@indigoai-us/hq-cli 5.345.104 → 5.345.106

package/dist/lib/session-company-lock.js

@@ -0,0 +1,97 @@
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { resolveSessionId } from "./core-utils/session-id.js";
+import { resolveDefaultHqRoot } from "../utils/hq-root-resolver.js";
+/** Read the session's validated company scope capability or legacy metadata. */
+export function readSessionCompanyLock(env = process.env) {
+    const root = resolveDefaultHqRoot({ env });
+    const sessionId = resolveSessionId(root, env);
+    if (!sessionId)
+        return undefined;
+    const sessionDir = path.join(root, "workspace/sessions", sessionId);
+    const capabilityPath = path.join(sessionDir, "scope-capability.json");
+    const metaPath = path.join(sessionDir, "meta.yaml");
+    let primary;
+    let companies;
+    let hasCapability = false;
+    try {
+        fs.lstatSync(capabilityPath);
+        hasCapability = true;
+    }
+    catch (error) {
+        const code = error.code;
+        if (code !== "ENOENT" && code !== "ENOTDIR")
+            throw new Error("Cannot verify this session's company lock because its scope capability is unreadable.");
+    }
+    if (hasCapability) {
+        let value;
+        try {
+            value = JSON.parse(fs.readFileSync(capabilityPath, "utf8"));
+        }
+        catch {
+            throw new Error("Cannot verify this session's company lock because its scope capability is unreadable.");
+        }
+        if (!value || typeof value !== "object" || Array.isArray(value))
+            throw new Error("Cannot verify this session's company lock because its scope capability is invalid.");
+        const cap = value;
+        if (cap.session_id !== sessionId)
+            throw new Error("Cannot verify this session's company lock because its scope capability does not match the active session.");
+        if (typeof cap.company_slug !== "string" || !/^[A-Za-z0-9_-]+$/.test(cap.company_slug))
+            throw new Error("Cannot verify this session's company lock because its scope capability is invalid.");
+        primary = cap.company_slug;
+        if (cap.company_slugs === undefined)
+            companies = [primary];
+        else if (Array.isArray(cap.company_slugs)
+            && cap.company_slugs.length > 0
+            && cap.company_slugs.every((slug) => typeof slug === "string" && /^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$/.test(slug))
+            && cap.company_slugs[0] === primary
+            && new Set(cap.company_slugs).size === cap.company_slugs.length
+            && ((primary === "personal" && cap.company_slugs.length === 1)
+                || (primary !== "personal" && !cap.company_slugs.includes("personal"))))
+            companies = [...cap.company_slugs];
+        else
+            throw new Error("Cannot verify this session's company lock because its scope capability is invalid.");
+    }
+    else {
+        try {
+            const meta = fs.readFileSync(metaPath, "utf8");
+            const read = (key) => meta.split(/\r?\n/).find((line) => new RegExp(`^\\s*${key}:`).test(line))?.replace(/^\s*[^:]+:\s*/, "").replace(/^"|"$/g, "") ?? "";
+            primary = read("company_slug");
+            const hasList = meta.split(/\r?\n/).some((line) => /^\s*company_slugs:/.test(line));
+            const listed = hasList ? read("company_slugs") : "";
+            if (hasList && (!listed || !primary))
+                throw new Error("invalid company lock");
+            companies = hasList ? listed.split(",") : primary ? [primary] : [];
+            if (companies.some((slug) => !/^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$/.test(slug)))
+                throw new Error("invalid company lock");
+            if (new Set(companies).size !== companies.length)
+                throw new Error("invalid company lock");
+            if (primary && companies[0] !== primary)
+                throw new Error("invalid company lock");
+            if (companies.length > 1 && companies.includes("personal"))
+                throw new Error("invalid company lock");
+        }
+        catch (error) {
+            const code = error.code;
+            if (code === "ENOENT" || code === "ENOTDIR" || code === "EACCES")
+                return { sessionId, companies: [] };
+            throw new Error("Cannot verify this session's company lock because its metadata is invalid.");
+        }
+    }
+    const real = companies.filter((slug) => {
+        if (slug === "personal")
+            return true;
+        try {
+            const companyPath = path.join(root, "companies", slug);
+            const stat = fs.lstatSync(companyPath);
+            return stat.isDirectory() && !stat.isSymbolicLink();
+        }
+        catch {
+            return false;
+        }
+    });
+    if (primary && real[0] !== primary)
+        return { sessionId, companies: [] };
+    return { sessionId, companies: real };
+}
+//# sourceMappingURL=session-company-lock.js.map

