id_token. */
-export function callerEmailFromToken(token) {
-    const claims = peekIdToken(token);
-    const email = claims.email;
-    return typeof email === "string" && email.trim().length > 0
-        ? email.trim()
-        : undefined;
-}
-/** Real readline prompt, used when stdin is a TTY. */
-function realPrompt(question) {
-    const rl = readline.createInterface({
-        input: process.stdin,
-        output: process.stdout,
-    });
-    return new Promise((resolve) => {
-        rl.question(question, (line) => {
-            rl.close();
-            resolve(line);
-        });
-    });
-}
-/**
- * Print a compact dry-run plan. Kept flat so the operator can eyeball what the
- * executor would touch without a JSON pretty-printer in the loop.
- */
-export function renderPlan(plan) {
-    const lines = [];
-    lines.push(chalk.bold(`\nReset plan for ${plan.target.normalizedEmail}`));
-    if (plan.target.input !== plan.target.normalizedEmail) {
-        lines.push(chalk.dim(`  raw input:            ${plan.target.input}`));
-    }
-    lines.push(`  person uid:           ${plan.personUid ?? chalk.dim("(none)")}`);
-    lines.push("");
-    lines.push(chalk.bold("  Cognito users"));
-    if (plan.cognitoUsers.length === 0) {
-        lines.push(chalk.dim("    (none)"));
-    }
-    else {
-        for (const u of plan.cognitoUsers) {
-            lines.push(`    - ${u.username}  [${u.provider}]  ${u.email}`);
-        }
-    }
-    lines.push("");
-    lines.push(chalk.bold("  Owned companies"));
-    if (plan.ownedCompanies.length === 0) {
-        lines.push(chalk.dim("    (none)"));
-    }
-    else {
-        for (const c of plan.ownedCompanies) {
-            lines.push(`    - ${c.slug} (${c.uid})  members: ${c.memberCount}`);
-        }
-    }
-    lines.push("");
-    lines.push(chalk.bold("  Personal vault"));
-    lines.push(`    bucket:               ${plan.personalVault.bucketName ?? chalk.dim("(none)")}`);
-    lines.push(`    kms alias:            ${plan.personalVault.kmsKeyAlias ?? chalk.dim("(none)")}`);
-    lines.push("");
-    lines.push(chalk.bold("  Stripe"));
-    if (plan.stripe.customerIds.length === 0) {
-        lines.push(chalk.dim("    (no customer)"));
-    }
-    else {
-        for (const id of plan.stripe.customerIds) {
-            lines.push(`    - ${id}`);
-        }
-    }
-    if (plan.stripe.subscriptionState !== null && plan.stripe.subscriptionState !== undefined) {
-        lines.push(`    subscription:         ${JSON.stringify(plan.stripe.subscriptionState)}`);
-    }
-    lines.push("");
-    lines.push(chalk.bold("  Other"));
-    lines.push(`    welcome-series row:   ${plan.welcomeSeries.present ? "yes" : "no"}`);
-    const wm = plan.workMesh.eventCount === null
-        ? plan.workMesh.note
-            ? `not enumerated (${plan.workMesh.note})`
-            : "not enumerated"
-        : String(plan.workMesh.eventCount);
-    lines.push(`    work-mesh events:     ${wm}`);
-    return lines.join("\n");
-}
-/**
- * One-line-per-step summary of the executor's result. AC calls for "per-step
- * counts, ok/failed".
- */
-export function renderExecuteSummary(result) {
-    const c = result.counts;
-    const s = result.steps;
-    const line = (label, step, count) => {
-        const flag = step.skipped
-            ? chalk.dim("skipped")
-            : step.ok
-                ? chalk.green("ok")
-                : chalk.red("failed");
-        const note = step.error ? `  ${chalk.red(step.error)}` : "";
-        return `  ${label.padEnd(20)}  ${flag.padEnd(10)}  ${String(count)}${note}`;
-    };
-    const overall = result.ok ? chalk.green("ok") : chalk.yellow("partial");
-    const rawTelemetry = c.rawTelemetryDeleted ?? "n/a";
-    const workMesh = c.workMeshDeleted ?? "n/a";
-    return [
-        "",
-        chalk.bold(`Reset result: ${overall}`),
-        line("stripe", s.stripe ?? { ok: true }, c.stripeDeleted),
-        line("welcome-series", s.welcomeSeries ?? { ok: true }, c.welcomeDeleted),
-        line("raw-telemetry", s.rawTelemetry ?? { ok: true }, rawTelemetry),
-        line("work-mesh", s.workMesh ?? { ok: true }, workMesh),
-        line("memberships", s.memberships ?? { ok: true }, c.membershipsDeleted),
-        line("companies", s.companies ?? { ok: true }, c.companiesPurged),
-        line("entities", s.entity ?? { ok: true }, c.entitiesPurged),
-        line("cognito", s.cognito ?? { ok: true }, c.cognitoDeleted),
-        line("kms (personal)", s.kms ?? { ok: true }, c.kms),
-        line("invites", s.invites ?? { ok: true }, c.invitesDeleted),
-    ].join("\n");
-}
-/** Read a JSON body, tolerant of an empty body (returns `{}`). */
-async function readBody(res) {
-    try {
-        return (await res.json());
-    }
-    catch {
-        return {};
-    }
-}
-function renderApiError(status, body) {
-    const code = typeof body.code === "string" ? body.code : undefined;
-    const message = typeof body.error === "string" ? body.error : `reset failed (${status})`;
-    const detail = body.details ? `  ${JSON.stringify(body.details)}` : "";
-    return code ? `${code}: ${message}${detail}` : `${message}${detail}`;
-}
-export async function runResetTestAccount(params, deps = {}) {
