@indigoai-us/hq-cli 5.314.0 → 5.315.0

package/dist/lib/node-binary.d.ts

@@ -0,0 +1,50 @@
+/**
+ * A node path that survives a node upgrade, for service units (LaunchAgents,
+ * systemd user units) that name node by absolute path.
+ *
+ * `process.execPath` is the resolved binary, e.g.
+ * /opt/homebrew/Cellar/node/26.0.0/bin/node. `brew upgrade node` deletes that
+ * directory, and every unit that baked it in stops launching (launchd cannot
+ * exec a missing program, so KeepAlive never brings the job back).
+ *
+ * The fix is to write the stable name the package manager keeps pointing at
+ * the current version (/opt/homebrew/bin/node, /opt/homebrew/opt/node/bin/node)
+ * instead of the versioned directory it points at today. A candidate is only
+ * used when it resolves to the SAME binary this process runs, so the unit
+ * keeps running the exact node it was installed with; a machine where no such
+ * alias exists (nvm without a `current` link, a hand-built node) keeps the
+ * execPath, as before.
+ */
+export interface NodeBinaryIo {
+    existsSync(p: string): boolean;
+    realpathSync(p: string): string;
+}
+/** True when `p` is a node binary inside a version-specific directory. */
+export declare function isVersionedNodePath(p: string): boolean;
+/**
+ * Stable names that may point at `execPath`, most specific first:
+ * the Homebrew prefix's bin/ and opt/<formula>/ links, a `current` link under
+ * nvm, then the usual global bins and every PATH entry.
+ */
+export declare function stableNodeCandidates(execPath: string, env?: NodeJS.ProcessEnv, home?: string): string[];
+/**
+ * The stable name for `execPath` when it sits in a versioned directory and an
+ * alias resolving to the same binary exists; otherwise `execPath` unchanged.
+ */
+export declare function preferStableNodeBinary(execPath: string, opts?: {
+    env?: NodeJS.ProcessEnv;
+    home?: string;
+    io?: NodeBinaryIo;
+}): string;
+/**
+ * Why a unit's node path needs rewriting, or null when it is fine:
+ * "missing" — the binary is gone (launchd can no longer start the job);
+ * "versioned" — it still exists but the next upgrade will remove it, and a
+ * stable alias for the same binary exists.
+ */
+export declare function nodeBinaryProblem(nodePath: string, opts?: {
+    env?: NodeJS.ProcessEnv;
+    home?: string;
+    io?: NodeBinaryIo;
+}): "missing" | "versioned" | null;
+//# sourceMappingURL=node-binary.d.ts.map

