@indigoai-us/hq-cli 5.313.0 → 5.314.0

package/dist/commands/cloud-retire.d.ts

@@ -1,51 +0,0 @@
-/**
- * `hq cloud retire company <slug>` — soft-tombstone a cloud company so
- * `hq cloud demote company` can run without `--propagate-deletes`.
- *
- * Console equivalent: Settings → Delete company (`DELETE /entity/{uid}`).
- * Owner-only. The entity row, S3 bucket, KMS key, and memberships stay;
- * `/membership/me` stops listing the company. Local files are not touched —
- * demote is the follow-up that flips the local tree back to local-only.
- *
- * Confirm step is on by default (`[y/N]`). `--yes` skips it for scripts.
- * A non-TTY stdin without `--yes` refuses rather than hanging.
- *
- * Exit codes (mirrors cloud-provision / cloud-demote):
- *   0 — success, already tombstoned, or the operator cancelled.
- *   1 — vault HTTP failure (auth/network/5xx).
- *   2 — validation (bad slug, no entity, not owner, missing confirm).
- */
-import { Command } from "commander";
-import { type VaultClient } from "./cloud-provision.js";
-/** Final stdout JSON shape. */
-export interface RetireResult {
-    ok: boolean;
-    company_slug: string;
-    cloud_uid: string | null;
-    /** True when hq-pro already had deleted=true (no DELETE sent). */
-    already_deleted: boolean;
-    cancelled?: boolean;
-}
-export interface RetireCompanyOptions {
-    slug: string;
-    hqRoot: string;
-    vaultApiUrl: string;
-    /** Skip the interactive confirmation prompt. */
-    yes?: boolean;
-    vaultClient?: VaultClient;
-    resolveAccessToken?: () => Promise<string>;
-    confirm?: (question: string) => Promise<boolean>;
-    stdinIsTTY?: boolean;
-}
-export declare function defaultConfirm(question: string): Promise<boolean>;
-/**
- * Read `companyUid` from `companies/<slug>/.hq/config.json` when the by-slug
- * lookup misses (a tombstoned company is filtered from that route).
- */
-export declare function readLocalCompanyUid(hqRoot: string, slug: string): string | null;
-export declare function retireCompany(options: RetireCompanyOptions): Promise<RetireResult>;
-/**
- * Register `retire company <slug>` under the `cloud` command group.
- */
-export declare function registerCloudRetireCommands(program: Command): void;
-//# sourceMappingURL=cloud-retire.d.ts.map

package/dist/commands/cloud-retire.js

@@ -1,154 +0,0 @@
-/**
- * `hq cloud retire company <slug>` — soft-tombstone a cloud company so
- * `hq cloud demote company` can run without `--propagate-deletes`.
- *
- * Console equivalent: Settings → Delete company (`DELETE /entity/{uid}`).
- * Owner-only. The entity row, S3 bucket, KMS key, and memberships stay;
- * `/membership/me` stops listing the company. Local files are not touched —
- * demote is the follow-up that flips the local tree back to local-only.
- *
- * Confirm step is on by default (`[y/N]`). `--yes` skips it for scripts.
- * A non-TTY stdin without `--yes` refuses rather than hanging.
- *
- * Exit codes (mirrors cloud-provision / cloud-demote):
- *   0 — success, already tombstoned, or the operator cancelled.
- *   1 — vault HTTP failure (auth/network/5xx).
- *   2 — validation (bad slug, no entity, not owner, missing confirm).
- */
-import * as fs from "node:fs";
-import * as readline from "node:readline";
-import chalk from "chalk";
-import { ProvisionError, companyConfigPath, createDefaultVaultClient, validateSlug, } from "./cloud-provision.js";
-import { DEFAULT_HQ_ROOT, DEFAULT_VAULT_API_URL, ensureCognitoToken, } from "../utils/cognito-session.js";
-export function defaultConfirm(question) {
-    const rl = readline.createInterface({
-        input: process.stdin,
-        output: process.stdout,
-    });
-    return new Promise((resolve) => {
-        rl.question(`${question} [y/N] `, (answer) => {
-            rl.close();
-            resolve(/^y(es)?$/i.test(answer.trim()));
-        });
-    });
-}
-/**
- * Read `companyUid` from `companies/<slug>/.hq/config.json` when the by-slug
- * lookup misses (a tombstoned company is filtered from that route).
- */
-export function readLocalCompanyUid(hqRoot, slug) {
-    const cPath = companyConfigPath(hqRoot, slug);
-    if (!fs.existsSync(cPath))
-        return null;
-    try {
-        const parsed = JSON.parse(fs.readFileSync(cPath, "utf-8"));
-        return typeof parsed.companyUid === "string" && parsed.companyUid.length > 0
-            ? parsed.companyUid
-            : null;
-    }
-    catch {
-        return null;
-    }
-}
-export async function retireCompany(options) {
-    validateSlug(options.slug);
-    const accessToken = options.resolveAccessToken
-        ? await options.resolveAccessToken()
-        : await ensureCognitoToken();
-    const client = options.vaultClient ??
-        createDefaultVaultClient(options.vaultApiUrl, accessToken);
-    let entity;
-    try {
-        entity = await client.findCompanyBySlug(options.slug);
-    }
-    catch (err) {
-        if (err instanceof ProvisionError)
-            throw err;
-        throw new ProvisionError(1, `Vault GET by-slug failed: ${err instanceof Error ? err.message : String(err)}`);
-    }
-    if (entity?.deleted === true) {
-        return {
-            ok: true,
-            company_slug: options.slug,
-            cloud_uid: entity.uid,
-            already_deleted: true,
-        };
-    }
-    const uid = entity?.uid ?? readLocalCompanyUid(options.hqRoot, options.slug);
-    if (!uid) {
-        throw new ProvisionError(2, `Refusing to retire '${options.slug}': no cloud entity found.`);
-    }
-    if (options.yes !== true) {
-        const tty = options.stdinIsTTY ?? process.stdin.isTTY === true;
-        if (!tty) {
-            throw new ProvisionError(2, `Refusing to retire '${options.slug}' without confirmation. Re-run with --yes.`);
-        }
-        const confirm = options.confirm ?? defaultConfirm;
-        const ok = await confirm(`Soft-tombstone cloud company '${options.slug}' (${uid})? ` +
-            `It will disappear from every member's picker. Vault files stay. ` +
-            `Then run: hq cloud demote company ${options.slug}`);
-        if (!ok) {
-            return {
-                ok: false,
-                company_slug: options.slug,
-                cloud_uid: uid,
-                already_deleted: false,
-                cancelled: true,
-            };
-        }
-    }
-    try {
-        await client.softDeleteCompany(uid);
-    }
-    catch (err) {
-        if (err instanceof ProvisionError)
-            throw err;
-        throw new ProvisionError(1, `Vault DELETE /entity/${uid} failed: ${err instanceof Error ? err.message : String(err)}`);
-    }
-    return {
-        ok: true,
-        company_slug: options.slug,
-        cloud_uid: uid,
-        already_deleted: false,
-    };
-}
-/**
- * Register `retire company <slug>` under the `cloud` command group.
- */
-export function registerCloudRetireCommands(program) {
-    const retireCmd = program
-        .command("retire")
-        .description("Soft-tombstone a cloud-backed company (owner only)");
-    retireCmd
-        .command("company")
-        .description("Soft-tombstone a cloud company so `hq cloud demote company` can run. " +
-        "Does not delete vault files or local folders. Prompts unless --yes.")
-        .argument("<slug>", "Company slug")
-        .option("--hq-root <path>", `Local HQ tree root (default: ${DEFAULT_HQ_ROOT})`, DEFAULT_HQ_ROOT)
-        .option("--vault-api-url <url>", `Vault API URL (default: ${DEFAULT_VAULT_API_URL})`, DEFAULT_VAULT_API_URL)
-        .option("-y, --yes", "Skip the confirmation prompt (for scripts)")
-        .action(async (slug, options) => {
-        try {
-            const result = await retireCompany({
-                slug,
-                hqRoot: options.hqRoot,
-                vaultApiUrl: options.vaultApiUrl,
-                yes: options.yes,
-            });
-            process.stdout.write(JSON.stringify(result) + "\n");
-            if (result.cancelled) {
-                process.stderr.write(chalk.dim("[hq cloud retire] Cancelled — nothing was tombstoned.\n"));
-            }
-            process.exit(0);
-        }
-        catch (err) {
-            if (err instanceof ProvisionError) {
-                process.stderr.write(chalk.red(`[hq cloud retire] ${err.message}\n`));
-                process.exit(err.code);
-            }
-            process.stderr.write(chalk.red(`[hq cloud retire] Unexpected error: ${err instanceof Error ? err.message : String(err)}\n`));
-            process.exit(1);
-        }
-    });
-}
-//# sourceMappingURL=cloud-retire.js.map

package/dist/commands/company-rename-flag.d.ts

@@ -1,4 +0,0 @@
-export declare const CLI_COMPANY_RENAME_FLAG = "cli.company-rename";
-/** Company display-name updates stay unavailable until hq-flags enables them. */
-export declare function companyRenameEnabled(): boolean;
-//# sourceMappingURL=company-rename-flag.d.ts.map

package/dist/commands/company-rename-flag.js

@@ -1,7 +0,0 @@
-import { resolveProcessFlagGate } from "../lib/flag-registry.js";
-export const CLI_COMPANY_RENAME_FLAG = "cli.company-rename";
-/** Company display-name updates stay unavailable until hq-flags enables them. */
-export function companyRenameEnabled() {
-    return resolveProcessFlagGate(CLI_COMPANY_RENAME_FLAG, { fallback: false }, () => false);
-}
-//# sourceMappingURL=company-rename-flag.js.map

package/dist/commands/company-rename.d.ts

@@ -1,4 +0,0 @@
-import { Command } from "commander";
-/** Register `hq company rename <new name>` for the selected/current company. */
-export declare function registerCompanyRenameCommand(company: Command): void;
-//# sourceMappingURL=company-rename.d.ts.map

package/dist/commands/company-rename.js

@@ -1,90 +0,0 @@
-import * as fs from "node:fs";
-import * as path from "node:path";
-import * as yaml from "js-yaml";
-import chalk from "chalk";
-import { resolveDefaultHqRoot } from "../utils/hq-root-resolver.js";
-import { parseUserYaml } from "../utils/user-yaml-error.js";
-import { ensureCognitoToken } from "../utils/cognito-session.js";
-import { getEntityUid, vaultApiFetch } from "../utils/vault-api.js";
-import { companyRenameEnabled } from "./company-rename-flag.js";
-function fail(message) {
-    console.error(chalk.red(message));
-    process.exit(1);
-    throw new Error(message);
-}
-function resolveManifestTarget(hqRoot, requestedSlug, companyUid) {
-    const manifestPath = path.join(hqRoot, "companies", "manifest.yaml");
-    if (!fs.existsSync(manifestPath)) {
-        throw new Error(`companies/manifest.yaml not found at ${manifestPath}`);
-    }
-    const raw = fs.readFileSync(manifestPath, "utf8");
-    const parsed = parseUserYaml(raw, manifestPath);
-    if (!parsed || !parsed.companies || typeof parsed.companies !== "object") {
-        throw new Error("companies/manifest.yaml is malformed — missing top-level .companies map");
-    }
-    const slug = requestedSlug ?? Object.entries(parsed.companies).find(([, entry]) => entry && typeof entry === "object" && entry.cloud_uid === companyUid)?.[0];
-    if (!slug) {
-        throw new Error(`No local company manifest entry is bound to ${companyUid}; run from the HQ root or pass --company <slug>.`);
-    }
-    const value = parsed.companies[slug];
-    if (!value || typeof value !== "object") {
-        throw new Error(`Company '${slug}' is not present in companies/manifest.yaml.`);
-    }
-    if (requestedSlug && value.cloud_uid !== companyUid) {
-        throw new Error(`Company '${slug}' has no matching cloud_uid in companies/manifest.yaml.`);
-    }
-    return { slug, path: manifestPath, document: parsed, entry: value };
-}
-function writeManifestName(target, name) {
-    target.entry.name = name;
-    target.document.companies[target.slug] = target.entry;
-    const mode = fs.statSync(target.path).mode;
-    const temporaryPath = `${target.path}.tmp.${process.pid}`;
-    fs.writeFileSync(temporaryPath, yaml.dump(target.document, { lineWidth: -1, noRefs: true }), { mode });
-    fs.chmodSync(temporaryPath, mode);
-    fs.renameSync(temporaryPath, target.path);
-}
-/** Register `hq company rename <new name>` for the selected/current company. */
-export function registerCompanyRenameCommand(company) {
-    company
-        .command("rename <new-name>")
-        .description("Rename a cloud-backed company display name")
-        .action(async (newName) => {
-        if (!companyRenameEnabled()) {
-            fail("Company rename is not available yet.");
-        }
-        const name = newName.trim();
-        if (!name)
-            fail("Company name cannot be empty.");
-        try {
-            const requestedSlug = company.opts().company;
-            const token = await ensureCognitoToken();
-            const companyUid = await getEntityUid(token, { companySlug: requestedSlug });
-            const hqRoot = resolveDefaultHqRoot({ onMissing: "throw" });
-            const manifestTarget = resolveManifestTarget(hqRoot, requestedSlug, companyUid);
-            const response = await vaultApiFetch({
-                token,
-                path: `/entity/${encodeURIComponent(companyUid)}`,
-                method: "PATCH",
-                body: { name },
-            });
-            if (!response.ok) {
-                if (response.status === 403) {
-                    fail("Only a company owner can rename this company.");
-                }
-                if (response.status === 404) {
-                    fail("Company not found in HQ Cloud.");
-                }
-                fail(`Could not rename company (HTTP ${response.status}).`);
-            }
-            writeManifestName(manifestTarget, name);
-            console.log(chalk.green(`Company renamed to ${name}.`));
-        }
-        catch (error) {
-            if (error instanceof Error && error.message.startsWith("process.exit"))
-                throw error;
-            fail(error instanceof Error ? error.message : String(error));
-        }
-    });
-}
-//# sourceMappingURL=company-rename.js.map

package/dist/commands/core-audit-log-native.d.ts

@@ -1,9 +0,0 @@
-import { type UtilityContext, type UtilityOutput } from "./core-native-utilities.js";
-import type { Command } from "commander";
-export declare const AUDIT_LOG_ASSET = "core/scripts/audit-log.sh";
-export declare const AUDIT_LOG_HELP = "audit-log.sh \u2014 HQ audit log utility\n\nSUBCOMMANDS:\n  append    Write one JSONL record to the audit log\n  query     Filter and display records\n  summary   Show aggregated table (project | worker | status)\n\nAPPEND FLAGS (--event and --project are required):\n  --timestamp    ISO8601 (auto-filled if omitted)\n  --event        task_started | phase_completed | task_completed | task_failed |\n                 project_started | project_completed |\n                 story_dispatched | story_completed | story_failed |\n                 pipeline_started | pipeline_completed | pipeline_paused |\n                 pipeline_failed | project_pr_created | project_reviewed |\n                 project_merged | project_deployed | project_canary_pass |\n                 project_canary_fail | gate_requested | gate_resolved\n  --company      Company slug (e.g. {company})\n  --project      Project slug (e.g. hq-observability)\n  --story-id     Story ID (e.g. US-001)\n  --worker       Worker name (e.g. backend-dev)\n  --model        Model name (e.g. sonnet)\n  --action       Short description of what happened\n  --files        Comma-separated file paths touched\n  --result       success | fail | skipped\n  --duration-ms  Wall-clock time in milliseconds (integer)\n  --error        Error message if result=fail\n  --session-id   Claude session/thread ID\n\nQUERY FLAGS:\n  --project      Filter by project slug\n  --company      Filter by company slug\n  --worker       Filter by worker name\n  --since        Filter by timestamp >= YYYY-MM-DD (or full ISO8601)\n  --event        Filter by event type\n\nEXAMPLES:\n  # Append a task_started event\n  core/scripts/audit-log.sh append \\\n    --event task_started \\\n    --project hq-observability \\\n    --company {company} \\\n    --story-id US-001 \\\n    --worker backend-dev \\\n    --model sonnet\n\n  # Query all failures for a project\n  core/scripts/audit-log.sh query --project hq-observability --event task_failed\n\n  # Query since a date\n  core/scripts/audit-log.sh query --since 2026-03-01\n\n  # Show summary table\n  core/scripts/audit-log.sh summary\n\nLOG FILE:\n  workspace/metrics/audit-log.jsonl\n";
-type AuditDeps = Pick<UtilityContext, "root" | "now">;
-export declare function runAuditLog(args: string[], deps: AuditDeps): UtilityOutput;
-export declare function registerCoreAuditLogNative(core: Command): void;
-export {};
-//# sourceMappingURL=core-audit-log-native.d.ts.map