package/dist/types.d.ts

@@ -127,6 +127,88 @@ export interface PackManifest {
         entrypoint: string;
         prompt?: string;
     };
+    /**
+     * Guided in-app setup. Optional — absent on
+     * legacy packs, which install unchanged. Validated by
+     * `lib/packages/setup-block.ts`; `hq packages install --start-bot` creates the
+     * bot it names and the bot's system prompt renders the questions and the run
+     * command from it.
+     */
+    setup?: PackSetup;
+}
+/** One question the pack bot asks, in order. */
+export interface PackSetupQuestion {
+    id: string;
+    text: string;
+    /** Suggested answers shown as buttons; may be empty (free text only). */
+    options: string[];
+    /** The bot proposes this value and asks to confirm (e.g. company_display_name). */
+    default_from?: string;
+    skippable: boolean;
+    /** What the bot needs to learn from this question; it follows up until it has that. */
+    goal?: string;
+}
+export interface PackSetup {
+    bot: {
+        /** Bot handle; also the worker id under contributes.workers. ^[a-z0-9-]{2,32}$ */
+        name: string;
+        display_name: string;
+        intro: string;
+    };
+    /** When true and HQ's setup bot has not finished, the pack bot finishes HQ setup first. */
+    takeover_setup: boolean;
+    questions: PackSetupQuestion[];
+    run: {
+        /** Relative to the pack root; must exist in the pack. */
+        script: string;
+        /** question id -> flag (the bot passes --firm itself). */
+        args: Record<string, string>;
+        /** Commands run after `script`, in order; each first token exists in the pack. */
+        then: string[];
+    };
+    done: {
+        message: string;
+        suggestion?: string;
+    };
+    /** Documents worth asking for at the start (a rate card, a past proposal); the bot reads them and asks less. */
+    documents?: string[];
+    /**
+     * Kinds of tools the bot asks about, connects and reads (with the owner's
+     * yes) to answer questions itself before asking them: sent client emails for
+     * voice, CRM deals for pricing. `informs` names question ids.
+     */
+    sources?: PackSetupSource[];
+}
+/**
+ * One tool a source can be. It connects in one of two ways: through HQ
+ * integrations (`domain`, a sign-in link from `hq integrations connect`), or
+ * through a script the pack ships (`tool`, run with `connect` / `status` and
+ * read with `usage`). `available: false` means the pack cannot read it yet.
+ */
+export interface PackSetupSourceOption {
+    name: string;
+    domain?: string;
+    /** Pack-relative script (.mjs/.js run with node, .sh with bash). */
+    tool?: string;
+    /** Arguments that start the connection (default "connect"). It prints JSON: a `url` to send, or `started: true` when it opened a sign-in page itself. */
+    connect?: string;
+    /** Arguments that report the connection (default "status"); JSON with `connected`. */
+    status?: string;
+    /** How to read with the tool, e.g. "search <terms> | recent | read <id>". */
+    usage?: string;
+    available?: boolean;
+    /** Shown to the bot when `available` is false, e.g. "coming in a later update". */
+    note?: string;
+}
+export interface PackSetupSource {
+    /** The kind of tool, as the person would say it: "email", "CRM", "team chat", "docs". */
+    kind: string;
+    /** What to read from it, in words the bot repeats when it asks: "the last 30 emails you sent to clients". */
+    read: string;
+    /** Question ids this source can answer. */
+    informs: string[];
+    /** Likely tools for this kind and how each one connects. */
+    options: PackSetupSourceOption[];
 }
 export {};
 //# sourceMappingURL=types.d.ts.map

package/dist/utils/cognito-config.d.ts

@@ -0,0 +1,5 @@
+import type { CognitoAuthConfig } from "@indigoai-us/hq-cloud";
+/** Lightweight Cognito and Vault defaults shared by startup-safe modules. */
+export declare const DEFAULT_COGNITO: CognitoAuthConfig;
+export declare const DEFAULT_VAULT_API_URL: string;
+//# sourceMappingURL=cognito-config.d.ts.map