package/dist/lib/node-binary.js

@@ -0,0 +1,133 @@
+/**
+ * A node path that survives a node upgrade, for service units (LaunchAgents,
+ * systemd user units) that name node by absolute path.
+ *
+ * `process.execPath` is the resolved binary, e.g.
+ * /opt/homebrew/Cellar/node/26.0.0/bin/node. `brew upgrade node` deletes that
+ * directory, and every unit that baked it in stops launching (launchd cannot
+ * exec a missing program, so KeepAlive never brings the job back).
+ *
+ * The fix is to write the stable name the package manager keeps pointing at
+ * the current version (/opt/homebrew/bin/node, /opt/homebrew/opt/node/bin/node)
+ * instead of the versioned directory it points at today. A candidate is only
+ * used when it resolves to the SAME binary this process runs, so the unit
+ * keeps running the exact node it was installed with; a machine where no such
+ * alias exists (nvm without a `current` link, a hand-built node) keeps the
+ * execPath, as before.
+ */
+import * as fs from "node:fs";
+import * as os from "node:os";
+import * as path from "node:path";
+const defaultIo = {
+    existsSync: (p) => fs.existsSync(p),
+    realpathSync: (p) => fs.realpathSync(p),
+};
+/**
+ * Install layouts whose node lives in a per-version directory that an upgrade
+ * or version switch removes or abandons.
+ */
+const VERSIONED_NODE_PATTERNS = [
+    // Homebrew: <prefix>/Cellar/node/26.0.0/bin/node, <prefix>/Cellar/node@22/22.9.0/bin/node
+    /\/Cellar\/node(?:@[^/]+)?\/[^/]+\/bin\/node$/,
+    // nvm
+    /\/\.nvm\/versions\/node\/[^/]+\/bin\/node$/,
+    // Volta
+    /\/\.volta\/tools\/image\/node\/[^/]+\/bin\/node$/,
+    // fnm (installed versions and the per-shell multishell links)
+    /\/fnm\/node-versions\/[^/]+\/installation\/bin\/node$/,
+    /\/fnm_multishells\/[^/]+\/bin\/node$/,
+    // asdf / mise
+    /\/\.asdf\/installs\/nodejs\/[^/]+\/bin\/node$/,
+    /\/mise\/installs\/node\/[^/]+\/bin\/node$/,
+    // n
+    /\/n\/versions\/node\/[^/]+\/bin\/node$/,
+];
+/** True when `p` is a node binary inside a version-specific directory. */
+export function isVersionedNodePath(p) {
+    const normalized = p.split(path.sep).join("/");
+    return VERSIONED_NODE_PATTERNS.some((re) => re.test(normalized));
+}
+/**
+ * Stable names that may point at `execPath`, most specific first:
+ * the Homebrew prefix's bin/ and opt/<formula>/ links, a `current` link under
+ * nvm, then the usual global bins and every PATH entry.
+ */
+export function stableNodeCandidates(execPath, env = process.env, home = os.homedir()) {
+    const normalized = execPath.split(path.sep).join("/");
+    const out = [];
+    const brew = /^(.*)\/Cellar\/(node(?:@[^/]+)?)\/[^/]+\/bin\/node$/.exec(normalized);
+    if (brew) {
+        const prefix = brew[1];
+        out.push(`${prefix}/bin/node`, `${prefix}/opt/${brew[2]}/bin/node`);
+    }
+    const nvmDir = env.NVM_DIR?.trim() || path.join(home, ".nvm");
+    if (/\/\.nvm\/versions\/node\//.test(normalized))
+        out.push(path.join(nvmDir, "current", "bin", "node"));
+    out.push("/opt/homebrew/bin/node", "/usr/local/bin/node", "/usr/bin/node");
+    for (const dir of (env.PATH ?? "").split(path.delimiter)) {
+        if (dir && path.isAbsolute(dir))
+            out.push(path.join(dir, "node"));
+    }
+    return [...new Set(out)];
+}
+/**
+ * The stable name for `execPath` when it sits in a versioned directory and an
+ * alias resolving to the same binary exists; otherwise `execPath` unchanged.
+ */
+export function preferStableNodeBinary(execPath, opts = {}) {
+    if (!execPath || !isVersionedNodePath(execPath))
+        return execPath;
+    const io = opts.io ?? defaultIo;
+    let target;
+    try {
+        target = io.realpathSync(execPath);
+    }
+    catch {
+        // A versioned node that is already gone (a stale unit being repaired):
+        // there is no binary to match, so any working stable node is the answer.
+        return firstWorkingStableNode(execPath, opts, io) ?? execPath;
+    }
+    for (const candidate of stableNodeCandidates(execPath, opts.env ?? process.env, opts.home ?? os.homedir())) {
+        if (isVersionedNodePath(candidate))
+            continue;
+        try {
+            if (!io.existsSync(candidate))
+                continue;
+            if (io.realpathSync(candidate) === target)
+                return candidate;
+        }
+        catch {
+            /* dangling link — not a candidate */
+        }
+    }
+    return execPath;
+}
+function firstWorkingStableNode(execPath, opts, io) {
+    for (const candidate of stableNodeCandidates(execPath, opts.env ?? process.env, opts.home ?? os.homedir())) {
+        if (isVersionedNodePath(candidate))
+            continue;
+        try {
+            if (io.existsSync(candidate) && io.existsSync(io.realpathSync(candidate)))
+                return candidate;
+        }
+        catch {
+            /* dangling link */
+        }
+    }
+    return null;
+}
+/**
+ * Why a unit's node path needs rewriting, or null when it is fine:
+ * "missing" — the binary is gone (launchd can no longer start the job);
+ * "versioned" — it still exists but the next upgrade will remove it, and a
+ * stable alias for the same binary exists.
+ */
+export function nodeBinaryProblem(nodePath, opts = {}) {
+    const io = opts.io ?? defaultIo;
+    if (!nodePath)
+        return null;
+    if (!io.existsSync(nodePath))
+        return "missing";
+    return preferStableNodeBinary(nodePath, opts) !== nodePath ? "versioned" : null;
+}
+//# sourceMappingURL=node-binary.js.map

package/dist/lib/notify-recipient.d.ts

@@ -0,0 +1,7 @@
+/** Canonical recipients accepted by the notify DM wire contract. */
+export declare const RECIPIENT_UID_PATTERN: RegExp;
+export declare const AGENT_UID_PATTERN: RegExp;
+export declare const EMAIL_PATTERN: RegExp;
+export declare function isRecipientUid(value: string): boolean;
+export declare function isAgentUid(value: string): boolean;
+//# sourceMappingURL=notify-recipient.d.ts.map

package/dist/lib/notify-recipient.js

@@ -0,0 +1,11 @@
+/** Canonical recipients accepted by the notify DM wire contract. */
+export const RECIPIENT_UID_PATTERN = /^(prs|agt)_[A-Za-z0-9_-]+$/;
+export const AGENT_UID_PATTERN = /^agt_[A-Za-z0-9_-]+$/;
+export const EMAIL_PATTERN = /^[^\s]+@[^\s]+$/;
+export function isRecipientUid(value) {
+    return RECIPIENT_UID_PATTERN.test(value.trim());
+}
+export function isAgentUid(value) {
+    return AGENT_UID_PATTERN.test(value.trim());
+}
+//# sourceMappingURL=notify-recipient.js.map

package/dist/lib/onboarding/checkpoint.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Onboarding checkpoint persistence (VLT-9 US-001; vendored from @indigoai-us/hq-onboarding).
+ *
+ * Reads/writes .hq/onboarding-state.json for idempotent resume.
+ * If a flow fails partway, re-running picks up from the last checkpoint.
+ */
+import type { OnboardingCheckpoint, OnboardingStep } from "./types.js";
+export declare function getCheckpointPath(hqRoot: string): string;
+export declare function readCheckpoint(hqRoot: string): Promise<OnboardingCheckpoint | null>;
+export declare function writeCheckpoint(hqRoot: string, checkpoint: OnboardingCheckpoint): Promise<void>;
+export declare function isStepComplete(checkpoint: OnboardingCheckpoint | null, step: OnboardingStep): boolean;
+export declare function deleteCheckpoint(hqRoot: string): Promise<void>;
+//# sourceMappingURL=checkpoint.d.ts.map

package/dist/lib/onboarding/checkpoint.js

@@ -0,0 +1,44 @@
+/**
+ * Onboarding checkpoint persistence (VLT-9 US-001; vendored from @indigoai-us/hq-onboarding).
+ *
+ * Reads/writes .hq/onboarding-state.json for idempotent resume.
+ * If a flow fails partway, re-running picks up from the last checkpoint.
+ */
+import { readFile, writeFile, mkdir } from "node:fs/promises";
+import { join, dirname } from "node:path";
+const CHECKPOINT_FILE = "onboarding-state.json";
+export function getCheckpointPath(hqRoot) {
+    return join(hqRoot, ".hq", CHECKPOINT_FILE);
+}
+export async function readCheckpoint(hqRoot) {
+    const path = getCheckpointPath(hqRoot);
+    try {
+        const raw = await readFile(path, "utf-8");
+        return JSON.parse(raw);
+    }
+    catch {
+        return null;
+    }
+}
+export async function writeCheckpoint(hqRoot, checkpoint) {
+    const path = getCheckpointPath(hqRoot);
+    await mkdir(dirname(path), { recursive: true });
+    checkpoint.updatedAt = new Date().toISOString();
+    await writeFile(path, JSON.stringify(checkpoint, null, 2) + "\n", "utf-8");
+}
+export function isStepComplete(checkpoint, step) {
+    if (!checkpoint)
+        return false;
+    return checkpoint.completedSteps.includes(step);
+}
+export async function deleteCheckpoint(hqRoot) {
+    const { unlink } = await import("node:fs/promises");
+    const path = getCheckpointPath(hqRoot);
+    try {
+        await unlink(path);
+    }
+    catch {
+        // File may not exist — that's fine
+    }
+}
+//# sourceMappingURL=checkpoint.js.map

package/dist/lib/onboarding/cli/onboard.d.ts

@@ -0,0 +1,53 @@
+/**
+ * CLI onboard entry point (VLT-9 US-002; vendored from @indigoai-us/hq-onboarding).
+ *
+ * Programmatic API for the /onboard command. The slash command calls
+ * these functions; they can also be consumed by integration tests.
+ */
+import type { VaultServiceConfig } from "@indigoai-us/hq-cloud";
+import { VaultClient } from "@indigoai-us/hq-cloud";
+import type { OnboardingResult } from "../types.js";
+export interface OnboardCliOptions {
+    mode: "create-company" | "join-company" | "resume" | "dry-run";
+    personName?: string;
+    personEmail?: string;
+    companyName?: string;
+    companySlug?: string;
+    inviteToken?: string;
+    vaultConfig: VaultServiceConfig;
+    hqRoot: string;
+    log?: (msg: string) => void;
+}
+export interface OnboardCliResult {
+    success: boolean;
+    result?: OnboardingResult;
+    error?: string;
+}
+export type CompanySlugAvailability = {
+    kind: "available";
+}
+/** The caller already owns (or is a member of) a company with this slug. */
+ | {
+    kind: "mine";
+    uid: string;
+}
+/** Another account holds the slug. */
+ | {
+    kind: "taken";
+};
+/**
+ * Decide whether `create-company` may proceed for a slug.
+ *
+ * A company that already exists in the CALLER's namespace is not "taken": it
+ * is theirs — typically left behind by an earlier run that created the
+ * entity and then died before the bucket, membership, or config were done
+ * (there may be no local checkpoint or company folder at all). The flow
+ * resumes against it instead of refusing. Only a slug held by a different
+ * account is refused.
+ */
+export declare function checkCompanySlugAvailability(client: Pick<VaultClient, "entity">, slug: string): Promise<CompanySlugAvailability>;
+/**
+ * Run the /onboard CLI flow.
+ */
+export declare function runOnboardCli(options: OnboardCliOptions): Promise<OnboardCliResult>;
+//# sourceMappingURL=onboard.d.ts.map

