@indigoai-us/hq-cli 5.314.0 → 5.316.0

package/dist/commands/report.js

@@ -0,0 +1,537 @@
+/** `hq report` — safe channel-report lifecycle commands for bot runbooks. */
+import { snapshotReport } from "../lib/report-snapshot.js";
+import * as fs from "node:fs";
+import * as os from "node:os";
+import * as path from "node:path";
+import { ensureCognitoToken, } from "../utils/cognito-session.js";
+import { vaultApiFetch } from "../utils/vault-api.js";
+import { DEPLOY_API_URL, deployApiRequest, deployHeaders } from "../lib/deploy-api.js";
+import { listDeployApps } from "../lib/deploy-apps.js";
+import { listReportTemplates } from "../lib/report-templates.js";
+import { adoptReport, buildReportTarball, conventionReportDir, deployOrgContext, ReportPublishError, plainFailureReason, publishReport, } from "../lib/report-publish.js";
+const REPORT_CHANNEL_STATE_FILE = "report-channels.json";
+const MAX_REPORT_DISCOVERY_CHANNELS = 50;
+const JOB_EXECUTION_DISABLED_MESSAGE = "Scheduled jobs are turned off for this company. A company owner can turn them back on.";
+function reportPath(channelId, reportId) {
+    return `/v1/notify/channels/${encodeURIComponent(channelId)}/reports/${encodeURIComponent(reportId)}`;
+}
+function reportListPath(channelId) {
+    return `/v1/notify/channels/${encodeURIComponent(channelId)}/reports`;
+}
+function reportChannelStatePath() {
+    const stateDir = process.env.HQ_STATE_DIR?.trim() || path.join(os.homedir(), ".hq");
+    return path.join(stateDir, REPORT_CHANNEL_STATE_FILE);
+}
+function readReportChannelState() {
+    const file = reportChannelStatePath();
+    let raw;
+    try {
+        raw = fs.readFileSync(file, "utf8");
+    }
+    catch (error) {
+        if (error.code === "ENOENT") {
+            return { version: 1, channels: {} };
+        }
+        throw new ReportPublishError("Could not read the local report channel state.");
+    }
+    try {
+        const parsed = JSON.parse(raw);
+        if (parsed.version !== 1 || !parsed.channels || typeof parsed.channels !== "object")
+            throw new Error("invalid state");
+        const channels = Object.fromEntries(Object.entries(parsed.channels).filter((entry) => typeof entry[1] === "string" && entry[1].length > 0));
+        return { version: 1, channels };
+    }
+    catch {
+        throw new ReportPublishError("Could not read the local report channel state.");
+    }
+}
+function rememberReportChannel(reportId, channelId) {
+    const file = reportChannelStatePath();
+    const state = readReportChannelState();
+    state.channels[reportId] = channelId;
+    fs.mkdirSync(path.dirname(file), { recursive: true });
+    const temporary = `${file}.${process.pid}.${Date.now()}.tmp`;
+    try {
+        fs.writeFileSync(temporary, `${JSON.stringify(state, null, 2)}\n`, { encoding: "utf8", mode: 0o600 });
+        fs.renameSync(temporary, file);
+    }
+    finally {
+        if (fs.existsSync(temporary))
+            fs.rmSync(temporary, { force: true });
+    }
+}
+function rememberReportChannelAfterSuccess(report) {
+    try {
+        rememberReportChannel(report.reportId, report.channelId);
+    }
+    catch (error) {
+        const reason = error instanceof Error ? error.message : "local state write failed";
+        console.warn(`Report succeeded but local channel context was not saved: ${reason}`);
+    }
+}
+function locallyRecordedChannel(reportId) {
+    return readReportChannelState().channels[reportId];
+}
+function notFoundMessage(scannedChannels) {
+    const scope = scannedChannels >= MAX_REPORT_DISCOVERY_CHANNELS
+        ? `the first ${MAX_REPORT_DISCOVERY_CHANNELS} channels`
+        : `${scannedChannels} channel${scannedChannels === 1 ? "" : "s"}`;
+    return `Report not found. Pass --channel or set HQ_REPORT_CHANNEL_ID. Searched ${scope}.`;
+}
+function errorMessage(error) {
+    if (error instanceof ReportPublishError)
+        return plainFailureReason(error);
+    return "Report command failed. Check the report context and try again.";
+}
+function print(value, json) {
+    if (json)
+        console.log(JSON.stringify(value, null, 2));
+    else
+        console.log(typeof value === "string" ? value : JSON.stringify(value, null, 2));
+}
+async function listReportChannels(token) {
+    // scope=all: the default list is personal channels only, which hid every
+    // project and company channel a report can live on.