-    const email = params.email.trim();
-    if (email.length === 0) {
-        throw new Error("email argument is required");
-    }
-    const token = await ensureCognitoToken();
-    // LOCAL preflight — a non-staff caller's Cognito token cannot pass the
-    // server's admin gate anyway, so we surface the refusal immediately and
-    // avoid a round trip.
-    const callerEmail = callerEmailFromToken(token);
-    if (!callerEmail || !isStaffEmail(callerEmail)) {
-        throw new Error("reset-test-account requires a super-admin (staff) HQ session. " +
-            "Sign in with an @getindigo.ai account and retry.");
-    }
-    // Dry-run first. The AC calls out "Without --execute, runs dry-run and
-    // prints the plan" — so a bare invocation always ends here.
-    const dryRunRes = await vaultApiFetch({
-        token,
-        path: "/v1/admin/test-account/reset",
-        method: "POST",
-        body: { email, dryRun: true },
-    });
-    const dryRunBody = await readBody(dryRunRes);
-    if (!dryRunRes.ok) {
-        throw new Error(renderApiError(dryRunRes.status, dryRunBody));
-    }
-    const plan = dryRunBody.plan;
-    if (!plan) {
-        throw new Error("server did not return a plan for the dry-run request");
-    }
-    console.log(renderPlan(plan));
-    if (!params.execute) {
-        console.log(chalk.dim("\n(dry-run — no writes occurred. Pass --execute after reviewing.)"));
-        return;
-    }
-    // Execute path — require the operator to type the email back.
-    console.log(chalk.yellow(`\nThis will DELETE every artifact above for ${plan.target.normalizedEmail}.`));
-    let confirmEmail;
-    if (params.yes === true) {
-        // `--yes` is an explicit operator act. The server still requires a
-        // matching `confirmEmail`, so we supply the normalized target on the
-        // operator's behalf; the guard on the wire is unchanged.
-        confirmEmail = plan.target.normalizedEmail;
-        console.log(chalk.dim(`  (--yes: sending confirmEmail=${confirmEmail})`));
-    }
-    else {
-        const prompt = deps.prompt ?? realPrompt;
-        const isTty = deps.isTty ?? Boolean(process.stdin.isTTY);
-        if (!isTty && !params.yes) {
-            throw new Error("--execute needs an interactive terminal for the typed-email " +
-                "confirmation. Re-run in a TTY, or pass --yes to skip the prompt.");
-        }
-        const answer = await prompt(`Type the target email to confirm (${plan.target.normalizedEmail}): `);
-        confirmEmail = (answer ?? "").trim();
-        if (confirmEmail.length === 0) {
-            throw new Error("Aborted — no confirmation entered.");
-        }
-        // Local pre-check so the operator gets the friendlier message than the
-        // server's CONFIRM_EMAIL_MISMATCH. Server still enforces via
-        // confirmEmailMatches, so a stale local check cannot bypass the wire gate.
-        if (confirmEmail.toLowerCase() !== plan.target.normalizedEmail.toLowerCase()) {
-            throw new Error(`Aborted — the typed email (${confirmEmail}) does not match the ` +
-                `target (${plan.target.normalizedEmail}).`);
-        }
-    }
-    const executeRes = await vaultApiFetch({
-        token,
-        path: "/v1/admin/test-account/reset",
-        method: "POST",
-        body: { email, dryRun: false, confirmEmail },
-    });
-    const executeBody = await readBody(executeRes);
-    // The handler answers 200 (all-ok) and 207 (best-effort partial). Anything
-    // else is a refusal from a safety gate and should surface as an error.
-    if (executeRes.status !== 200 && executeRes.status !== 207) {
-        throw new Error(renderApiError(executeRes.status, executeBody));
-    }
-    const result = executeBody.result;
-    if (!result) {
-        throw new Error("server did not return an execute result");
-    }
-    console.log(renderExecuteSummary(result));
-    if (!result.ok) {
-        // Non-zero exit so a scripted caller can react. The summary line above
-        // already shows which step failed.
-        process.exitCode = 1;
-    }
-}
-// ── Commander wiring ────────────────────────────────────────────────────────
-function fail(err) {
-    console.error(chalk.red(err instanceof Error ? err.message : String(err)));
-    process.exit(1);
-}
-export function registerResetTestAccountCommand(staff, deps = {}) {
-    return staff
-        .command("reset-test-account")
-        .description("Reset a designated real-email test account (dry-run by default). " +
-        "Wraps POST /v1/admin/test-account/reset — super-admin only.")
-        .argument("<email>", "Designated test-account email (must be in the registry)")
-        .option("--execute", "Actually delete artifacts. Prompts for a typed-email confirmation.")
-        .option("-y, --yes", "Skip the typed-email confirmation prompt (still sends confirmEmail).")
-        .action(async (email, opts) => {
-        try {
-            await runResetTestAccount({
-                email,
-                execute: opts.execute === true,
-                yes: opts.yes === true,
-            }, deps);
-        }
-        catch (err) {
-            fail(err);
-        }
-    });
-}
-//# sourceMappingURL=reset-test-account.js.map