package/dist/lib/onboarding/cli/onboard.js

@@ -0,0 +1,135 @@
+/**
+ * CLI onboard entry point (VLT-9 US-002; vendored from @indigoai-us/hq-onboarding).
+ *
+ * Programmatic API for the /onboard command. The slash command calls
+ * these functions; they can also be consumed by integration tests.
+ */
+import { VaultClient, VaultConflictError, VaultNotFoundError } from "@indigoai-us/hq-cloud";
+import { createCompanyFlow, joinCompanyFlow, resumeOnboarding, } from "../orchestrator.js";
+import { readCheckpoint, getCheckpointPath } from "../checkpoint.js";
+import { formatProgress, formatSummary, formatError } from "./prompts.js";
+const CREATE_STEPS = 6;
+const JOIN_STEPS = 6;
+/**
+ * Decide whether `create-company` may proceed for a slug.
+ *
+ * A company that already exists in the CALLER's namespace is not "taken": it
+ * is theirs — typically left behind by an earlier run that created the
+ * entity and then died before the bucket, membership, or config were done
+ * (there may be no local checkpoint or company folder at all). The flow
+ * resumes against it instead of refusing. Only a slug held by a different
+ * account is refused.
+ */
+export async function checkCompanySlugAvailability(client, slug) {
+    const mine = await client.entity.findInMyNamespace("company", slug);
+    if (mine)
+        return { kind: "mine", uid: mine.uid };
+    try {
+        await client.entity.findBySlug("company", slug);
+        return { kind: "taken" };
+    }
+    catch (err) {
+        // VaultNotFoundError = slug available, continue
+        const isNotFound = err instanceof VaultNotFoundError ||
+            (err instanceof Error && err.name === "VaultNotFoundError");
+        if (isNotFound)
+            return { kind: "available" };
+        // Several other tenants hold the slug (server answers 409): not ours.
+        const isConflict = err instanceof VaultConflictError ||
+            (err instanceof Error && err.name === "VaultConflictError");
+        if (isConflict)
+            return { kind: "taken" };
+        throw err;
+    }
+}
+/**
+ * Run the /onboard CLI flow.
+ */
+export async function runOnboardCli(options) {
+    const { mode, vaultConfig, hqRoot, log = console.log } = options;
+    let stepCounter = 0;
+    const onProgress = (event) => {
+        if (event.status === "running")
+            stepCounter++;
+        const total = mode === "create-company" ? CREATE_STEPS : JOIN_STEPS;
+        log(formatProgress(event, stepCounter, total));
+    };
+    const config = { vaultConfig, hqRoot };
+    try {
+        if (mode === "resume") {
+            const checkpoint = await readCheckpoint(hqRoot);
+            if (!checkpoint) {
+                return { success: false, error: "No checkpoint found. Run /onboard to start." };
+            }
+            log(`Resuming ${checkpoint.mode} flow from step ${checkpoint.completedSteps.length + 1}...`);
+            const result = await resumeOnboarding(config, onProgress);
+            log("");
+            log(formatSummary(result));
+            return { success: true, result };
+        }
+        if (mode === "dry-run") {
+            log("DRY RUN — simulating create-company flow:");
+            log("  1. Create person entity");
+            log("  2. Create company entity");
+            log("  3. Provision S3 bucket + KMS key");
+            log("  4. Bootstrap owner membership");
+            log("  5. Verify STS credential vending");
+            log("  6. Write .hq/config.json");
+            log("");
+            log("No resources will be created. Run /onboard to execute.");
+            return { success: true };
+        }
+        if (mode === "create-company") {
+            // Validate slug availability
+            if (options.companySlug) {
+                const client = new VaultClient(vaultConfig);
+                const availability = await checkCompanySlugAvailability(client, options.companySlug);
+                if (availability.kind === "taken") {
+                    return {
+                        success: false,
+                        error: `Company slug "${options.companySlug}" is already taken. Choose another.`,
+                    };
+                }
+                if (availability.kind === "mine") {
+                    log(`Company "${options.companySlug}" already exists in your account (${availability.uid}) — finishing its setup.`);
+                }
+            }
+            const input = {
+                mode: "create-company",
+                personName: options.personName,
+                personEmail: options.personEmail,
+                companyName: options.companyName,
+                companySlug: options.companySlug,
+            };
+            log(`Creating company "${input.companyName}" (${input.companySlug})...`);
+            log("");
+            const result = await createCompanyFlow(input, config, onProgress);
+            log("");
+            log(formatSummary(result));
+            return { success: true, result };
+        }
+        if (mode === "join-company") {
+            const input = {
+                mode: "join-company",
+                personName: options.personName,
+                personEmail: options.personEmail,
+                inviteToken: options.inviteToken,
+            };
+            log("Joining company via invite...");
+            log("");
+            const result = await joinCompanyFlow(input, config, onProgress);
+            log("");
+            log(formatSummary(result));
+            return { success: true, result };
+        }
+        return { success: false, error: `Unknown mode: ${mode}` };
+    }
+    catch (err) {
+        const checkpointPath = getCheckpointPath(hqRoot);
+        const errorMsg = err instanceof Error ? err.message : String(err);
+        log("");
+        log(formatError(err instanceof Error ? err : new Error(errorMsg), checkpointPath));
+        return { success: false, error: errorMsg };
+    }
+}
+//# sourceMappingURL=onboard.js.map