+    const channels = await vaultApiFetch({ token, path: "/v1/notify/channels?scope=all" });
+    if (!channels.ok)
+        throw new ReportPublishError("Could not resolve the report channel.", "source-invalid");
+    const listed = await channels.json();
+    return Array.isArray(listed.channels) ? listed.channels : [];
+}
+/** Any company-owned channel (company or project scope) can carry reports; personal channels cannot. */
+function isCompanyReportChannel(channel) {
+    if (channel.scope === "personal")
+        return false;
+    return channel.scope === "company" || channel.scope === "project" || Boolean(channel.companyUid);
+}
+function requireCompanyReportChannel(channels, channelId) {
+    const channel = channels.find((row) => row.channelId === channelId);
+    if (!channel)
+        throw new ReportPublishError("Report channel was not found in your channels.", "source-invalid");
+    if (!isCompanyReportChannel(channel))
+        throw new ReportPublishError("Channel reports require a company channel.", "source-invalid");
+}
+async function readReportInChannel(token, channelId, reportId) {
+    const res = await vaultApiFetch({ token, path: reportPath(channelId, reportId) });
+    if (!res.ok)
+        return undefined;
+    const body = await res.json();
+    if (!body.report)
+        throw new ReportPublishError("Report response was incomplete.");
+    return body.report;
+}
+/**
+ * Records created before hq-pro stamped companyUid carry null. The channel the
+ * caller can see knows its company, and publish needs it to pick the deploy
+ * org, so fill it from there rather than failing every publish.
+ */
+function withChannelCompany(report, channels) {
+    if (report.companyUid)
+        return report;
+    const companyUid = channels.find((row) => row.channelId === report.channelId)?.companyUid;
+    return companyUid ? { ...report, companyUid } : report;
+}
+/** Explicit context has priority; discovery is the authenticated fallback for normal CLI use. */
+export async function resolveReport(token, reportId, requestedChannelId) {
+    const explicit = requestedChannelId ?? process.env.HQ_REPORT_CHANNEL_ID;
+    const channels = await listReportChannels(token);
+    if (explicit) {
+        requireCompanyReportChannel(channels, explicit);
+        const res = await vaultApiFetch({ token, path: reportPath(explicit, reportId) });
+        if (!res.ok)
+            throw new ReportPublishError("Report was not found in the supplied channel context.", "source-invalid");
+        const body = await res.json();
+        if (!body.report)
+            throw new ReportPublishError("Report response was incomplete.");
+        return withChannelCompany(body.report, channels);
+    }
+    const recordedChannel = locallyRecordedChannel(reportId);
+    if (recordedChannel) {
+        requireCompanyReportChannel(channels, recordedChannel);
+        const recorded = await readReportInChannel(token, recordedChannel, reportId);
+        if (recorded)
+            return withChannelCompany(recorded, channels);
+    }
+    // The report API is intentionally channel-scoped. Discover only among the
+    // caller's existing channels, using list endpoints so missing reports never
+    // become one server-side 404 per channel.