package/dist/commands/staff/test-account.d.ts

@@ -1,51 +0,0 @@
-import { Command } from "commander";
-/**
- * `hq staff test-account {add|remove|list}` — onboarding-test-accounts US-007
- * follow-up. Thin CLI wrappers over the vault-service registry routes:
- *
- *   POST   /v1/admin/test-account-registry            (add)
- *   DELETE /v1/admin/test-account-registry/{emailB64} (remove)
- *   GET    /v1/admin/test-account-registry            (list)
- *
- * The runbook now points staff at these commands instead of the previous
- * hand-rolled `curl` + `~/.hq/cognito-tokens.json` pattern. Reusing
- * `ensureCognitoToken` + `vaultApiFetch` means the id_token is never printed,
- * never handed to the operator, and never lifted out of the CLI's secure state
- * directory. The server owns every write; this file's local staff-email
- * preflight only saves an already-refused round trip.
- */
-interface RegistryEntry {
-    email: string;
-    addedBy: string;
-    addedAt: string;
-    note: string | null;
-    active: boolean;
-    removedBy?: string;
-    removedAt?: string;
-}
-/**
- * Encode an email as the base64url path segment the DELETE route expects. The
- * server decodes and normalizes (`decodeRegistryEmailKey` → `normalizeRegistryEmail`),
- * so the operator can type `Bohemian.HW@gmail.com` and hit the same row as
- * `bohemianhw@gmail.com`. Local encoding is a pure transform on the raw input;
- * we never persist or print a locally normalized value.
- */
-export declare function encodeEmailForPath(email: string): string;
-export declare function renderEntry(entry: RegistryEntry): string;
-export declare function renderList(entries: RegistryEntry[]): string;
-export interface RunAddParams {
-    email: string;
-    note?: string;
-}
-export declare function runAddTestAccount(params: RunAddParams): Promise<void>;
-export interface RunRemoveParams {
-    email: string;
-}
-export declare function runRemoveTestAccount(params: RunRemoveParams): Promise<void>;
-export interface RunListParams {
-    includeInactive?: boolean;
-}
-export declare function runListTestAccounts(params?: RunListParams): Promise<void>;
-export declare function registerTestAccountCommand(staff: Command): Command;
-export {};
-//# sourceMappingURL=test-account.d.ts.map

