@indigoai-us/hq-cli 5.35.0 → 5.35.2

package/dist/commands/auth.js

@@ -14,10 +14,11 @@
  * by the deploy + sync skills.
  */
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="a4a30b14-55b3-5206-9148-48aff1a8cdd4")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="e8f8cd77-2f24-5e71-8cb6-518095482b22")}catch(e){}}();
 import chalk from "chalk";
 import { browserLogin, clearCachedTokens, loadCachedTokens, isExpiring, CognitoAuthError, } from "@indigoai-us/hq-cloud";
-import { DEFAULT_COGNITO, refreshCachedSession, } from "../utils/cognito-session.js";
+import { refreshCachedSession, } from "../utils/cognito-session.js";
+import { cognitoConfigForLoginProvider } from "../utils/login-provider.js";
 /**
  * Decode the (unverified) ID token payload for display purposes only.
  * The token was just returned by Cognito's token endpoint, so its contents
@@ -44,7 +45,8 @@ export function registerAuthCommands(program) {
     authCmd
         .command("login")
         .description("Sign in to HQ — opens the Cognito Hosted UI and caches tokens locally")
-        .action(async () => {
+        .option("--provider <provider>", "OAuth provider to use: google, microsoft, or picker")
+        .action(async (options) => {
         const existing = loadCachedTokens();
         if (existing && !isExpiring(existing, 120)) {
             const who = peekIdToken(existing.idToken).email ?? "cached session";
@@ -52,7 +54,7 @@ export function registerAuthCommands(program) {
             return;
         }
         try {
-            const tokens = await browserLogin(DEFAULT_COGNITO);
+            const tokens = await browserLogin(cognitoConfigForLoginProvider(options.provider));
             const who = peekIdToken(tokens.idToken).email ?? "HQ";
             console.log(chalk.green(`Signed in as ${who}`));
             console.log(chalk.dim(`  Token cached at ~/.hq/cognito-tokens.json (expires ${tokens.expiresAt})`));
@@ -110,4 +112,4 @@ export function registerAuthCommands(program) {
     });
 }
 //# sourceMappingURL=auth.js.map
-//# debugId=a4a30b14-55b3-5206-9148-48aff1a8cdd4
+//# debugId=e8f8cd77-2f24-5e71-8cb6-518095482b22

package/dist/commands/cloud-provision.d.ts

@@ -222,11 +222,20 @@ export interface ManifestCompanyEntry {
  * under the target slug. Read → mutate → temp-write → rename so concurrent
  * readers never see a partially-written file.
  *
- * Idempotent: if the values already match, this is a no-op (still rewrites
- * the file to canonical YAML, but the mutation is identical).
+ * Skip-if-unchanged: if the target slug already carries the exact
+ * `cloud_uid` + `bucket_name`, this is a true no-op — the file is left
+ * byte-for-byte intact (comments, ordering, and formatting preserved) and
+ * we return `false`. This matters because `yaml.dump` does NOT round-trip
+ * comments or the original layout: an unconditional rewrite re-canonicalises
+ * the manifest (stripping the `/newcompany` header comment, reflowing keys)
+ * on EVERY provision/Connect, even when nothing semantically changed. Each
+ * such rewrite is then pushed by the initial-sync step, so the
+ * comment-stripped local form perpetually diverges from any peer/cloud copy
+ * that still holds the commented form — manifesting as a recurring HQ Sync
+ * conflict loop on `companies/manifest.yaml` that re-fires every sync. Only
+ * writing when a value actually changes lets the two forms converge.
  *
- * Returns true if the file was written (always true in current impl —
- * reserved for future "skip if unchanged" optimization).
+ * Returns true if the file was written, false if it was already current.
  */
 export declare function patchManifest(hqRoot: string, slug: string, cloudUid: string, bucketName: string): boolean;
 /**

package/dist/commands/cloud-provision.js

@@ -28,7 +28,7 @@
  *       `initial_sync.ok=false`). Manifest + config may have been written.
  */
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="925baddc-7b12-5ad4-b64f-d7e20bd0daab")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="3ae2829b-1343-59f7-92b0-63d93f37086f")}catch(e){}}();
 import chalk from "chalk";
 import * as fs from "node:fs";
 import * as path from "node:path";
@@ -209,11 +209,20 @@ export function ensureManifestEntryForProvision(hqRoot, slug) {
  * under the target slug. Read → mutate → temp-write → rename so concurrent
  * readers never see a partially-written file.
  *
- * Idempotent: if the values already match, this is a no-op (still rewrites
- * the file to canonical YAML, but the mutation is identical).
+ * Skip-if-unchanged: if the target slug already carries the exact
+ * `cloud_uid` + `bucket_name`, this is a true no-op — the file is left
+ * byte-for-byte intact (comments, ordering, and formatting preserved) and
+ * we return `false`. This matters because `yaml.dump` does NOT round-trip
+ * comments or the original layout: an unconditional rewrite re-canonicalises
+ * the manifest (stripping the `/newcompany` header comment, reflowing keys)
+ * on EVERY provision/Connect, even when nothing semantically changed. Each
+ * such rewrite is then pushed by the initial-sync step, so the
+ * comment-stripped local form perpetually diverges from any peer/cloud copy
+ * that still holds the commented form — manifesting as a recurring HQ Sync
+ * conflict loop on `companies/manifest.yaml` that re-fires every sync. Only
+ * writing when a value actually changes lets the two forms converge.
  *
- * Returns true if the file was written (always true in current impl —
- * reserved for future "skip if unchanged" optimization).
+ * Returns true if the file was written, false if it was already current.
  */
 export function patchManifest(hqRoot, slug, cloudUid, bucketName) {
     const mPath = manifestPath(hqRoot);
@@ -224,6 +233,12 @@ export function patchManifest(hqRoot, slug, cloudUid, bucketName) {
     const existing = parsed.companies[slug];
     // Preserve null / object / unknown — promote null → {} so we can write keys.
     const entry = existing && typeof existing === "object" ? { ...existing } : {};
+    // No-op guard: both fields already match → leave the on-disk file (and its
+    // comments) untouched so a re-provision can't churn the manifest and seed a
+    // sync conflict loop.
+    if (entry.cloud_uid === cloudUid && entry.bucket_name === bucketName) {
+        return false;
+    }
     entry.cloud_uid = cloudUid;
     entry.bucket_name = bucketName;
     parsed.companies[slug] = entry;
@@ -495,9 +510,13 @@ export async function provisionCompany(options) {
     const cloudUid = entity.uid;
     const bucketName = entity.bucketName;
     const kmsKeyId = entity.kmsKeyId ?? null;
-    // Step 6: patch manifest atomically
-    patchManifest(options.hqRoot, options.slug, cloudUid, bucketName);
-    log(`patched companies/manifest.yaml`);
+    // Step 6: patch manifest atomically. Skip-if-unchanged returns false when
+    // the manifest already carries this slug's cloud_uid + bucket_name, so we
+    // report the honest outcome rather than always claiming a patch.
+    const manifestPatched = patchManifest(options.hqRoot, options.slug, cloudUid, bucketName);
+    log(manifestPatched
+        ? `patched companies/manifest.yaml`
+        : `companies/manifest.yaml already current — left untouched`);
     // Step 7: write .hq/config.json atomically
     writeCompanyConfig(options.hqRoot, options.slug, {
         companyUid: cloudUid,
@@ -556,7 +575,7 @@ export async function provisionCompany(options) {
         vault_api_url: options.vaultApiUrl,
         kms_key_id: kmsKeyId,
         created_entity: createdEntity,
-        manifest_patched: true,
+        manifest_patched: manifestPatched,
         config_written: true,
         initial_sync: initialSync,
     };
@@ -615,4 +634,4 @@ export function registerCloudProvisionCommands(program) {
     });
 }
 //# sourceMappingURL=cloud-provision.js.map
-//# debugId=925baddc-7b12-5ad4-b64f-d7e20bd0daab
+//# debugId=3ae2829b-1343-59f7-92b0-63d93f37086f

package/dist/commands/cloud.d.ts

@@ -104,6 +104,7 @@ export interface ShareCallOptions {
     message?: string;
     skipUnchanged?: boolean;
     propagateDeletes?: boolean;
+    propagateDeletePolicy?: "owned-only" | "currency-gated" | "all";
 }
 export interface ShareCallResult {
     filesUploaded: number;

package/dist/commands/cloud.js

@@ -13,13 +13,40 @@
  *   hq sync status            — show local journal summary
  */
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="bdaf154f-b17d-5482-9e4d-feaebe606a1b")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="94a293c9-eb80-5100-a3e0-d64c93f7165c")}catch(e){}}();
 import chalk from "chalk";
 import * as fs from "fs";
 import * as path from "path";
 import { share, sync, readJournal, getJournalPath, loadCachedTokens, VaultClient, computePersonalVaultPaths, } from "@indigoai-us/hq-cloud";
 import { DEFAULT_HQ_ROOT, ensureCognitoToken, buildVaultConfig, } from "../utils/cognito-session.js";
 import { emitNarrowHint, isStrictRefusal, resolveBannerLevel, } from "../lib/narrow-hint-banner.js";
+/**
+ * Resolve the `propagateDeletePolicy` for share() calls.
+ *
+ * Mirrors `@indigoai-us/hq-cloud`'s `bin/sync-runner.js` `resolveDeletePolicy`
+ * — the same function the AppBar HQ Sync menubar uses — so the CLI and the
+ * menubar agree on the policy by default. Inlined here (rather than
+ * deep-imported from `dist/bin/sync-runner.js`) to avoid coupling to a
+ * non-public subpath.
+ *
+ * Default is `"currency-gated"` (etag-verified safe delete). Override via
+ * the `HQ_SYNC_DELETE_POLICY` env var: `owned-only` (legacy direction-of-
+ * origin filter, multi-user safe but stranded down-stream litter on
+ * personal vaults until hq-cloud 6.0.1's prs_ override), `currency-gated`
+ * (the menubar default), or `all` (emergency-reconcile, no safety gates).
+ *
+ * Prior to this helper, the CLI passed nothing → share() fell through to
+ * its own `"owned-only"` default, leaving CLI users on a stricter (and
+ * sometimes wrong, on personal vault) policy than menubar users for
+ * months. See `workspace/reports/owned-only-delete-policy-purpose-debug.md`.
+ */
+function resolveDeletePolicy() {
+    const env = process.env.HQ_SYNC_DELETE_POLICY;
+    if (env === "owned-only" || env === "all" || env === "currency-gated") {
+        return env;
+    }
+    return "currency-gated";
+}
 // Oldest-first by createdAt, ties broken by uid lexicographic — matches
 // `pickCanonicalPersonEntity` in @indigoai-us/hq-cloud so the CLI lands on
 // the same person bucket that `hq-sync-runner` picks.
@@ -171,6 +198,7 @@ export async function pushAll(options, deps) {
                 paths: [path.join(options.hqRoot, "companies", slug)],
                 skipUnchanged: true,
                 propagateDeletes: true,
+                propagateDeletePolicy: resolveDeletePolicy(),
                 ...(options.onConflict ? { onConflict: options.onConflict } : {}),
                 ...(options.message ? { message: options.message } : {}),
             },
@@ -188,6 +216,7 @@ export async function pushAll(options, deps) {
                 journalSlug: "personal",
                 skipUnchanged: true,
                 propagateDeletes: true,
+                propagateDeletePolicy: resolveDeletePolicy(),
                 ...(options.onConflict ? { onConflict: options.onConflict } : {}),
                 ...(options.message ? { message: options.message } : {}),
             },
@@ -869,6 +898,9 @@ async function runPushAll(hqRoot, message, onConflict, skipPersonal) {
                 ...(opts.propagateDeletes !== undefined
                     ? { propagateDeletes: opts.propagateDeletes }
                     : {}),
+                ...(opts.propagateDeletePolicy !== undefined
+                    ? { propagateDeletePolicy: opts.propagateDeletePolicy }
+                    : {}),
                 ...(author ? { author } : {}),
             }),
         });
@@ -949,6 +981,7 @@ async function runNowSingle(hqRoot, company, personal, message, onConflict, mode
             hqRoot,
             skipUnchanged: true,
             propagateDeletes: true,
+            propagateDeletePolicy: resolveDeletePolicy(),
             ...(onConflict ? { onConflict } : {}),
             ...(message ? { message } : {}),
             ...(personalMode ? { personalMode: true } : {}),
@@ -1130,4 +1163,4 @@ function resolveUploadAuthorFromCache() {
     }
 }
 //# sourceMappingURL=cloud.js.map
-//# debugId=bdaf154f-b17d-5482-9e4d-feaebe606a1b
+//# debugId=94a293c9-eb80-5100-a3e0-d64c93f7165c

package/dist/commands/creators.d.ts

@@ -0,0 +1,34 @@
+/**
+ * `hq creators apply` — apply for verified-creator access.
+ *
+ * Publishing to the marketplace is gated on verified-creator status. An
+ * unverified caller submits an application (a short pitch + optional desired
+ * handle); it is persisted server-side and an Indigo admin reviews it. On
+ * approval the caller becomes a verified creator and can `hq publish`.
+ *
+ * Wire contract (POST /v1/creators/request-access, authed):
+ *   body { reason: string, handle?: string }
+ *   202  { status, code, applicationId, requestAccessPath }
+ *   409  { code: "APPLICATION_PENDING", error, applicationId }  (already pending)
+ */
+import { Command } from "commander";
+export interface CreatorApplyOptions {
+    reason: string;
+    handle?: string;
+}
+export interface CreatorApplyDeps {
+    /** Resolve a non-expired access token (prompts login when interactive). */
+    getAccessToken: () => Promise<string>;
+    /** POST the application body to the vault API. */
+    post: (token: string, body: Record<string, unknown>) => Promise<Response>;
+}
+export interface CreatorApplyResult {
+    message: string;
+}
+/**
+ * Testable core. Submits the application and maps the server response to a
+ * single human-readable message. Throws on hard failures.
+ */
+export declare function runCreatorApply(opts: CreatorApplyOptions, deps: CreatorApplyDeps): Promise<CreatorApplyResult>;
+export declare function registerCreatorsCommand(program: Command): void;
+//# sourceMappingURL=creators.d.ts.map

package/dist/commands/creators.js

@@ -0,0 +1,68 @@
+
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="9cd4617e-f5b0-54ad-86a0-042157165a91")}catch(e){}}();
+import chalk from "chalk";
+import { ensureCognitoToken } from "../utils/cognito-session.js";
+import { vaultApiFetch } from "../utils/vault-api.js";
+/**
+ * Testable core. Submits the application and maps the server response to a
+ * single human-readable message. Throws on hard failures.
+ */
+export async function runCreatorApply(opts, deps) {
+    const reason = opts.reason?.trim();
+    if (!reason) {
+        throw new Error('A reason is required — pass --reason "why you want to publish to the marketplace".');
+    }
+    const token = await deps.getAccessToken();
+    const body = { reason };
+    const handle = opts.handle?.trim();
+    if (handle)
+        body.handle = handle;
+    const res = await deps.post(token, body);
+    const parsed = (await res
+        .json()
+        .catch(() => ({})));
+    if (res.status === 409 || parsed.code === "APPLICATION_PENDING") {
+        return {
+            message: "You already have a pending creator application — an Indigo admin will review it.",
+        };
+    }
+    if (res.status < 200 || res.status >= 300) {
+        const msg = parsed.error ?? parsed.message ?? `HTTP ${res.status}`;
+        throw new Error(`Creator application failed: ${msg}`);
+    }
+    const id = typeof parsed.applicationId === "string" ? ` (${parsed.applicationId})` : "";
+    return {
+        message: `Creator application submitted${id} — an Indigo admin will review it. ` +
+            "You'll be able to `hq publish` once approved.",
+    };
+}
+export function registerCreatorsCommand(program) {
+    const creators = program
+        .command("creators")
+        .description("Creator marketplace account");
+    creators
+        .command("apply")
+        .description("Apply for verified-creator access (required to publish packs)")
+        .requiredOption("--reason <reason>", "Why you want to publish to the marketplace")
+        .option("--handle <handle>", "Desired creator handle (optional)")
+        .action(async (options) => {
+        try {
+            const result = await runCreatorApply({ reason: options.reason, handle: options.handle }, {
+                getAccessToken: () => ensureCognitoToken({ interactive: true }),
+                post: (token, body) => vaultApiFetch({
+                    token,
+                    path: "/v1/creators/request-access",
+                    method: "POST",
+                    body,
+                }),
+            });
+            console.log(chalk.green(result.message));
+        }
+        catch (err) {
+            console.error(chalk.red(err.message));
+            process.exitCode = 1;
+        }
+    });
+}
+//# sourceMappingURL=creators.js.map
+//# debugId=9cd4617e-f5b0-54ad-86a0-042157165a91

package/dist/commands/login.d.ts

@@ -1,5 +1,5 @@
 /**
- * hq login — opens browser for Cognito auth via Google OAuth
+ * hq login — opens browser for Cognito auth.
  */
 import { Command } from 'commander';
 export declare function registerLoginCommand(program: Command): void;

package/dist/commands/login.js

@@ -1,11 +1,11 @@
 /**
- * hq login — opens browser for Cognito auth via Google OAuth
+ * hq login — opens browser for Cognito auth.
  */
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="31735154-208b-5544-85a4-22f8f0fbe415")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="cb1c9acd-d4b0-52a2-b5ce-f567be9ff048")}catch(e){}}();
 import chalk from 'chalk';
 import { browserLogin, loadCachedTokens, isExpiring } from '@indigoai-us/hq-cloud';
-import { DEFAULT_COGNITO } from '../utils/cognito-session.js';
+import { cognitoConfigForLoginProvider } from '../utils/login-provider.js';
 function peekIdToken(idToken) {
     try {
         const payload = idToken.split('.')[1];
@@ -23,8 +23,9 @@ function peekIdToken(idToken) {
 export function registerLoginCommand(program) {
     program
         .command('login')
-        .description('Authenticate with HQ via Cognito (Google OAuth)')
-        .action(async () => {
+        .description('Authenticate with HQ via Cognito')
+        .option('--provider <provider>', 'OAuth provider to use: google, microsoft, or picker')
+        .action(async (options) => {
         try {
             const existing = loadCachedTokens();
             if (existing && !isExpiring(existing, 120)) {
@@ -33,7 +34,7 @@ export function registerLoginCommand(program) {
                 return;
             }
             console.log('Opening browser for authentication...');
-            const tokens = await browserLogin(DEFAULT_COGNITO);
+            const tokens = await browserLogin(cognitoConfigForLoginProvider(options.provider));
             const who = peekIdToken(tokens.idToken).email ?? 'HQ';
             console.log(chalk.green(`Logged in as ${who}`));
         }
@@ -44,4 +45,4 @@ export function registerLoginCommand(program) {
     });
 }
 //# sourceMappingURL=login.js.map
-//# debugId=31735154-208b-5544-85a4-22f8f0fbe415
+//# debugId=cb1c9acd-d4b0-52a2-b5ce-f567be9ff048

package/dist/commands/pack-install.js

@@ -34,7 +34,7 @@
  * from each pack's package.yaml; rationale lives in the layout-fix PR.)
  */
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="dafe45c8-d9bb-5082-b5b7-aaf1a2ee5c7e")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="d5029b6f-fc42-52ea-9ddd-aaaae682a8f4")}catch(e){}}();
 import * as fs from 'fs';
 import * as os from 'os';
 import * as path from 'path';
@@ -263,20 +263,45 @@ export function defaultMarketplaceDeps() {
     return {
         resolveListing: async (slug, version) => {
             // Search by slug (public). The API returns approved listings only.
+            //
+            // BUGFIX: the browse handler historically IGNORED `?slug=` and only
+            // honored `?q=` (fuzzy), so `?slug=tdd` returned ALL approved listings
+            // newest-first — and blindly taking `listings[0]` then installed the
+            // newest pack, not the requested slug (e.g. `marketplace:tdd` installed
+            // hq-pack-review). We now (a) query with BOTH `slug` (exact, server-side
+            // filter being added in parallel) AND `q` (fuzzy fallback) so the right
+            // results come back whichever param the server honors, and (b) NEVER take
+            // `listings[0]` — we exact-match `l.slug === slug` among the results and
+            // throw a clear error if none matches, rather than installing the wrong
+            // pack.
+            const query = { slug, q: slug };
+            if (version)
+                query.version = version;
             const res = await vaultApiFetchPublic({
                 path: '/v1/listings',
-                query: version ? { slug, version } : { slug },
+                query,
             });
             if (!res.ok) {
                 throw new Error(`Failed to search marketplace for "${slug}" (HTTP ${res.status}).`);
             }
             const body = (await res.json().catch(() => ({})));
             const listings = body.listings ?? [];
-            const match = version
-                ? listings.find((l) => (l.version ?? l.latestVersion) === version)
-                : listings[0];
+            // Only consider listings whose slug EXACTLY matches the request — the
+            // fuzzy `q` search (and a slug-ignoring browse handler) can return
+            // unrelated packs, so an exact-slug filter is the safety floor.
+            const exact = listings.filter((l) => l.slug === slug);
+            let match;
+            if (version) {
+                // Pinned `marketplace:<slug>@<version>` → require an exact version too.
+                match = exact.find((l) => (l.version ?? l.latestVersion) === version);
+            }
+            else {
+                // No pin → newest exact-slug match. The feed is newest-first, so the
+                // first exact-slug entry is the newest version of that slug.
+                match = exact[0];
+            }
             if (!match) {
-                throw new Error(`No approved marketplace listing found for "${slug}"${version ? `@${version}` : ''}.`);
+                throw new Error(`No marketplace listing found for slug "${slug}"${version ? `@${version}` : ''}.`);
             }
             const id = match.listingId ?? match.id;
             if (!id)
@@ -726,7 +751,12 @@ export function validateManifest(payloadDir, hqVersion) {
     if (!range || !semverValidRange(range)) {
         throw new Error(`requires.hqCore must be a valid semver range (got "${range}")`);
     }
-    if (hqVersion && !semverSatisfies(hqVersion, range)) {
+    // `includePrerelease` so a prerelease host version (e.g. `15.0.9-beta.1`)
+    // satisfies a plain range like `>=14.2.0`. By default node-semver excludes
+    // prereleases from range matching, which would wrongly reject every dogfooding
+    // beta/rc HQ build from installing packs. A genuinely-too-old host (e.g.
+    // `13.0.0`) still fails the range.
+    if (hqVersion && !semverSatisfies(hqVersion, range, { includePrerelease: true })) {
         throw new Error(`Host hqCore ${hqVersion} does not satisfy pack requirement ${range}`);
     }
     // 7. contributes has at least one non-empty subfield
@@ -1051,4 +1081,4 @@ export async function installPack(source, opts = {}) {
     }
 }
 //# sourceMappingURL=pack-install.js.map
-//# debugId=dafe45c8-d9bb-5082-b5b7-aaf1a2ee5c7e
+//# debugId=d5029b6f-fc42-52ea-9ddd-aaaae682a8f4

package/dist/commands/publish.js

@@ -28,7 +28,7 @@
  *   - manifest.ts (modules.yaml read/write for provenance)
  */
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="73704bc7-d7b1-5c4c-a34e-54edadcc2753")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="f5046847-a2b9-50e4-9a68-6a81a9e0de2b")}catch(e){}}();
 import * as fs from 'fs';
 import * as os from 'os';
 import * as path from 'path';
@@ -237,6 +237,12 @@ export function buildListingNotice(status, body, packName, packVersion) {
             `Bump the version in package.yaml and re-run \`hq publish\`.`);
     }
     if (status === 401 || status === 403) {
+        const code = typeof body.code === 'string' ? body.code : '';
+        if (code === 'NOT_VERIFIED_CREATOR') {
+            throw new Error('Only verified creators can publish to the marketplace. ' +
+                'Run `hq creators apply --reason "..."` to request verified-creator access; ' +
+                'an Indigo admin will review it.');
+        }
         throw new Error('Not authorized to publish — run `hq login` and ensure your creator account is verified.');
     }
     if (status < 200 || status >= 300) {
@@ -372,4 +378,4 @@ export function registerPublishCommand(program) {
     });
 }
 //# sourceMappingURL=publish.js.map
-//# debugId=73704bc7-d7b1-5c4c-a34e-54edadcc2753
+//# debugId=f5046847-a2b9-50e4-9a68-6a81a9e0de2b

package/dist/index.js

@@ -3,7 +3,7 @@
  * HQ CLI - Module management, package management, and cloud sync for HQ
  */
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="202089d2-b89b-5779-aa66-f88531a9b893")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="6fa5c878-2930-5b94-bc7c-5deea8795218")}catch(e){}}();
 import { Command } from "commander";
 import { initSentry, Sentry } from "./sentry.js";
 import { registerAddCommand } from "./commands/add.js";
@@ -25,6 +25,7 @@ import { registerPackageUpdateCommand } from "./commands/pkg-update.js";
 import { registerPackageListCommand } from "./commands/pkg-list.js";
 import { registerPacksCommand } from "./commands/packs.js";
 import { registerPublishCommand } from "./commands/publish.js";
+import { registerCreatorsCommand } from "./commands/creators.js";
 import { registerTeamSyncCommand } from "./commands/team-sync.js";
 import { registerAuthCommands } from "./commands/auth.js";
 import { registerSecretsCommand } from "./commands/secrets.js";
@@ -91,6 +92,8 @@ registerPackageRemoveCommand(program);
 // "hq publish <skill-or-worker-path>" packages and submits a pack to the
 // marketplace via POST /v1/listings.
 registerPublishCommand(program);
+// `hq creators apply` — request verified-creator access (required to publish).
+registerCreatorsCommand(program);
 // Cloud sync subcommand group
 const syncCmd = program
     .command("sync")
@@ -174,4 +177,4 @@ registerRescueCommand(program);
     }
 })();
 //# sourceMappingURL=index.js.map
-//# debugId=202089d2-b89b-5779-aa66-f88531a9b893
+//# debugId=6fa5c878-2930-5b94-bc7c-5deea8795218

package/dist/utils/login-provider.d.ts

@@ -0,0 +1,11 @@
+import type { CognitoAuthConfig } from "@indigoai-us/hq-cloud";
+declare const PROVIDER_TO_COGNITO_IDP: {
+    readonly google: "Google";
+    readonly microsoft: "MicrosoftPersonal";
+    readonly picker: undefined;
+};
+export type LoginProvider = keyof typeof PROVIDER_TO_COGNITO_IDP;
+export declare function parseLoginProvider(value: string | undefined): LoginProvider | undefined;
+export declare function cognitoConfigForLoginProvider(value: string | undefined): CognitoAuthConfig;
+export {};
+//# sourceMappingURL=login-provider.d.ts.map

package/dist/utils/login-provider.js

@@ -0,0 +1,28 @@
+
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="10f78162-e7f8-5295-a572-936ae454ad62")}catch(e){}}();
+import { DEFAULT_COGNITO } from "./cognito-session.js";
+const PROVIDER_TO_COGNITO_IDP = {
+    google: "Google",
+    microsoft: "MicrosoftPersonal",
+    picker: undefined,
+};
+export function parseLoginProvider(value) {
+    if (value === undefined)
+        return undefined;
+    const normalized = value.trim().toLowerCase();
+    if (normalized in PROVIDER_TO_COGNITO_IDP) {
+        return normalized;
+    }
+    throw new Error("Provider must be one of: google, microsoft, picker");
+}
+export function cognitoConfigForLoginProvider(value) {
+    const provider = parseLoginProvider(value);
+    if (!provider)
+        return DEFAULT_COGNITO;
+    return {
+        ...DEFAULT_COGNITO,
+        identityProvider: PROVIDER_TO_COGNITO_IDP[provider],
+    };
+}
+//# sourceMappingURL=login-provider.js.map
+//# debugId=10f78162-e7f8-5295-a572-936ae454ad62

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.35.0",
-  "description": "HQ by Indigo management CLI — modules and cloud sync",
+  "version": "5.35.2",
+  "description": "HQ by Indigo management CLI \u2014 modules and cloud sync",
   "main": "dist/index.js",
   "bin": {
     "hq": "dist/index.js",
@@ -15,7 +15,7 @@
     "clean": "rm -rf dist"
   },
   "dependencies": {
-    "@indigoai-us/hq-cloud": "^6.0.0",
+    "@indigoai-us/hq-cloud": "^6.0.1",
     "@indigoai-us/hq-onboarding": "^0.1.0",
     "@sentry/node": "^10.49.0",
     "chalk": "^5.3.0",

package/src/commands/auth.ts

@@ -27,6 +27,7 @@ import {
   DEFAULT_COGNITO,
   refreshCachedSession,
 } from "../utils/cognito-session.js";
+import { cognitoConfigForLoginProvider } from "../utils/login-provider.js";
 
 /**
  * Decode the (unverified) ID token payload for display purposes only.
@@ -62,7 +63,11 @@ export function registerAuthCommands(program: Command): void {
     .description(
       "Sign in to HQ — opens the Cognito Hosted UI and caches tokens locally",
     )
-    .action(async () => {
+    .option(
+      "--provider <provider>",
+      "OAuth provider to use: google, microsoft, or picker",
+    )
+    .action(async (options: { provider?: string }) => {
       const existing = loadCachedTokens();
       if (existing && !isExpiring(existing, 120)) {
         const who = peekIdToken(existing.idToken).email ?? "cached session";
@@ -72,7 +77,7 @@ export function registerAuthCommands(program: Command): void {
         return;
       }
       try {
-        const tokens = await browserLogin(DEFAULT_COGNITO);
+        const tokens = await browserLogin(cognitoConfigForLoginProvider(options.provider));
         const who = peekIdToken(tokens.idToken).email ?? "HQ";
         console.log(chalk.green(`Signed in as ${who}`));
         console.log(