+    let scannedChannels = 0;
+    for (const row of channels) {
+        if (!row.channelId)
+            continue;
+        if (!isCompanyReportChannel(row))
+            continue;
+        if (scannedChannels >= MAX_REPORT_DISCOVERY_CHANNELS)
+            break;
+        scannedChannels += 1;
+        const res = await vaultApiFetch({ token, path: reportListPath(row.channelId) });
+        if (!res.ok)
+            continue;
+        const body = await res.json();
+        const reports = Array.isArray(body.reports) ? body.reports : [];
+        const match = reports.find((report) => report.reportId === reportId);
+        if (match)
+            return withChannelCompany(match, channels);
+    }
+    throw new ReportPublishError(notFoundMessage(scannedChannels));
+}
+export async function patchReport(token, report, patch) {
+    if (!report.companyUid)
+        throw new ReportPublishError("Channel reports require a company channel.", "source-invalid");
+    const patchOnce = (current) => vaultApiFetch({
+        token,
+        path: reportPath(current.channelId, current.reportId),
+        method: "PATCH",
+        body: {
+            ...(typeof patch === "function" ? patch(current) : patch),
+            revision: current.revision,
+        },
+    });
+    let res = await patchOnce(report);
+    if (res.status === 409) {
+        const body = await res.json().catch(() => ({}));
+        if (body.error === "already-running")
+            throw new ReportPublishError("already running", "already-running");
+        if (body.error !== "revision-mismatch")
+            throw new ReportPublishError("Report changed while it was being updated.", "revision-conflict");
+        const latest = await readReportInChannel(token, report.channelId, report.reportId);
+        if (!latest)
+            throw new ReportPublishError("Could not reread the report after it changed.", "revision-conflict");
+        if (typeof patch !== "function") {
+            throw new ReportPublishError("Report changed while it was being updated; refresh and retry.", "revision-conflict");
+        }
+        res = await patchOnce(latest);
+        if (res.status === 409) {
+            const retryBody = await res.json().catch(() => ({}));
+            if (retryBody.error === "already-running")
+                throw new ReportPublishError("already running", "already-running");
+            throw new ReportPublishError("Report changed while it was being updated; refresh and retry.", "revision-conflict");
+        }
+    }
+    if (!res.ok)
+        throw new ReportPublishError("Could not update the report record.");
+    const body = await res.json();
+    if (!body.report)
+        throw new ReportPublishError("Report update response was incomplete.");
+    return body.report;
+}
+async function deployJson(token, route, method, body, extraHeaders = {}) {
+    let res;
+    try {
+        res = await deployApiRequest(token, route, method, body, extraHeaders);
+    }
+    catch {
+        throw new ReportPublishError("Could not reach hq-deploy.");
+    }
+    if (!res.ok) {
+        const failure = await res.json().catch(() => ({}));
+        if (failure?.error?.code === "SUBDOMAIN_DUPLICATE")
+            throw new SubdomainTakenError();
+        throw new ReportPublishError("hq-deploy rejected the report deployment.");
+    }
+    return await res.json();
+}
+/** hq-deploy refused the subdomain: another app, not visible to this caller, holds it. */
+class SubdomainTakenError extends ReportPublishError {
+    constructor() {
+        super("hq-deploy rejected the report deployment.");
+    }
+}
+/**
+ * Subdomains to try, in order. The first is the report's own slug; the rest
+ * are used only when an app the caller cannot see already holds it (for
+ * example, one left by an earlier publish under a different account).
+ */
+export function candidateSlugs(slug, attempts = 3) {
+    return [slug, ...Array.from({ length: attempts }, (_, i) => `${slug}-${i + 2}`)];
+}
+async function resolveCompanySlug(token, companyUid) {
+    const res = await vaultApiFetch({ token, path: `/entity/${encodeURIComponent(companyUid)}` });
+    if (!res.ok)
+        throw new ReportPublishError("Could not resolve the report's company for deploy.");
+    const body = await res.json();
+    const slug = body.entity?.slug;
+    if (!slug)
+        throw new ReportPublishError("Could not resolve the report's company for deploy.");
+    return slug;
+}
+async function orgFor(token, report) {
+    const slug = report.companyUid ? await resolveCompanySlug(token, report.companyUid) : undefined;
+    return deployOrgContext(report, slug);
+}