package/dist/commands/staff/test-account.js

@@ -1,196 +0,0 @@
-import chalk from "chalk";
-import { ensureCognitoToken } from "../../utils/cognito-session.js";
-import { vaultApiFetch } from "../../utils/vault-api.js";
-import { callerEmailFromToken, isStaffEmail } from "./reset-test-account.js";
-// ── URL-safe base64 encode for the DELETE path parameter ────────────────────
-/**
- * Encode an email as the base64url path segment the DELETE route expects. The
- * server decodes and normalizes (`decodeRegistryEmailKey` → `normalizeRegistryEmail`),
- * so the operator can type `Bohemian.HW@gmail.com` and hit the same row as
- * `bohemianhw@gmail.com`. Local encoding is a pure transform on the raw input;
- * we never persist or print a locally normalized value.
- */
-export function encodeEmailForPath(email) {
-    return Buffer.from(email.trim(), "utf8")
-        .toString("base64")
-        .replace(/\+/g, "-")
-        .replace(/\//g, "_")
-        .replace(/=+$/, "");
-}
-// ── Rendering ───────────────────────────────────────────────────────────────
-function renderEntryLine(entry) {
-    const flag = entry.active ? chalk.green("active") : chalk.dim("inactive");
-    const note = entry.note ? `  ${chalk.dim(entry.note)}` : "";
-    return `  ${entry.email.padEnd(40)}  ${flag}  added ${entry.addedAt} by ${entry.addedBy}${note}`;
-}
-export function renderEntry(entry) {
-    const lines = [];
-    lines.push(chalk.bold(`\nRegistry entry for ${entry.email}`));
-    lines.push(`  active:      ${entry.active ? chalk.green("yes") : chalk.dim("no")}`);
-    lines.push(`  added by:    ${entry.addedBy}`);
-    lines.push(`  added at:    ${entry.addedAt}`);
-    lines.push(`  note:        ${entry.note ?? chalk.dim("(none)")}`);
-    if (entry.removedBy !== undefined) {
-        lines.push(`  removed by:  ${entry.removedBy}`);
-    }
-    if (entry.removedAt !== undefined) {
-        lines.push(`  removed at:  ${entry.removedAt}`);
-    }
-    return lines.join("\n");
-}
-export function renderList(entries) {
-    if (entries.length === 0) {
-        return chalk.dim("\n(no registry entries)");
-    }
-    const lines = [];
-    lines.push(chalk.bold(`\nTest-account registry (${entries.length})`));
-    for (const entry of entries) {
-        lines.push(renderEntryLine(entry));
-    }
-    return lines.join("\n");
-}
-// ── Shared HTTP helpers ─────────────────────────────────────────────────────
-async function readBody(res) {
-    try {
-        return (await res.json());
-    }
-    catch {
-        return {};
-    }
-}
-function renderApiError(status, body) {
-    const code = typeof body.code === "string" ? body.code : undefined;
-    const message = typeof body.error === "string" ? body.error : `request failed (${status})`;
-    return code ? `${code}: ${message}` : message;
-}
-/**
- * Same local preflight the reset command runs. Duplicated in shape (not code)
- * so both commands surface the same message without a circular import; the
- * server remains the authorization boundary.
- */
-async function requireStaffToken() {
-    const token = await ensureCognitoToken();
-    const callerEmail = callerEmailFromToken(token);
-    if (!callerEmail || !isStaffEmail(callerEmail)) {
-        throw new Error("hq staff test-account requires a super-admin (staff) HQ session. " +
-            "Sign in with an @getindigo.ai account and retry.");
-    }
-    return token;
-}
-export async function runAddTestAccount(params) {
-    const email = params.email.trim();
-    if (email.length === 0) {
-        throw new Error("email argument is required");
-    }
-    const token = await requireStaffToken();
-    const body = { email };
-    if (params.note !== undefined)
-        body.note = params.note;
-    const res = await vaultApiFetch({
-        token,
-        path: "/v1/admin/test-account-registry",
-        method: "POST",
-        body,
-    });
-    const parsed = await readBody(res);
-    if (!res.ok) {
-        throw new Error(renderApiError(res.status, parsed));
-    }
-    const entry = parsed.entry;
-    if (!entry) {
-        throw new Error("server did not return the registry entry");
-    }
-    console.log(renderEntry(entry));
-    console.log(chalk.dim("\n(entry added — reset command will now accept this email.)"));
-}
-export async function runRemoveTestAccount(params) {
-    const email = params.email.trim();
-    if (email.length === 0) {
-        throw new Error("email argument is required");
-    }
-    const token = await requireStaffToken();
-    const emailB64 = encodeEmailForPath(email);
-    const res = await vaultApiFetch({
-        token,
-        path: `/v1/admin/test-account-registry/${emailB64}`,
-        method: "DELETE",
-    });
-    const parsed = await readBody(res);
-    if (!res.ok) {
-        throw new Error(renderApiError(res.status, parsed));
-    }
-    const entry = parsed.entry;
-    if (!entry) {
-        throw new Error("server did not return the registry entry");
-    }
-    console.log(renderEntry(entry));
-    console.log(chalk.dim("\n(entry soft-deleted — row stays with active: false.)"));
-}
-export async function runListTestAccounts(params = {}) {
-    const token = await requireStaffToken();
-    const res = await vaultApiFetch({
-        token,
-        path: "/v1/admin/test-account-registry",
-        method: "GET",
-        query: params.includeInactive ? { includeInactive: "true" } : undefined,
-    });
-    const parsed = await readBody(res);
-    if (!res.ok) {
-        throw new Error(renderApiError(res.status, parsed));
-    }
-    const entries = parsed.entries;
-    if (!Array.isArray(entries)) {
-        throw new Error("server did not return a list of entries");
-    }
-    console.log(renderList(entries));
-}
-// ── Commander wiring ────────────────────────────────────────────────────────
-function fail(err) {
-    console.error(chalk.red(err instanceof Error ? err.message : String(err)));
-    process.exit(1);
-}
-export function registerTestAccountCommand(staff) {
-    const group = staff
-        .command("test-account")
-        .description("Manage the designated test-account registry (super-admin only). " +
-        "Wraps /v1/admin/test-account-registry.");
-    group
-        .command("add")
-        .description("Add an email to the registry so `hq staff reset-test-account` will sweep it.")
-        .argument("<email>", "Designated test-account email")
-        .option("--note <text>", "Short reason recorded on the row")
-        .action(async (email, opts) => {
-        try {
-            await runAddTestAccount({ email, note: opts.note });
-        }
-        catch (err) {
-            fail(err);
-        }
-    });
-    group
-        .command("remove")
-        .description("Soft-delete a registry entry (row stays with active: false).")
-        .argument("<email>", "Registered test-account email")
-        .action(async (email) => {
-        try {
-            await runRemoveTestAccount({ email });
-        }
-        catch (err) {
-            fail(err);
-        }
-    });
-    group
-        .command("list")
-        .description("List active registry entries.")
-        .option("--include-inactive", "Also list soft-deleted rows (active: false).")
-        .action(async (opts) => {
-        try {
-            await runListTestAccounts({ includeInactive: opts.includeInactive === true });
-        }
-        catch (err) {
-            fail(err);
-        }
-    });
-    return group;
-}
-//# sourceMappingURL=test-account.js.map

package/dist/commands/vault-retention-flag.d.ts

@@ -1,3 +0,0 @@
-export declare const VAULT_RETENTION_SETTINGS_FLAG = "cli.vault-retention-settings";
-export declare function vaultRetentionSettingsEnabled(companyUid?: string, idToken?: string): boolean | Promise<boolean>;
-//# sourceMappingURL=vault-retention-flag.d.ts.map

package/dist/commands/vault-retention-flag.js

@@ -1,9 +0,0 @@
-import { resolveCompanyFlagGate, resolveProcessFlagGate } from "../lib/flag-registry.js";
-export const VAULT_RETENTION_SETTINGS_FLAG = "cli.vault-retention-settings";
-export function vaultRetentionSettingsEnabled(companyUid, idToken) {
-    if (companyUid && idToken) {
-        return resolveCompanyFlagGate(companyUid, idToken, VAULT_RETENTION_SETTINGS_FLAG, { fallback: false }, () => false);
-    }
-    return resolveProcessFlagGate(VAULT_RETENTION_SETTINGS_FLAG, { fallback: false }, () => false);
-}
-//# sourceMappingURL=vault-retention-flag.js.map

package/dist/commands/vault-retention.d.ts

@@ -1,11 +0,0 @@
-import { Command } from "commander";
-import { vaultApiFetch } from "../utils/vault-api.js";
-type Dependencies = {
-    enabled: (companyUid?: string, token?: string) => boolean | Promise<boolean>;
-    token: () => Promise<string>;
-    companyUid: (token: string, slug: string | undefined) => Promise<string>;
-    request: typeof vaultApiFetch;
-};
-export declare function registerVaultRetentionCommand(program: Command, deps?: Dependencies): void;
-export {};
-//# sourceMappingURL=vault-retention.d.ts.map

package/dist/commands/vault-retention.js

@@ -1,69 +0,0 @@
-import { ensureCognitoToken } from "../utils/cognito-session.js";
-import { markExpectedUserError } from "../utils/expected-cli-error.js";
-import { getCompanyUid, vaultApiFetch } from "../utils/vault-api.js";
-import { vaultRetentionSettingsEnabled } from "./vault-retention-flag.js";
-const defaultDependencies = {
-    enabled: vaultRetentionSettingsEnabled,
-    token: ensureCognitoToken,
-    companyUid: getCompanyUid,
-    request: vaultApiFetch,
-};
-export function registerVaultRetentionCommand(program, deps = defaultDependencies) {
-    const vault = program.command("vault").description("Manage HQ vault settings");
-    const retention = vault
-        .command("retention")
-        .description("Get or set the default retention for future vault object versions")
-        .option("--company <slug>", "Company vault slug (omit for your personal vault)");
-    const companyOf = (command) => command.opts().company ??
-        retention.opts().company;
-    retention
-        .command("get")
-        .description("Show the vault's default retention in days")
-        .action(async function () {
-        await execute(this, "GET");
-    });
-    retention
-        .command("set")
-        .description("Set the vault's default retention in days (1-30)")
-        .argument("<days>")
-        .action(async function (rawDays) {
-        const days = Number(rawDays);
-        if (!Number.isInteger(days) || days < 1 || days > 30) {
-            throw new Error("days must be an integer from 1 through 30");
-        }
-        await execute(this, "PUT", days);
-    });
-    async function execute(command, method, days) {
-        const slug = companyOf(command);
-        let token;
-        let companyUid;
-        if (slug) {
-            token = await deps.token();
-            companyUid = await deps.companyUid(token, slug);
-            if (!(await deps.enabled(companyUid, token))) {
-                throw markExpectedUserError(new Error("Vault retention settings are not enabled for this company."));
-            }
-        }
-        else {
-            if (!(await deps.enabled())) {
-                throw markExpectedUserError(new Error("Vault retention settings are not enabled for this company."));
-            }
-            token = await deps.token();
-        }
-        const query = companyUid ? { companyUid } : undefined;
-        const response = await deps.request({
-            token,
-            path: "/vault/retention",
-            method,
-            ...(query ? { query } : {}),
-            ...(days === undefined ? {} : { body: { days } }),
-        });
-        if (!response.ok) {
-            const body = (await response.json().catch(() => ({})));
-            throw new Error(body.error ?? body.message ?? response.statusText);
-        }
-        const body = (await response.json());
-        process.stdout.write(`${body.days} days\n`);
-    }
-}
-//# sourceMappingURL=vault-retention.js.map

package/dist/commands/version.d.ts

@@ -1,10 +0,0 @@
-/**
- * hq version — labelled HQ vs CLI vs latest hq-core.
- *
- * Bare `hq --version` is intercepted on the fast path in index.ts and prints
- * only the CLI semver. This registrar exists so `hq --help` lists the command
- * and so `hq version` / `hq version --json` still work if the fast path is skipped.
- */
-import { Command } from "commander";
-export declare function registerVersionCommand(program: Command): void;
-//# sourceMappingURL=version.d.ts.map

package/dist/commands/version.js

@@ -1,11 +0,0 @@
-import { runVersionCommand } from "../utils/version-report.js";
-export function registerVersionCommand(program) {
-    program
-        .command("version")
-        .description("Show HQ, CLI, and latest hq-core versions")
-        .option("--json", "Output the same payload as JSON")
-        .action(async () => {
-        await runVersionCommand(process.argv);
-    });
-}
-//# sourceMappingURL=version.js.map