package/dist/commands/core-audit-log-native.js

@@ -1,257 +0,0 @@
-/** In-process implementation of core/scripts/audit-log.sh. */
-import * as fs from "node:fs";
-import * as path from "node:path";
-import { serializeJqJson } from "../lib/core-utils/jq-json-serializer.js";
-import { resolveLiveRoot } from "../utils/hq-roots.js";
-import { bundledShellUnboundValue, registerNativeUtility, utilityError } from "./core-native-utilities.js";
-export const AUDIT_LOG_ASSET = "core/scripts/audit-log.sh";
-export const AUDIT_LOG_HELP = `audit-log.sh — HQ audit log utility
-
-SUBCOMMANDS:
-  append    Write one JSONL record to the audit log
-  query     Filter and display records
-  summary   Show aggregated table (project | worker | status)
-
-APPEND FLAGS (--event and --project are required):
-  --timestamp    ISO8601 (auto-filled if omitted)
-  --event        task_started | phase_completed | task_completed | task_failed |
-                 project_started | project_completed |
-                 story_dispatched | story_completed | story_failed |
-                 pipeline_started | pipeline_completed | pipeline_paused |
-                 pipeline_failed | project_pr_created | project_reviewed |
-                 project_merged | project_deployed | project_canary_pass |
-                 project_canary_fail | gate_requested | gate_resolved
-  --company      Company slug (e.g. {company})
-  --project      Project slug (e.g. hq-observability)
-  --story-id     Story ID (e.g. US-001)
-  --worker       Worker name (e.g. backend-dev)
-  --model        Model name (e.g. sonnet)
-  --action       Short description of what happened
-  --files        Comma-separated file paths touched
-  --result       success | fail | skipped
-  --duration-ms  Wall-clock time in milliseconds (integer)
-  --error        Error message if result=fail
-  --session-id   Claude session/thread ID
-
-QUERY FLAGS:
-  --project      Filter by project slug
-  --company      Filter by company slug
-  --worker       Filter by worker name
-  --since        Filter by timestamp >= YYYY-MM-DD (or full ISO8601)
-  --event        Filter by event type
-
-EXAMPLES:
-  # Append a task_started event
-  core/scripts/audit-log.sh append \\
-    --event task_started \\
-    --project hq-observability \\
-    --company {company} \\
-    --story-id US-001 \\
-    --worker backend-dev \\
-    --model sonnet
-
-  # Query all failures for a project
-  core/scripts/audit-log.sh query --project hq-observability --event task_failed
-
-  # Query since a date
-  core/scripts/audit-log.sh query --since 2026-03-01
-
-  # Show summary table
-  core/scripts/audit-log.sh summary
-
-LOG FILE:
-  workspace/metrics/audit-log.jsonl
-`;
-const EVENTS = "task_started phase_completed task_completed task_failed project_started project_completed story_dispatched story_completed story_failed pipeline_started pipeline_completed pipeline_paused pipeline_failed project_pr_created project_reviewed project_merged project_deployed project_canary_pass project_canary_fail gate_requested gate_resolved";
-const RESULTS = "success fail skipped";
-const APPEND_FLAGS = {
-    "--timestamp": "timestamp", "--event": "event", "--company": "company", "--project": "project",
-    "--story-id": "story_id", "--worker": "worker", "--model": "model", "--action": "action",
-    "--files": "files_touched", "--result": "result", "--duration-ms": "duration_ms", "--error": "error", "--session-id": "session_id",
-};
-const QUERY_FLAGS = {
-    "--project": "project", "--company": "company", "--worker": "worker", "--since": "timestamp", "--event": "event",
-};
-const APPEND_SHELL_LINES = {
-    "--timestamp": 76, "--event": 77, "--company": 78, "--project": 79, "--story-id": 80,
-    "--worker": 81, "--model": 82, "--action": 83, "--files": 84, "--result": 85,
-    "--duration-ms": 86, "--error": 87, "--session-id": 88,
-};
-const QUERY_SHELL_LINES = {
-    "--project": 171, "--company": 172, "--worker": 173, "--since": 174, "--event": 175,
-};
-const OMIT_EMPTY_FIELDS = ["company", "story_id", "worker", "model", "action", "result", "duration_ms", "error", "session_id"];
-function parseFlags(args, allowed) {
-    const values = {};
-    for (let i = 0; i < args.length; i += 1) {
-        const key = args[i];
-        if (!Object.hasOwn(allowed, key))
-            return { error: `ERROR: Unknown flag: ${key}` };
-        if (i + 1 >= args.length)
-            return { missingValue: key };
-        values[allowed[key]] = args[i + 1];
-        i += 1;
-    }
-    return { values };
-}
-function logPath(root) {
-    return path.join(root, "workspace/metrics/audit-log.jsonl");
-}
-function append(args, deps) {
-    const parsed = parseFlags(args, APPEND_FLAGS);
-    if (!parsed.values)
-        return parsed.missingValue
-            ? bundledShellUnboundValue(AUDIT_LOG_ASSET, APPEND_SHELL_LINES[parsed.missingValue])
-            : utilityError(parsed.error ?? "ERROR: invalid arguments");
-    const values = parsed.values;
-    const event = values.event ?? "";
-    const project = values.project ?? "";
-    if (!event)
-        return utilityError("ERROR: Missing required field: --event");
-    if (!project)
-        return utilityError("ERROR: Missing required field: --project");
-    if (!` ${EVENTS} `.includes(` ${event} `))
-        return utilityError(`ERROR: Invalid event '${event}'. Must be one of: ${EVENTS}`);
-    if (values.result && !` ${RESULTS} `.includes(` ${values.result} `))
-        return utilityError(`ERROR: Invalid result '${values.result}'. Must be one of: ${RESULTS}`);
-    if (values.duration_ms && !/^\d+$/.test(values.duration_ms))
-        return utilityError("ERROR: --duration-ms must be a non-negative integer");
-    const timestamp = values.timestamp || deps.now().toISOString().replace(/\.\d{3}Z$/, "Z");
-    const files = values.files_touched ? values.files_touched.split(",") : [];
-    const entry = {
-        timestamp,
-        event,
-        company: values.company || null,
-        project,
-        story_id: values.story_id || null,
-        worker: values.worker || null,
-        model: values.model || null,
-        action: values.action || null,
-        files_touched: files,
-        result: values.result || null,
-        duration_ms: values.duration_ms ? Number(values.duration_ms) : null,
-        error: values.error || null,
-        session_id: values.session_id || null,
-    };
-    for (const key of OMIT_EMPTY_FIELDS) {
-        if (entry[key] === null)
-            delete entry[key];
-    }
-    if (files.length === 0)
-        delete entry.files_touched;
-    const target = logPath(deps.root);
-    fs.mkdirSync(path.dirname(target), { recursive: true });
-    fs.appendFileSync(target, serializeJqJson(entry, "compact"), { encoding: "utf8", mode: 0o666 });
-    return { code: 0, stdout: `Appended to ${target}\n`, stderr: "" };
-}
-function readEntries(file) {
-    return fs.readFileSync(file, "utf8").split(/\r?\n/).filter((line) => line.length > 0)
-        .map((line) => JSON.parse(line));
-}
-function query(args, deps) {
-    const parsed = parseFlags(args, QUERY_FLAGS);
-    if (!parsed.values)
-        return parsed.missingValue
-            ? bundledShellUnboundValue(AUDIT_LOG_ASSET, QUERY_SHELL_LINES[parsed.missingValue])
-            : utilityError(parsed.error ?? "ERROR: invalid arguments");
-    const file = logPath(deps.root);
-    if (!fs.existsSync(file))
-        return { code: 0, stdout: "", stderr: `No audit log found at ${file}\n` };
-    let entries;
-    try {
-        entries = readEntries(file);
-    }
-    catch {
-        return { code: 4, stdout: "", stderr: "" };
-    }
-    const filters = Object.fromEntries(Object.entries(parsed.values).filter(([, value]) => value !== ""));
-    const rows = entries.filter((entry) => Object.entries(filters).every(([key, value]) => {
-        if (key === "timestamp")
-            return String(entry.timestamp ?? "") >= value;
-        return entry[key] === value;
-    }));
-    return { code: 0, stdout: serializeJqJson(rows, "pretty"), stderr: `--- ${rows.length} record(s) matched ---\n` };
-}
-function pad(value, width) {
-    return String(value ?? "").padEnd(width, " ");
-}
-function right(value, width) {
-    return String(value ?? "").padStart(width, " ");
-}
-function printProject(project, stories, phases, failures, skipped, last) {
-    return `${pad(project, 40)}  ${right(stories, 8)}  ${right(phases, 8)}  ${right(failures, 8)}  ${right(skipped, 8)}  ${pad(last, 26)}\n`;
-}
-function printWorker(worker, tasks, failures, rate) {
-    return `${pad(worker, 30)}  ${right(tasks, 8)}  ${right(failures, 8)}  ${pad(rate, 10)}\n`;
-}
-function isTask(entry) { return entry.event === "task_completed" || entry.event === "task_failed"; }
-function isFailure(entry) { return entry.result === "fail" || entry.event === "task_failed"; }
-function summary(_args, deps) {
-    const file = logPath(deps.root);
-    if (!fs.existsSync(file))
-        return { code: 0, stdout: "", stderr: `No audit log found at ${file}\n` };
-    let contents;
-    let entries;
-    try {
-        contents = fs.readFileSync(file, "utf8");
-        entries = readEntries(file);
-    }
-    catch {
-        return { code: 4, stdout: "", stderr: "" };
-    }
-    const lineCount = (contents.match(/\n/g) ?? []).length;
-    if (lineCount === 0)
-        return { code: 0, stdout: "Audit log is empty — no records to summarize.\n", stderr: "" };
-    const projects = new Map();
-    const workers = new Map();
-    for (const entry of entries) {
-        const project = String(entry.project ?? "null");
-        projects.set(project, [...(projects.get(project) ?? []), entry]);
-        if (entry.worker !== undefined && entry.worker !== null) {
-            const worker = String(entry.worker);
-            workers.set(worker, [...(workers.get(worker) ?? []), entry]);
-        }
-    }
-    let out = "\n=== Audit Log Summary ===\n\n--- By Project ---\n";
-    out += printProject("PROJECT", "STORIES", "PHASES", "FAILURES", "SKIPPED", "LAST_ACTIVITY");
-    out += printProject("-".repeat(40), "--------", "--------", "--------", "--------", "-".repeat(26));
-    for (const project of [...projects.keys()].sort()) {
-        const rows = projects.get(project);
-        const sorted = [...rows].sort((a, b) => String(a.timestamp ?? "").localeCompare(String(b.timestamp ?? "")));
-        out += printProject(project === "null" ? "unknown" : project, rows.filter(isTask).length, rows.filter((row) => row.event === "phase_completed").length, rows.filter(isFailure).length, rows.filter((row) => row.result === "skipped").length, String(sorted.at(-1)?.timestamp ?? "-"));
-    }
-    out += "\n--- By Worker ---\n";
-    out += printWorker("WORKER", "TASKS", "FAILURES", "SUCCESS_RATE");
-    out += printWorker("-".repeat(30), "--------", "--------", "----------");
-    for (const worker of [...workers.keys()].sort()) {
-        const rows = workers.get(worker);
-        const tasks = rows.filter(isTask).length;
-        const failures = rows.filter(isFailure).length;
-        const rate = tasks > 0 ? `${Math.floor(((tasks - failures) / tasks * 100) + 0.5)}%` : "n/a";
-        out += printWorker(worker, tasks, failures, rate);
-    }
-    const totalTasks = entries.filter(isTask).length;
-    const totalFailures = entries.filter(isFailure).length;
-    out += `\n--- Totals ---\n  Total events:   ${lineCount}\n  Total tasks:    ${totalTasks}\n  Total failures: ${totalFailures}\n\n`;
-    return { code: 0, stdout: out, stderr: "" };
-}
-export function runAuditLog(args, deps) {
-    const [subcommand = "help", ...rest] = args;
-    if (subcommand === "help" || subcommand === "--help" || subcommand === "-h")
-        return { code: 0, stdout: AUDIT_LOG_HELP, stderr: "" };
-    if (subcommand === "append")
-        return append(rest, deps);
-    if (subcommand === "query")
-        return query(rest, deps);
-    if (subcommand === "summary")
-        return summary(rest, deps);
-    return utilityError(`ERROR: Unknown subcommand '${subcommand}'. Use: append | query | summary | help`);
-}
-export function registerCoreAuditLogNative(core) {
-    registerNativeUtility(core, {
-        name: "audit-log", asset: AUDIT_LOG_ASSET, root: "live", summary: "Append, query, or summarize the HQ audit log",
-        resolveRoot: (_cwd, hqRoot) => resolveLiveRoot({ hqRoot }),
-        run: (args, context) => runAuditLog(args, context),
-    });
-}
-//# sourceMappingURL=core-audit-log-native.js.map

package/dist/commands/core-checkpoint-gate-setting.d.ts

@@ -1,59 +0,0 @@
-/**
- * `hq core checkpoint-gate-setting` — keeps the local cache that lets a
- * company owner turn the checkpoint Stop gate off for their company (CO-58).
- *
- * The owner sets `companySettings.checkpointGateEnabled` on hq-pro
- * (`hq company settings set --checkpoint-gate-enabled false`, or the console
- * Settings page). The Stop gate script never calls the network: it reads
- * `~/.hq/cache/checkpoint-gate/<slug>.json` and, when that is missing or older
- * than ten minutes, starts this command detached with `--refresh`.
- *
- * `--refresh` reads the setting through the member-readable
- * `GET /company-settings/checkpoint-gate` route and writes the cache only while
- * the hq-flag `checkpoint.gate.company-setting` is on for the company. With the
- * flag off it removes the cache, so the gate keeps today's behaviour. Any
- * failure (no login, API unreachable, timeout) leaves the cache as it was: the
- * gate then uses the last known value, or today's behaviour when there is none.
- * Only the named company's setting is ever read.
- */
-import { Command } from "commander";
-export declare const CHECKPOINT_GATE_SETTING_FLAG = "checkpoint.gate.company-setting";
-export declare function checkpointGateCachePath(slug: string, home?: string): string;
-export type CheckpointGateRefreshOutcome = {
-    status: "written";
-    company: string;
-    checkpointGateEnabled: boolean;
-} | {
-    status: "removed";
-    company: string;
-    reason: "flag_off";
-} | {
-    status: "kept";
-    company: string;
-    reason: string;
-};
-export interface CheckpointGateRefreshDeps {
-    home?: string;
-    now?: () => Date;
-    timeoutMs?: number;
-    getToken?: () => Promise<string>;
-    resolveCompanyUid?: (token: string, slug: string) => Promise<string>;
-    /** Returns the company's effective setting; throws on any failure. */
-    fetchSetting?: (token: string, companyUid: string, signal: AbortSignal) => Promise<boolean>;
-    /** Returns the rollout flag, or null when the registry could not be read. */
-    readFlag?: (slug: string, companyUid: string) => Promise<boolean | null>;
-}
-/**
- * `readLanesRegistryFlag` resolves a failed registry read to `false`. The
- * refresh must not treat that as "flag off" and delete a valid cache, so a
- * reported failure becomes null (unknown).
- */
-export declare function readCheckpointGateSettingFlag(slug: string, companyUid: string): Promise<boolean | null>;
-/**
- * Refresh one company's cache entry. Never throws for a network or auth
- * failure: those return `kept` and leave the cache untouched.
- */
-export declare function refreshCheckpointGateSetting(slug: string, deps?: CheckpointGateRefreshDeps): Promise<CheckpointGateRefreshOutcome>;
-export declare function describeRefreshOutcome(outcome: CheckpointGateRefreshOutcome): string;
-export declare function registerCoreCheckpointGateSettingCommand(core: Command): void;
-//# sourceMappingURL=core-checkpoint-gate-setting.d.ts.map