+export async function findOrCreateApp(token, slug, org) {
+    const apps = await listDeployApps((cursor) => {
+        const route = cursor ? `/api/apps?cursor=${encodeURIComponent(cursor)}` : "/api/apps";
+        return deployJson(token, route, "GET", undefined, org.headers);
+    });
+    const mine = (name) => apps.find((app) => !!app && typeof app === "object" && (app.subdomain === name || app.name === name));
+    let app;
+    for (const name of candidateSlugs(slug)) {
+        const existing = mine(name);
+        if (existing) {
+            app = existing;
+            break;
+        }
+        try {
+            app = await deployJson(token, "/api/apps", "POST", { name, type: "static" }, org.headers);
+            break;
+        }
+        catch (error) {
+            if (error instanceof SubdomainTakenError)
+                continue;
+            throw error;
+        }
+    }
+    if (!app)
+        throw new ReportPublishError("Every address for this report is taken on hq-deploy.");
+    const id = typeof app.id === "string" ? app.id : undefined;
+    const subdomain = typeof app.subdomain === "string" ? app.subdomain : undefined;
+    if (!id || !subdomain)
+        throw new ReportPublishError("hq-deploy returned an incomplete app record.");
+    return { id, subdomain };
+}
+async function deployReportStatic(token, input) {
+    const app = await findOrCreateApp(token, input.slug, input.org);
+    await deployJson(token, `/api/apps/${encodeURIComponent(app.id)}/access-policy`, "PUT", input.access, input.org.headers);
+    const tarball = buildReportTarball(input.files);
+    const deployment = await deployJson(token, "/api/deploys", "POST", {
+        appSlug: app.subdomain,
+        ...(input.org.org ? { org: input.org.org } : {}),
+        manifest: { files: [], size: tarball.sizeBytes, sha256: tarball.sha256 },
+    }, input.org.headers);
+    const deployId = typeof deployment.deployId === "string" ? deployment.deployId : undefined;
+    const presignedUrl = typeof deployment.presignedUrl === "string" ? deployment.presignedUrl : undefined;
+    if (!deployId || !presignedUrl)
+        throw new ReportPublishError("hq-deploy did not create an upload.");
+    let upload;
+    try {
+        upload = await fetch(presignedUrl, { method: "PUT", headers: { "Content-Type": "application/gzip" }, body: tarball.bytes });
+    }
+    catch {
+        throw new ReportPublishError("Report upload failed.");
+    }
+    if (!upload.ok)
+        throw new ReportPublishError("Report upload failed.");
+    const completed = await deployJson(token, `/api/deploys/${encodeURIComponent(deployId)}/complete`, "POST", { appSlug: app.subdomain }, input.org.headers);
+    const url = typeof completed.url === "string" ? completed.url : `https://${app.subdomain}.indigo-hq.com`;
+    return { appId: app.id, url, deployId };
+}
+async function publishWithOrg(token, report, directory, draft) {
+    const published = await publishReport(report, directory, draft, {
+        // The server echoes the stored record, whose companyUid may still be null
+        // on reports created before hq-pro stamped it. Keep the company resolved
+        // from the channel so the access policy and deploy org stay correct.
+        patch: async (current, patch) => {
+            const next = await patchReport(token, current, patch);
+            const companyUid = next.companyUid ?? current.companyUid ?? report.companyUid;
+            return companyUid ? { ...next, companyUid } : next;
+        },
+        deploy: async (input) => {
+            const org = await orgFor(token, report);
+            return deployReportStatic(token, { ...input, org });
+        },
+        now: () => new Date().toISOString(),
+        snapshot: (source) => snapshotReport(source),
+    });
+    rememberReportChannelAfterSuccess(published);
+    return published;
+}
+async function publishAction(reportId, options) {
+    const token = await ensureCognitoToken();
+    const report = await resolveReport(token, reportId, options.channel);
+    print(await publishWithOrg(token, report, options.dir, options.draft === true), options.json === true);
+}
+async function promoteAction(reportId, options) {
+    const token = await ensureCognitoToken();
+    const report = await resolveReport(token, reportId, options.channel);
+    const directory = options.dir?.trim() ? options.dir : conventionReportDir(reportId);
+    const published = await publishWithOrg(token, report, directory, false);
+    // A promotion makes the freshly deployed live page authoritative. Null clears
+    // the draft pointer; omitting the field would leave the old draft in place.
+    const updated = published.draft
+        ? await patchReport(token, published, { draft: null, state: "live" })
+        : published;
+    print(updated, options.json === true);
+}
+async function getAction(reportId, options) {
+    const report = await resolveReport(await ensureCognitoToken(), reportId, options.channel);
+    print(report, options.json === true);
+}
+async function discardDraftAction(reportId, options) {
+    const token = await ensureCognitoToken();
+    const report = await resolveReport(token, reportId, options.channel);
+    const org = await orgFor(token, report);
+    if (report.draft?.appId) {
+        const res = await fetch(`${DEPLOY_API_URL.replace(/\/+$/, "")}/api/apps/${encodeURIComponent(report.draft.appId)}`, {
+            method: "DELETE",
+            headers: deployHeaders(token, false, org.headers),
+        });
+        if (!res.ok && res.status !== 404)
+            throw new ReportPublishError("Could not remove the draft deployment.");
+    }
+    const updated = await patchReport(token, report, (current) => ({
+        draft: null,
+        state: current.url ? "live" : "draft-pending",
+    }));
+    print(updated, options.json === true);
+}
+async function accessAction(reportId, options) {
+    if (!["company", "selected", "password", "public"].includes(options.mode)) {
+        throw new ReportPublishError("Access mode must be company, selected, password, or public.");
+    }
+    if (options.mode === "password" && !options.password) {
+        throw new ReportPublishError("A password is required for password access mode.");
+    }
+    const token = await ensureCognitoToken();
+    const report = await resolveReport(token, reportId, options.channel);
+    const appId = report.deployAppId ?? report.draft?.appId;
+    if (!appId)
+        throw new ReportPublishError("Publish the report before changing its access policy.");
+    const companyUid = report.companyUid ?? "personal";
+    const policy = {
+        mode: options.mode,
+        companyUid,
+        users: options.mode === "selected" ? [{ id: report.createdBy }] : [],
+        groups: [],
+        ...(options.mode === "password" && options.password ? { password: options.password } : {}),
+    };
+    const org = await orgFor(token, report);
+    const result = await deployJson(token, `/api/apps/${encodeURIComponent(appId)}/access-policy`, "PUT", policy, org.headers);
+    print(result, options.json === true);
+}
+async function cancelOwnedJob(token, agentUid, jobId) {
+    const res = await vaultApiFetch({
+        token,
+        path: `/v1/agents/${encodeURIComponent(agentUid)}/jobs/${encodeURIComponent(jobId)}/cancel`,
+        method: "POST",
+    });
+    if (!res.ok && res.status !== 404)
+        throw new ReportPublishError("Could not remove the report job.");
+}
+async function requireScheduledJobsEnabled(token, agentUid) {
+    let executionEnabled;
+    try {
+        const res = await vaultApiFetch({
+            token,
+            path: `/v1/agents/${encodeURIComponent(agentUid)}/jobs`,
+            method: "GET",
+        });
+        if (!res.ok) {
+            console.debug("Scheduled job preflight was unavailable; proceeding with job creation.", { status: res.status });
+            return;
+        }
+        const body = await res.json();
+        if (body && typeof body === "object" && !Array.isArray(body)) {
+            executionEnabled = body.executionEnabled;
+        }
+    }
+    catch (error) {
+        console.debug("Scheduled job preflight failed; proceeding with job creation.", error);
+        return;
+    }
+    if (executionEnabled === false) {
+        throw new ReportPublishError(JOB_EXECUTION_DISABLED_MESSAGE, "job-execution-disabled");
+    }
+    if (executionEnabled !== true) {
+        console.debug("Scheduled job preflight did not return a boolean executionEnabled; proceeding with job creation.");
+    }
+}
+async function adoptAction(reportId, options) {
+    const token = await ensureCognitoToken();
+    const report = await resolveReport(token, reportId, options.channel);
+    const updated = await adoptReport(report, {
+        preflightJobCreation: () => requireScheduledJobsEnabled(token, report.ownerAgentUid),
+        cancelJob: (jobId) => cancelOwnedJob(token, report.ownerAgentUid, jobId),
+        createJob: async (input) => {
+            const res = await vaultApiFetch({
+                token,
+                path: `/v1/agents/${encodeURIComponent(report.ownerAgentUid)}/jobs`,
+                method: "POST",
+                body: input,
+            });
+            if (!res.ok) {
+                if (res.status === 409) {
+                    let rejection;
+                    try {
+                        rejection = await res.json();
+                    }
+                    catch {
+                        // A non-JSON conflict response is still the generic install failure.
+                    }
+                    if (rejection?.code === "JOB_EXECUTION_DISABLED") {
+                        throw new ReportPublishError(JOB_EXECUTION_DISABLED_MESSAGE, "job-execution-disabled");
+                    }
+                }
+                throw new ReportPublishError("Could not install the report job.");
+            }
+            const body = await res.json();
+            const jobId = body.job?.jobId ?? body.jobId;
+            if (!jobId)
+                throw new ReportPublishError("Jobs API returned an incomplete job.");
+            return { jobId };
+        },
+        patch: (current, patch) => patchReport(token, current, patch),
+    });
+    rememberReportChannelAfterSuccess(updated);
+    print(updated, options.json === true);
+}
+async function decommissionAction(reportId, options) {
+    const token = await ensureCognitoToken();
+    const report = await resolveReport(token, reportId, options.channel);
+    const org = await orgFor(token, report);
+    const leftover = [];
+    for (const id of [report.deployAppId, report.draft?.appId]) {
+        if (!id)
+            continue;
+        try {
+            const res = await fetch(`${DEPLOY_API_URL.replace(/\/+$/, "")}/api/apps/${encodeURIComponent(id)}`, {
+                method: "DELETE",
+                headers: deployHeaders(token, false, org.headers),
+            });
+            if (res.status === 404)
+                leftover.push("The published page was already gone.");
+            else if (!res.ok)
+                leftover.push("A deployment could not be deactivated.");
+        }
+        catch {
+            leftover.push("A deployment could not be reached.");
+        }
+    }
+    // The durable report is marked decommissioned by hq-pro before this prompt.
+    // Cleanup gaps stay on the result so a missing app or offline bot does not roll the record back.
+    if (report.jobId) {
+        try {
+            await cancelOwnedJob(token, report.ownerAgentUid, report.jobId);
+        }
+        catch {
+            leftover.push("The report job is still installed.");
+        }
+    }
+    const note = leftover.length ? [...new Set(leftover)].join(" ") : null;
+    print({ reportId: report.reportId, decommissioned: true, note }, options.json === true);
+}
+export function registerReportCommand(program) {
+    const report = program.command("report").description("Publish and manage a channel report owned by this bot.");
+    const context = (command) => command.option("--channel <channelId>", "report channel context (or set HQ_REPORT_CHANNEL_ID)");
+    context(report.command("get <reportId>").option("--json").action((reportId, options) => runReportCommand(() => getAction(reportId, options))));
+    context(report.command("publish <reportId>").requiredOption("--dir <path>").option("--draft").option("--json").action((reportId, options) => runReportCommand(() => publishAction(reportId, options))));
+    context(report.command("promote <reportId>").option("--dir <path>", "report folder; defaults to <workerDir>/reports/<reportId>").option("--json").action((reportId, options) => runReportCommand(() => promoteAction(reportId, options))));
+    context(report.command("discard-draft <reportId>").option("--json").action((reportId, options) => runReportCommand(() => discardDraftAction(reportId, options))));
+    context(report.command("access <reportId>").requiredOption("--mode <mode>", "company|selected|password|public").option("--password <password>").option("--json").action((reportId, options) => runReportCommand(() => accessAction(reportId, options))));
+    context(report.command("decommission <reportId>").option("--json").action((reportId, options) => runReportCommand(() => decommissionAction(reportId, options))));
+    context(report.command("adopt <reportId>").option("--json").action((reportId, options) => runReportCommand(() => adoptAction(reportId, options))));
+    report.command("templates").option("--json").action((options) => {
+        const templates = listReportTemplates().map(({ name, path: templatePath }) => ({ name, path: templatePath }));
+        print(templates, options.json === true);
+    });
+}
+async function runReportCommand(action) {
+    try {
+        await action();
+    }
+    catch (error) {
+        console.error(errorMessage(error));
+        process.exitCode = 1;
+    }
+}
+//# sourceMappingURL=report.js.map

package/dist/commands/rescue.d.ts

@@ -45,5 +45,9 @@ export declare function shouldAttemptSelfUpdate(opts: {
     check?: boolean;
     selfUpdate?: boolean;
 }): boolean;
+/** Latest release tag for a repo, e.g. `v12.3.0`. Throws on failure. */
+export declare function getLatestReleaseTag(repo: string, token?: string): Promise<string>;
+/** Resolve a tag to its commit SHA, dereferencing annotated tags. */
+export declare function resolveTagSha(repo: string, tag: string, token?: string): Promise<string>;
 export declare function registerRescueCommand(program: Command): void;
 //# sourceMappingURL=rescue.d.ts.map

package/dist/commands/rescue.js

@@ -53,38 +53,48 @@ function ghHeaders(token) {
         headers.Authorization = `Bearer ${token}`;
     return headers;
 }
+// Thirty seconds gives GitHub time to respond while keeping the recovery command bounded.
+const GITHUB_REQUEST_TIMEOUT_MS = 30_000;
+async function githubJsonRequest(url, token) {
+    const signal = AbortSignal.timeout(GITHUB_REQUEST_TIMEOUT_MS);
+    try {
+        const response = await fetch(url, { headers: ghHeaders(token), signal });
+        if (!response.ok)
+            return { response };
+        const body = (await response.json());
+        return { response, body };
+    }
+    catch (error) {
+        if (signal.aborted)
+            throw new Error('GitHub request timed out', { cause: error });
+        throw error;
+    }
+}
 /** Latest release tag for a repo, e.g. `v12.3.0`. Throws on failure. */
-async function getLatestReleaseTag(repo, token) {
-    const res = await fetch(`https://api.github.com/repos/${repo}/releases/latest`, {
-        headers: ghHeaders(token),
-    });
-    if (!res.ok) {
-        throw new Error(`GitHub releases/latest for ${repo}: HTTP ${res.status}`);
+export async function getLatestReleaseTag(repo, token) {
+    const { response, body } = await githubJsonRequest(`https://api.github.com/repos/${repo}/releases/latest`, token);
+    if (!response.ok) {
+        throw new Error(`GitHub releases/latest for ${repo}: HTTP ${response.status}`);
     }
-    const body = (await res.json());
-    if (!body.tag_name)
+    if (!body?.tag_name)
         throw new Error(`no tag_name in latest release for ${repo}`);
     return body.tag_name;
 }
 /** Resolve a tag to its commit SHA, dereferencing annotated tags. */
-async function resolveTagSha(repo, tag, token) {
-    const refRes = await fetch(`https://api.github.com/repos/${repo}/git/ref/tags/${encodeURIComponent(tag)}`, { headers: ghHeaders(token) });
+export async function resolveTagSha(repo, tag, token) {
+    const { response: refRes, body: ref } = await githubJsonRequest(`https://api.github.com/repos/${repo}/git/ref/tags/${encodeURIComponent(tag)}`, token);
     if (!refRes.ok)
         throw new Error(`git/ref/tags/${tag} for ${repo}: HTTP ${refRes.status}`);
-    const ref = (await refRes.json());
-    const obj = ref.object;
+    const obj = ref?.object;
     if (!obj?.sha)
         throw new Error(`no object.sha for tag ${tag} in ${repo}`);
     if (obj.type !== 'tag')
         return obj.sha; // lightweight tag → already a commit
     // Annotated tag → dereference to the commit it points at.
-    const tagRes = await fetch(`https://api.github.com/repos/${repo}/git/tags/${obj.sha}`, {
-        headers: ghHeaders(token),
-    });
+    const { response: tagRes, body: annotated } = await githubJsonRequest(`https://api.github.com/repos/${repo}/git/tags/${obj.sha}`, token);
     if (!tagRes.ok)
         throw new Error(`git/tags/${obj.sha} for ${repo}: HTTP ${tagRes.status}`);
-    const annotated = (await tagRes.json());
-    if (!annotated.object?.sha)
+    if (!annotated?.object?.sha)
         throw new Error(`annotated tag ${tag} has no target sha`);
     return annotated.object.sha;
 }

package/dist/commands/run-feature-telemetry.d.ts

@@ -0,0 +1,3 @@
+/** Attribute hq run's batch secret read to its resolved company UID. */
+export declare function withRunSecretReadTelemetry<T>(companyUid: string, action: () => Promise<T>): Promise<T>;
+//# sourceMappingURL=run-feature-telemetry.d.ts.map

package/dist/commands/run-feature-telemetry.js

@@ -0,0 +1,6 @@
+import { withCliFeatureUsed } from '../utils/cli-telemetry.js';
+/** Attribute hq run's batch secret read to its resolved company UID. */
+export function withRunSecretReadTelemetry(companyUid, action) {
+    return withCliFeatureUsed('secret_read', action, companyUid);
+}
+//# sourceMappingURL=run-feature-telemetry.js.map