package/dist/lib/onboarding/cli/prompts.d.ts

@@ -0,0 +1,28 @@
+/**
+ * CLI prompt helpers for /onboard command (VLT-9 US-002; vendored from @indigoai-us/hq-onboarding).
+ *
+ * Provides typed prompt interfaces the slash command can call.
+ * These are library functions — the actual UX is in onboard.md.
+ */
+import type { OnboardingResult, OnboardingProgress } from "../types.js";
+/**
+ * Format a progress event for CLI display.
+ */
+export declare function formatProgress(event: OnboardingProgress, stepNumber: number, totalSteps: number): string;
+/**
+ * Format the success summary box.
+ */
+export declare function formatSummary(result: OnboardingResult): string;
+/**
+ * Format an error for CLI display with recovery hints.
+ */
+export declare function formatError(error: Error, checkpointPath: string): string;
+/**
+ * Validate a company slug: lowercase, alphanumeric + hyphens, 3-40 chars.
+ */
+export declare function validateSlug(slug: string): string | null;
+/**
+ * Validate email format.
+ */
+export declare function validateEmail(email: string): string | null;
+//# sourceMappingURL=prompts.d.ts.map

package/dist/lib/onboarding/cli/prompts.js

@@ -0,0 +1,83 @@
+/**
+ * CLI prompt helpers for /onboard command (VLT-9 US-002; vendored from @indigoai-us/hq-onboarding).
+ *
+ * Provides typed prompt interfaces the slash command can call.
+ * These are library functions — the actual UX is in onboard.md.
+ */
+/**
+ * Format a progress event for CLI display.
+ */
+export function formatProgress(event, stepNumber, totalSteps) {
+    const statusIcon = {
+        pending: "○",
+        running: "◉",
+        done: "✓",
+        skipped: "→",
+        failed: "✗",
+    }[event.status];
+    const detail = event.detail ? ` — ${event.detail}` : "";
+    return `  ${statusIcon} Step ${stepNumber}/${totalSteps}: ${event.step}${detail}`;
+}
+/**
+ * Format the success summary box.
+ */
+export function formatSummary(result) {
+    const lines = [
+        "┌─────────────────────────────────────────────┐",
+        "│  HQ Onboarding Complete                     │",
+        "├─────────────────────────────────────────────┤",
+        `│  Company:  ${result.companySlug.padEnd(33)}│`,
+        `│  UID:      ${result.companyUid.padEnd(33)}│`,
+        `│  Person:   ${result.personUid.padEnd(33)}│`,
+        `│  Role:     ${result.role.padEnd(33)}│`,
+    ];
+    if (result.bucketName) {
+        lines.push(`│  Bucket:   ${result.bucketName.padEnd(33)}│`);
+    }
+    lines.push("├─────────────────────────────────────────────┤");
+    lines.push("│  Next steps:                                │");
+    if (result.role === "owner") {
+        lines.push("│    • Run /invite <email> to add team        │");
+        lines.push("│    • Run hq sync to push files              │");
+    }
+    else {
+        lines.push("│    • Run hq sync to pull latest files       │");
+    }
+    lines.push("└─────────────────────────────────────────────┘");
+    return lines.join("\n");
+}
+/**
+ * Format an error for CLI display with recovery hints.
+ */
+export function formatError(error, checkpointPath) {
+    const lines = [
+        `ERROR: ${error.message}`,
+        "",
+        `Checkpoint saved to: ${checkpointPath}`,
+        "To retry: /onboard --resume",
+    ];
+    return lines.join("\n");
+}
+/**
+ * Validate a company slug: lowercase, alphanumeric + hyphens, 3-40 chars.
+ */
+export function validateSlug(slug) {
+    if (slug.length < 3)
+        return "Slug must be at least 3 characters";
+    if (slug.length > 40)
+        return "Slug must be at most 40 characters";
+    if (!/^[a-z0-9][a-z0-9-]*[a-z0-9]$/.test(slug)) {
+        return "Slug must be lowercase alphanumeric with hyphens (e.g. 'my-company')";
+    }
+    return null;
+}
+/**
+ * Validate email format.
+ */
+export function validateEmail(email) {
+    if (!email.includes("@") || !email.includes(".")) {
+        return "Invalid email format";
+    }
+    return null;
+}
+//# sourceMappingURL=prompts.js.map

package/dist/lib/onboarding/errors.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Onboarding error classes (VLT-9 US-001; vendored from @indigoai-us/hq-onboarding).
+ *
+ * Each failure class maps to a distinct step in the onboarding flow,
+ * making it easy for the installer to show targeted recovery hints.
+ */
+declare class OnboardingError extends Error {
+    readonly step: string;
+    readonly cause?: Error | undefined;
+    constructor(message: string, step: string, cause?: Error | undefined);
+}
+export declare class PersonCreationError extends OnboardingError {
+    constructor(message: string, cause?: Error);
+}
+export declare class CompanyCreationError extends OnboardingError {
+    constructor(message: string, cause?: Error);
+}
+export declare class ProvisioningError extends OnboardingError {
+    constructor(message: string, cause?: Error);
+}
+export declare class MembershipBootstrapError extends OnboardingError {
+    constructor(message: string, cause?: Error);
+}
+export declare class FirstSyncError extends OnboardingError {
+    constructor(message: string, cause?: Error);
+}
+export declare class InviteAcceptError extends OnboardingError {
+    constructor(message: string, cause?: Error);
+}
+export declare class StsVerifyError extends OnboardingError {
+    constructor(message: string, cause?: Error);
+}
+export {};
+//# sourceMappingURL=errors.d.ts.map

package/dist/lib/onboarding/errors.js

@@ -0,0 +1,59 @@
+/**
+ * Onboarding error classes (VLT-9 US-001; vendored from @indigoai-us/hq-onboarding).
+ *
+ * Each failure class maps to a distinct step in the onboarding flow,
+ * making it easy for the installer to show targeted recovery hints.
+ */
+class OnboardingError extends Error {
+    step;
+    cause;
+    constructor(message, step, cause) {
+        super(message);
+        this.step = step;
+        this.cause = cause;
+        this.name = "OnboardingError";
+    }
+}
+export class PersonCreationError extends OnboardingError {
+    constructor(message, cause) {
+        super(message, "create-person", cause);
+        this.name = "PersonCreationError";
+    }
+}
+export class CompanyCreationError extends OnboardingError {
+    constructor(message, cause) {
+        super(message, "create-company", cause);
+        this.name = "CompanyCreationError";
+    }
+}
+export class ProvisioningError extends OnboardingError {
+    constructor(message, cause) {
+        super(message, "provision-bucket", cause);
+        this.name = "ProvisioningError";
+    }
+}
+export class MembershipBootstrapError extends OnboardingError {
+    constructor(message, cause) {
+        super(message, "bootstrap-membership", cause);
+        this.name = "MembershipBootstrapError";
+    }
+}
+export class FirstSyncError extends OnboardingError {
+    constructor(message, cause) {
+        super(message, "first-sync", cause);
+        this.name = "FirstSyncError";
+    }
+}
+export class InviteAcceptError extends OnboardingError {
+    constructor(message, cause) {
+        super(message, "accept-invite", cause);
+        this.name = "InviteAcceptError";
+    }
+}
+export class StsVerifyError extends OnboardingError {
+    constructor(message, cause) {
+        super(message, "verify-sts", cause);
+        this.name = "StsVerifyError";
+    }
+}
+//# sourceMappingURL=errors.js.map

package/dist/lib/onboarding/index.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Onboarding orchestrator (formerly the npm package `@indigoai-us/hq-onboarding`,
+ * vendored into hq-cli in 2026-09 because nobody owned the package and its
+ * company-create step no longer matched the vault-service's authorization).
+ *
+ * Composes entities, bucket provisioning, STS, sync, membership, and
+ * invite/accept into create-company and join-company flows with
+ * checkpoint/resume.
+ */
+export { readCheckpoint } from "./checkpoint.js";
+export type { OnboardingCheckpoint } from "./types.js";
+export { runOnboardCli } from "./cli/onboard.js";
+//# sourceMappingURL=index.d.ts.map