package/dist/utils/cognito-config.js

@@ -0,0 +1,14 @@
+/** Lightweight Cognito and Vault defaults shared by startup-safe modules. */
+export const DEFAULT_COGNITO = {
+    region: process.env.AWS_REGION ?? "us-east-1",
+    userPoolDomain: process.env.HQ_COGNITO_DOMAIN ?? "vault-indigo-hq-prod",
+    clientId: process.env.HQ_COGNITO_CLIENT_ID ?? "7acei2c8v870enheptb1j5foln",
+    port: process.env.HQ_COGNITO_CALLBACK_PORT
+        ? Number(process.env.HQ_COGNITO_CALLBACK_PORT)
+        : 8765,
+    identityProvider: process.env.HQ_COGNITO_IDENTITY_PROVIDER !== undefined
+        ? process.env.HQ_COGNITO_IDENTITY_PROVIDER || undefined
+        : "Google",
+};
+export const DEFAULT_VAULT_API_URL = process.env.HQ_VAULT_API_URL ?? "https://hqapi.hq.computer";
+//# sourceMappingURL=cognito-config.js.map

package/dist/utils/cognito-revoke.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Server-side revocation of a Cognito refresh token.
+ *
+ * `hq logout` calls this before it deletes the local token file so that a
+ * copied token file stops working too. Cognito's `/oauth2/revoke` endpoint on
+ * the hosted domain (the same domain the CLI already uses for `/oauth2/token`)
+ * revokes the refresh token and every access/ID token issued from it. The CLI
+ * app client is public (no client secret), so the body carries only the token
+ * and the client id.
+ *
+ * This never throws and never includes the token in its result: callers get a
+ * plain outcome they can print.
+ */
+export interface CognitoRevokeConfig {
+    region: string;
+    userPoolDomain: string;
+    clientId: string;
+}
+export type RevokeOutcome = {
+    ok: true;
+} | {
+    ok: false;
+    reason: "network" | "timeout" | "rejected";
+    status?: number;
+};
+/** Upper bound on the revoke request so logout never hangs on a dead network. */
+export declare const REVOKE_TIMEOUT_MS = 5000;
+export declare function cognitoRevokeEndpoint(config: CognitoRevokeConfig): string;
+export declare function revokeRefreshToken(refreshToken: string, config: CognitoRevokeConfig, opts?: {
+    timeoutMs?: number;
+    fetchImpl?: typeof fetch;
+}): Promise<RevokeOutcome>;
+//# sourceMappingURL=cognito-revoke.d.ts.map

package/dist/utils/cognito-revoke.js

@@ -0,0 +1,42 @@
+/**
+ * Server-side revocation of a Cognito refresh token.
+ *
+ * `hq logout` calls this before it deletes the local token file so that a
+ * copied token file stops working too. Cognito's `/oauth2/revoke` endpoint on
+ * the hosted domain (the same domain the CLI already uses for `/oauth2/token`)
+ * revokes the refresh token and every access/ID token issued from it. The CLI
+ * app client is public (no client secret), so the body carries only the token
+ * and the client id.
+ *
+ * This never throws and never includes the token in its result: callers get a
+ * plain outcome they can print.
+ */
+/** Upper bound on the revoke request so logout never hangs on a dead network. */
+export const REVOKE_TIMEOUT_MS = 5_000;
+export function cognitoRevokeEndpoint(config) {
+    return `https://${config.userPoolDomain}.auth.${config.region}.amazoncognito.com/oauth2/revoke`;
+}
+export async function revokeRefreshToken(refreshToken, config, opts = {}) {
+    const fetchImpl = opts.fetchImpl ?? fetch;
+    const body = new URLSearchParams({ token: refreshToken, client_id: config.clientId });
+    try {
+        const response = await fetchImpl(cognitoRevokeEndpoint(config), {
+            method: "POST",
+            headers: { "Content-Type": "application/x-www-form-urlencoded" },
+            body: body.toString(),
+            signal: AbortSignal.timeout(opts.timeoutMs ?? REVOKE_TIMEOUT_MS),
+        });
+        // Drain the body so the socket is released; its content is not needed.
+        await response.text().catch(() => undefined);
+        if (response.ok)
+            return { ok: true };
+        return { ok: false, reason: "rejected", status: response.status };
+    }
+    catch (error) {
+        const name = error instanceof Error ? error.name : "";
+        if (name === "TimeoutError" || name === "AbortError")
+            return { ok: false, reason: "timeout" };
+        return { ok: false, reason: "network" };
+    }
+}
+//# sourceMappingURL=cognito-revoke.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.345.104",
+  "version": "5.345.106",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {