@indigoai-us/hq-cli 5.4.0 → 5.5.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (15) hide show
  1. package/dist/commands/cloud.d.ts +12 -2
  2. package/dist/commands/cloud.d.ts.map +1 -1
  3. package/dist/commands/cloud.js +112 -80
  4. package/dist/commands/cloud.js.map +1 -1
  5. package/dist/index.js +5 -2
  6. package/dist/index.js.map +1 -1
  7. package/dist/utils/cognito-session.d.ts +18 -7
  8. package/dist/utils/cognito-session.d.ts.map +1 -1
  9. package/dist/utils/cognito-session.js +35 -8
  10. package/dist/utils/cognito-session.js.map +1 -1
  11. package/package.json +10 -3
  12. package/src/commands/cloud.ts +214 -101
  13. package/src/commands/onboard.ts +193 -0
  14. package/src/index.ts +6 -2
  15. package/src/utils/cognito-session.ts +46 -14
package/dist/commands/cloud.d.ts CHANGED
@@ -1,6 +1,16 @@
1
1
  /**
2
- * hq sync commands — cloud sync management
3
- * Bridges hq-cli to @indigoai-us/hq-cloud
2
+ * `hq sync` commands — push/pull files between the local HQ tree and the
3
+ * company's S3 vault bucket.
4
+ *
5
+ * VLT-5 model: each command resolves a Cognito access token, asks
6
+ * vault-service for the company's bucket + STS-vended credentials, and
7
+ * runs the operation. No daemon, no init step (handled by `hq onboard`),
8
+ * no long-lived background process — every invocation is self-contained.
9
+ *
10
+ * Subcommands:
11
+ * hq sync push [paths...] — broadcast local file(s) to the vault
12
+ * hq sync pull — pull all permitted files from the vault
13
+ * hq sync status — show local journal summary
4
14
  */
5
15
  import { Command } from "commander";
6
16
  export declare function registerCloudCommands(program: Command): void;
package/dist/commands/cloud.d.ts.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"cloud.d.ts","sourceRoot":"","sources":["../../src/commands/cloud.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAGpC,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAoH5D"}
1
+ {"version":3,"file":"cloud.d.ts","sourceRoot":"","sources":["../../src/commands/cloud.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAwBpC,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CA2L5D"}
package/dist/commands/cloud.js CHANGED
@@ -1,106 +1,138 @@
1
1
  /**
2
- * hq sync commands — cloud sync management
3
- * Bridges hq-cli to @indigoai-us/hq-cloud
2
+ * `hq sync` commands — push/pull files between the local HQ tree and the
3
+ * company's S3 vault bucket.
4
+ *
5
+ * VLT-5 model: each command resolves a Cognito access token, asks
6
+ * vault-service for the company's bucket + STS-vended credentials, and
7
+ * runs the operation. No daemon, no init step (handled by `hq onboard`),
8
+ * no long-lived background process — every invocation is self-contained.
9
+ *
10
+ * Subcommands:
11
+ * hq sync push [paths...] — broadcast local file(s) to the vault
12
+ * hq sync pull — pull all permitted files from the vault
13
+ * hq sync status — show local journal summary
4
14
  */
5
- import { findHqRoot } from "../utils/manifest.js";
15
+ import chalk from "chalk";
16
+ import * as fs from "fs";
17
+ import * as path from "path";
18
+ import { share, sync, readJournal, getJournalPath, } from "@indigoai-us/hq-cloud";
19
+ import { DEFAULT_HQ_ROOT, ensureCognitoToken, buildVaultConfig, } from "../utils/cognito-session.js";
6
20
  export function registerCloudCommands(program) {
7
21
  program
8
- .command("init")
9
- .description("Authenticate with IndigoAI and set up cloud sync")
10
- .action(async () => {
11
- try {
12
- const hqRoot = findHqRoot();
13
- const { initSync } = await import("@indigoai-us/hq-cloud");
14
- await initSync(hqRoot);
15
- }
16
- catch (error) {
17
- console.error("Error:", error instanceof Error ? error.message : error);
18
- process.exit(1);
19
- }
20
- });
21
- program
22
- .command("start")
23
- .description("Start the background sync daemon")
24
- .action(async () => {
22
+ .command("push")
23
+ .description("Push local file(s) to the company vault on S3")
24
+ .argument("[paths...]", "Paths to push (defaults to current directory)")
25
+ .option("--hq-root <path>", `Local HQ tree root (default: ${DEFAULT_HQ_ROOT})`, DEFAULT_HQ_ROOT)
26
+ .option("--company <slug>", "Company slug or UID (defaults to active company in .hq/config.json)")
27
+ .option("--message <msg>", "Optional message attached to journal entries for these uploads")
28
+ .option("--on-conflict <strategy>", "Conflict strategy: overwrite | keep | abort (omit for interactive)")
29
+ .action(async (paths, options) => {
25
30
  try {
26
- const hqRoot = findHqRoot();
27
- const { startDaemon } = await import("@indigoai-us/hq-cloud");
28
- await startDaemon(hqRoot);
29
- console.log("Sync daemon started. Use 'hq sync status' to check.");
31
+ const targetPaths = paths && paths.length > 0 ? paths : [process.cwd()];
32
+ console.log(chalk.bold("\nHQ Sync — Push"));
33
+ console.log(` HQ root: ${options.hqRoot}`);
34
+ console.log(` Company: ${options.company ?? "(from .hq/config.json)"}`);
35
+ console.log(` Paths: ${targetPaths.join(", ")}\n`);
36
+ const accessToken = await ensureCognitoToken();
37
+ const result = await share({
38
+ paths: targetPaths,
39
+ company: options.company,
40
+ message: options.message,
41
+ onConflict: options.onConflict,
42
+ vaultConfig: buildVaultConfig(accessToken),
43
+ hqRoot: options.hqRoot,
44
+ });
45
+ if (result.aborted) {
46
+ console.log(chalk.yellow(`\n⚠ Push aborted (${result.filesUploaded} uploaded, ${result.filesSkipped} skipped)`));
47
+ process.exit(1);
48
+ }
49
+ console.log(chalk.green(`\n✓ Pushed ${result.filesUploaded} file(s) (${formatBytes(result.bytesUploaded)}, ${result.filesSkipped} skipped)`));
30
50
  }
31
- catch (error) {
32
- console.error("Error:", error instanceof Error ? error.message : error);
51
+ catch (err) {
52
+ console.error(chalk.red("\n✗ Push failed:"), err instanceof Error ? err.message : String(err));
33
53
  process.exit(1);
34
54
  }
35
55
  });
36
56
  program
37
- .command("stop")
38
- .description("Stop the sync daemon")
39
- .action(async () => {
57
+ .command("pull")
58
+ .description("Pull permitted files from the company vault to local HQ")
59
+ .option("--hq-root <path>", `Local HQ tree root (default: ${DEFAULT_HQ_ROOT})`, DEFAULT_HQ_ROOT)
60
+ .option("--company <slug>", "Company slug or UID (defaults to active company in .hq/config.json)")
61
+ .option("--on-conflict <strategy>", "Conflict strategy: overwrite | keep | abort (omit for interactive)")
62
+ .action(async (options) => {
40
63
  try {
41
- const hqRoot = findHqRoot();
42
- const { stopDaemon } = await import("@indigoai-us/hq-cloud");
43
- await stopDaemon(hqRoot);
44
- console.log("Sync daemon stopped.");
64
+ console.log(chalk.bold("\nHQ Sync — Pull"));
65
+ console.log(` HQ root: ${options.hqRoot}`);
66
+ console.log(` Company: ${options.company ?? "(from .hq/config.json)"}\n`);
67
+ const accessToken = await ensureCognitoToken();
68
+ const result = await sync({
69
+ company: options.company,
70
+ onConflict: options.onConflict,
71
+ vaultConfig: buildVaultConfig(accessToken),
72
+ hqRoot: options.hqRoot,
73
+ });
74
+ if (result.aborted) {
75
+ console.log(chalk.yellow(`\n⚠ Pull aborted (${result.filesDownloaded} downloaded, ${result.filesSkipped} skipped, ${result.conflicts} conflicts)`));
76
+ process.exit(1);
77
+ }
78
+ console.log(chalk.green(`\n✓ Pulled ${result.filesDownloaded} file(s) (${formatBytes(result.bytesDownloaded)}, ${result.filesSkipped} skipped, ${result.conflicts} conflicts)`));
45
79
  }
46
- catch (error) {
47
- console.error("Error:", error instanceof Error ? error.message : error);
80
+ catch (err) {
81
+ console.error(chalk.red("\n✗ Pull failed:"), err instanceof Error ? err.message : String(err));
48
82
  process.exit(1);
49
83
  }
50
84
  });
51
85
  program
52
86
  .command("status")
53
- .description("Show sync status")
54
- .action(async () => {
87
+ .description("Show local sync journal summary")
88
+ .option("--hq-root <path>", `Local HQ tree root (default: ${DEFAULT_HQ_ROOT})`, DEFAULT_HQ_ROOT)
89
+ .action((options) => {
55
90
  try {
56
- const hqRoot = findHqRoot();
57
- const { getStatus } = await import("@indigoai-us/hq-cloud");
58
- const status = await getStatus(hqRoot);
59
- console.log(` State: ${status.running ? "running" : "stopped"}`);
60
- console.log(` Last sync: ${status.lastSync || "never"}`);
61
- console.log(` Files: ${status.fileCount} tracked`);
62
- console.log(` Bucket: ${status.bucket || "not configured"}`);
63
- if (status.errors.length > 0) {
64
- console.log(` Errors: ${status.errors.length}`);
65
- for (const err of status.errors.slice(0, 5)) {
66
- console.log(` - ${err}`);
91
+ const journalPath = getJournalPath(options.hqRoot);
92
+ if (!fs.existsSync(journalPath)) {
93
+ console.log(chalk.dim("No sync journal yet — run `hq sync push` or `hq sync pull` to create one."));
94
+ console.log(chalk.dim(` Expected at: ${journalPath}`));
95
+ return;
96
+ }
97
+ const journal = readJournal(options.hqRoot);
98
+ const entries = Object.entries(journal.files ?? {});
99
+ const lastSyncTimes = entries
100
+ .map(([, entry]) => entry.syncedAt)
101
+ .filter((t) => typeof t === "string")
102
+ .sort();
103
+ const lastSync = lastSyncTimes.at(-1) ?? "never";
104
+ const totalBytes = entries.reduce((acc, [, entry]) => acc + (entry.size ?? 0), 0);
105
+ const configPath = path.join(options.hqRoot, ".hq", "config.json");
106
+ let activeCompany;
107
+ if (fs.existsSync(configPath)) {
108
+ try {
109
+ const cfg = JSON.parse(fs.readFileSync(configPath, "utf-8"));
110
+ activeCompany = cfg.activeCompany;
111
+ }
112
+ catch {
113
+ // ignore
67
114
  }
68
115
  }
116
+ console.log(chalk.bold("\nHQ Sync — Status"));
117
+ console.log(` HQ root: ${options.hqRoot}`);
118
+ console.log(` Active company: ${activeCompany ?? chalk.dim("(none)")}`);
119
+ console.log(` Tracked files: ${entries.length}`);
120
+ console.log(` Total size: ${formatBytes(totalBytes)}`);
121
+ console.log(` Last sync: ${lastSync}`);
122
+ console.log(` Journal: ${journalPath}`);
69
123
  }
70
- catch (error) {
71
- console.error("Error:", error instanceof Error ? error.message : error);
72
- process.exit(1);
73
- }
74
- });
75
- program
76
- .command("push")
77
- .description("Force push all local changes to cloud")
78
- .action(async () => {
79
- try {
80
- const hqRoot = findHqRoot();
81
- const { pushAll } = await import("@indigoai-us/hq-cloud");
82
- const result = await pushAll(hqRoot);
83
- console.log(`Pushed ${result.filesUploaded} files to cloud.`);
84
- }
85
- catch (error) {
86
- console.error("Error:", error instanceof Error ? error.message : error);
87
- process.exit(1);
88
- }
89
- });
90
- program
91
- .command("pull")
92
- .description("Force pull all cloud changes to local")
93
- .action(async () => {
94
- try {
95
- const hqRoot = findHqRoot();
96
- const { pullAll } = await import("@indigoai-us/hq-cloud");
97
- const result = await pullAll(hqRoot);
98
- console.log(`Pulled ${result.filesDownloaded} files from cloud.`);
99
- }
100
- catch (error) {
101
- console.error("Error:", error instanceof Error ? error.message : error);
124
+ catch (err) {
125
+ console.error(chalk.red("✗ Status failed:"), err instanceof Error ? err.message : String(err));
102
126
  process.exit(1);
103
127
  }
104
128
  });
105
129
  }
130
+ function formatBytes(bytes) {
131
+ if (bytes === 0)
132
+ return "0 B";
133
+ const units = ["B", "KB", "MB", "GB"];
134
+ const exponent = Math.min(Math.floor(Math.log(bytes) / Math.log(1024)), units.length - 1);
135
+ const value = bytes / Math.pow(1024, exponent);
136
+ return `${value.toFixed(value >= 100 || exponent === 0 ? 0 : 1)} ${units[exponent]}`;
137
+ }
106
138
  //# sourceMappingURL=cloud.js.map
package/dist/commands/cloud.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"cloud.js","sourceRoot":"","sources":["../../src/commands/cloud.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAElD,MAAM,UAAU,qBAAqB,CAAC,OAAgB;IACpD,OAAO;SACJ,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,kDAAkD,CAAC;SAC/D,MAAM,CAAC,KAAK,IAAI,EAAE;QACjB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;YAC5B,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;YAC3D,MAAM,QAAQ,CAAC,MAAM,CAAC,CAAC;QACzB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CACX,QAAQ,EACR,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAC/C,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,OAAO;SACJ,OAAO,CAAC,OAAO,CAAC;SAChB,WAAW,CAAC,kCAAkC,CAAC;SAC/C,MAAM,CAAC,KAAK,IAAI,EAAE;QACjB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;YAC5B,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;YAC9D,MAAM,WAAW,CAAC,MAAM,CAAC,CAAC;YAC1B,OAAO,CAAC,GAAG,CAAC,qDAAqD,CAAC,CAAC;QACrE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CACX,QAAQ,EACR,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAC/C,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,OAAO;SACJ,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,sBAAsB,CAAC;SACnC,MAAM,CAAC,KAAK,IAAI,EAAE;QACjB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;YAC5B,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;YAC7D,MAAM,UAAU,CAAC,MAAM,CAAC,CAAC;YACzB,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;QACtC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CACX,QAAQ,EACR,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAC/C,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,OAAO;SACJ,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,kBAAkB,CAAC;SAC/B,MAAM,CAAC,KAAK,IAAI,EAAE;QACjB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;YAC5B,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;YAC5D,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,CAAC;YACvC,OAAO,CAAC,GAAG,CAAC,iBAAiB,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;YACvE,OAAO,CAAC,GAAG,CAAC,iBAAiB,MAAM,CAAC,QAAQ,IAAI,OAAO,EAAE,CAAC,CAAC;YAC3D,OAAO,CAAC,GAAG,CAAC,iBAAiB,MAAM,CAAC,SAAS,UAAU,CAAC,CAAC;YACzD,OAAO,CAAC,GAAG,CAAC,iBAAiB,MAAM,CAAC,MAAM,IAAI,gBAAgB,EAAE,CAAC,CAAC;YAClE,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC7B,OAAO,CAAC,GAAG,CAAC,iBAAiB,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;gBACrD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;oBAC5C,OAAO,CAAC,GAAG,CAAC,SAAS,GAAG,EAAE,CAAC,CAAC;gBAC9B,CAAC;YACH,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CACX,QAAQ,EACR,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAC/C,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,OAAO;SACJ,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,uCAAuC,CAAC;SACpD,MAAM,CAAC,KAAK,IAAI,EAAE;QACjB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;YAC5B,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;YAC1D,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;YACrC,OAAO,CAAC,GAAG,CAAC,UAAU,MAAM,CAAC,aAAa,kBAAkB,CAAC,CAAC;QAChE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CACX,QAAQ,EACR,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAC/C,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,OAAO;SACJ,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,uCAAuC,CAAC;SACpD,MAAM,CAAC,KAAK,IAAI,EAAE;QACjB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;YAC5B,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;YAC1D,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;YACrC,OAAO,CAAC,GAAG,CAAC,UAAU,MAAM,CAAC,eAAe,oBAAoB,CAAC,CAAC;QACpE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CACX,QAAQ,EACR,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAC/C,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC"}
1
+ {"version":3,"file":"cloud.js","sourceRoot":"","sources":["../../src/commands/cloud.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAGH,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAE7B,OAAO,EACL,KAAK,EACL,IAAI,EACJ,WAAW,EACX,cAAc,GAEf,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EACL,eAAe,EACf,kBAAkB,EAClB,gBAAgB,GACjB,MAAM,6BAA6B,CAAC;AAOrC,MAAM,UAAU,qBAAqB,CAAC,OAAgB;IACpD,OAAO;SACJ,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,+CAA+C,CAAC;SAC5D,QAAQ,CAAC,YAAY,EAAE,+CAA+C,CAAC;SACvE,MAAM,CACL,kBAAkB,EAClB,gCAAgC,eAAe,GAAG,EAClD,eAAe,CAChB;SACA,MAAM,CACL,kBAAkB,EAClB,qEAAqE,CACtE;SACA,MAAM,CACL,iBAAiB,EACjB,gEAAgE,CACjE;SACA,MAAM,CACL,0BAA0B,EAC1B,oEAAoE,CACrE;SACA,MAAM,CACL,KAAK,EACH,KAAe,EACf,OAGC,EACD,EAAE;QACF,IAAI,CAAC;YACH,MAAM,WAAW,GACf,KAAK,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;YAEtD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,CAAC;YAC5C,OAAO,CAAC,GAAG,CAAC,eAAe,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;YAC7C,OAAO,CAAC,GAAG,CAAC,eAAe,OAAO,CAAC,OAAO,IAAI,wBAAwB,EAAE,CAAC,CAAC;YAC1E,OAAO,CAAC,GAAG,CAAC,eAAe,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAEvD,MAAM,WAAW,GAAG,MAAM,kBAAkB,EAAE,CAAC;YAC/C,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC;gBACzB,KAAK,EAAE,WAAW;gBAClB,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,WAAW,EAAE,gBAAgB,CAAC,WAAW,CAAC;gBAC1C,MAAM,EAAE,OAAO,CAAC,MAAM;aACvB,CAAC,CAAC;YAEH,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;gBACnB,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,MAAM,CACV,qBAAqB,MAAM,CAAC,aAAa,cAAc,MAAM,CAAC,YAAY,WAAW,CACtF,CACF,CAAC;gBACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;YAED,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,KAAK,CACT,cAAc,MAAM,CAAC,aAAa,aAAa,WAAW,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,MAAM,CAAC,YAAY,WAAW,CACpH,CACF,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CACX,KAAK,CAAC,GAAG,CAAC,kBAAkB,CAAC,EAC7B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CACjD,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CACF,CAAC;IAEJ,OAAO;SACJ,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,yDAAyD,CAAC;SACtE,MAAM,CACL,kBAAkB,EAClB,gCAAgC,eAAe,GAAG,EAClD,eAAe,CAChB;SACA,MAAM,CACL,kBAAkB,EAClB,qEAAqE,CACtE;SACA,MAAM,CACL,0BAA0B,EAC1B,oEAAoE,CACrE;SACA,MAAM,CACL,KAAK,EACH,OAEC,EACD,EAAE;QACF,IAAI,CAAC;YACH,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,CAAC;YAC5C,OAAO,CAAC,GAAG,CAAC,eAAe,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;YAC7C,OAAO,CAAC,GAAG,CAAC,eAAe,OAAO,CAAC,OAAO,IAAI,wBAAwB,IAAI,CAAC,CAAC;YAE5E,MAAM,WAAW,GAAG,MAAM,kBAAkB,EAAE,CAAC;YAC/C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC;gBACxB,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,WAAW,EAAE,gBAAgB,CAAC,WAAW,CAAC;gBAC1C,MAAM,EAAE,OAAO,CAAC,MAAM;aACvB,CAAC,CAAC;YAEH,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;gBACnB,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,MAAM,CACV,qBAAqB,MAAM,CAAC,eAAe,gBAAgB,MAAM,CAAC,YAAY,aAAa,MAAM,CAAC,SAAS,aAAa,CACzH,CACF,CAAC;gBACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;YAED,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,KAAK,CACT,cAAc,MAAM,CAAC,eAAe,aAAa,WAAW,CAAC,MAAM,CAAC,eAAe,CAAC,KAAK,MAAM,CAAC,YAAY,aAAa,MAAM,CAAC,SAAS,aAAa,CACvJ,CACF,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CACX,KAAK,CAAC,GAAG,CAAC,kBAAkB,CAAC,EAC7B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CACjD,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CACF,CAAC;IAEJ,OAAO;SACJ,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,iCAAiC,CAAC;SAC9C,MAAM,CACL,kBAAkB,EAClB,gCAAgC,eAAe,GAAG,EAClD,eAAe,CAChB;SACA,MAAM,CAAC,CAAC,OAA2B,EAAE,EAAE;QACtC,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,cAAc,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YACnD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;gBAChC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,2EAA2E,CAAC,CAAC,CAAC;gBACpG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,kBAAkB,WAAW,EAAE,CAAC,CAAC,CAAC;gBACxD,OAAO;YACT,CAAC;YAED,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YAC5C,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;YACpD,MAAM,aAAa,GAAG,OAAO;iBAC1B,GAAG,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC;iBAClC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;iBACjD,IAAI,EAAE,CAAC;YACV,MAAM,QAAQ,GAAG,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC;YACjD,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAC/B,CAAC,GAAG,EAAE,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC,EAC3C,CAAC,CACF,CAAC;YAEF,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,EAAE,aAAa,CAAC,CAAC;YACnE,IAAI,aAAiC,CAAC;YACtC,IAAI,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC9B,IAAI,CAAC;oBACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;oBAC7D,aAAa,GAAG,GAAG,CAAC,aAAa,CAAC;gBACpC,CAAC;gBAAC,MAAM,CAAC;oBACP,SAAS;gBACX,CAAC;YACH,CAAC;YAED,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,CAAC;YAC9C,OAAO,CAAC,GAAG,CAAC,qBAAqB,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;YACnD,OAAO,CAAC,GAAG,CAAC,qBAAqB,aAAa,IAAI,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;YACzE,OAAO,CAAC,GAAG,CAAC,qBAAqB,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;YACnD,OAAO,CAAC,GAAG,CAAC,qBAAqB,WAAW,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;YAC5D,OAAO,CAAC,GAAG,CAAC,qBAAqB,QAAQ,EAAE,CAAC,CAAC;YAC7C,OAAO,CAAC,GAAG,CAAC,qBAAqB,WAAW,EAAE,CAAC,CAAC;QAClD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CACX,KAAK,CAAC,GAAG,CAAC,kBAAkB,CAAC,EAC7B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CACjD,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC;AAED,SAAS,WAAW,CAAC,KAAa;IAChC,IAAI,KAAK,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9B,MAAM,KAAK,GAAG,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACtC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CACvB,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,EAC5C,KAAK,CAAC,MAAM,GAAG,CAAC,CACjB,CAAC;IACF,MAAM,KAAK,GAAG,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC/C,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,IAAI,GAAG,IAAI,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;AACvF,CAAC"}
package/dist/index.js CHANGED
@@ -11,6 +11,7 @@ import { registerCloudCommands } from "./commands/cloud.js";
11
11
  import { registerLoginCommand } from "./commands/login.js";
12
12
  import { registerLogoutCommand } from "./commands/logout.js";
13
13
  import { registerWhoamiCommand } from "./commands/whoami.js";
14
+ import { registerOnboardCommand } from "./commands/onboard.js";
14
15
  import { registerPackageInstallCommand } from "./commands/pkg-install.js";
15
16
  import { registerPackageRemoveCommand } from "./commands/pkg-remove.js";
16
17
  import { registerPackageUpdateCommand } from "./commands/pkg-update.js";
@@ -21,7 +22,7 @@ const program = new Command();
21
22
  program
22
23
  .name("hq")
23
24
  .description("HQ management CLI — modules, packages, and cloud sync")
24
- .version("5.4.0");
25
+ .version("5.5.0");
25
26
  // Module management subcommand group
26
27
  const modulesCmd = program
27
28
  .command("modules")
@@ -50,10 +51,12 @@ const syncCmd = program
50
51
  registerCloudCommands(syncCmd);
51
52
  // Team commands (top-level)
52
53
  registerTeamSyncCommand(program);
53
- // Auth commands (top-level)
54
+ // Auth commands (top-level — registry auth via Clerk, separate from Cognito)
54
55
  registerLoginCommand(program);
55
56
  registerLogoutCommand(program);
56
57
  registerWhoamiCommand(program);
57
58
  registerAuthCommands(program);
59
+ // Onboarding (top-level — Cognito + vault-service provisioning)
60
+ registerOnboardCommand(program);
58
61
  program.parse();
59
62
  //# sourceMappingURL=index.js.map
package/dist/index.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAEA;;GAEG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EAAE,6BAA6B,EAAE,MAAM,2BAA2B,CAAC;AAC1E,OAAO,EAAE,4BAA4B,EAAE,MAAM,0BAA0B,CAAC;AACxE,OAAO,EAAE,4BAA4B,EAAE,MAAM,0BAA0B,CAAC;AACxE,OAAO,EAAE,0BAA0B,EAAE,MAAM,wBAAwB,CAAC;AACpE,OAAO,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AAClE,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAE1D,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;AAE9B,OAAO;KACJ,IAAI,CAAC,IAAI,CAAC;KACV,WAAW,CAAC,uDAAuD,CAAC;KACpE,OAAO,CAAC,OAAO,CAAC,CAAC;AAEpB,qCAAqC;AACrC,MAAM,UAAU,GAAG,OAAO;KACvB,OAAO,CAAC,SAAS,CAAC;KAClB,WAAW,CAAC,4BAA4B,CAAC,CAAC;AAE7C,kBAAkB,CAAC,UAAU,CAAC,CAAC;AAC/B,mBAAmB,CAAC,UAAU,CAAC,CAAC;AAChC,mBAAmB,CAAC,UAAU,CAAC,CAAC;AAChC,qBAAqB,CAAC,UAAU,CAAC,CAAC;AAElC,sCAAsC;AACtC,MAAM,WAAW,GAAG,OAAO;KACxB,OAAO,CAAC,UAAU,CAAC;KACnB,WAAW,CAAC,6BAA6B,CAAC,CAAC;AAE9C,6BAA6B,CAAC,WAAW,CAAC,CAAC;AAC3C,4BAA4B,CAAC,WAAW,CAAC,CAAC;AAC1C,4BAA4B,CAAC,WAAW,CAAC,CAAC;AAC1C,0BAA0B,CAAC,WAAW,CAAC,CAAC;AAExC,2CAA2C;AAC3C,qDAAqD;AACrD,oDAAoD;AACpD,6BAA6B,CAAC,OAAO,CAAC,CAAC;AACvC,4BAA4B,CAAC,OAAO,CAAC,CAAC;AAEtC,8BAA8B;AAC9B,MAAM,OAAO,GAAG,OAAO;KACpB,OAAO,CAAC,MAAM,CAAC;KACf,WAAW,CAAC,uDAAuD,CAAC,CAAC;AAExE,qBAAqB,CAAC,OAAO,CAAC,CAAC;AAE/B,4BAA4B;AAC5B,uBAAuB,CAAC,OAAO,CAAC,CAAC;AAEjC,4BAA4B;AAC5B,oBAAoB,CAAC,OAAO,CAAC,CAAC;AAC9B,qBAAqB,CAAC,OAAO,CAAC,CAAC;AAC/B,qBAAqB,CAAC,OAAO,CAAC,CAAC;AAC/B,oBAAoB,CAAC,OAAO,CAAC,CAAC;AAE9B,OAAO,CAAC,KAAK,EAAE,CAAC"}
1
+ {"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAEA;;GAEG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAC/D,OAAO,EAAE,6BAA6B,EAAE,MAAM,2BAA2B,CAAC;AAC1E,OAAO,EAAE,4BAA4B,EAAE,MAAM,0BAA0B,CAAC;AACxE,OAAO,EAAE,4BAA4B,EAAE,MAAM,0BAA0B,CAAC;AACxE,OAAO,EAAE,0BAA0B,EAAE,MAAM,wBAAwB,CAAC;AACpE,OAAO,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AAClE,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAE1D,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;AAE9B,OAAO;KACJ,IAAI,CAAC,IAAI,CAAC;KACV,WAAW,CAAC,uDAAuD,CAAC;KACpE,OAAO,CAAC,OAAO,CAAC,CAAC;AAEpB,qCAAqC;AACrC,MAAM,UAAU,GAAG,OAAO;KACvB,OAAO,CAAC,SAAS,CAAC;KAClB,WAAW,CAAC,4BAA4B,CAAC,CAAC;AAE7C,kBAAkB,CAAC,UAAU,CAAC,CAAC;AAC/B,mBAAmB,CAAC,UAAU,CAAC,CAAC;AAChC,mBAAmB,CAAC,UAAU,CAAC,CAAC;AAChC,qBAAqB,CAAC,UAAU,CAAC,CAAC;AAElC,sCAAsC;AACtC,MAAM,WAAW,GAAG,OAAO;KACxB,OAAO,CAAC,UAAU,CAAC;KACnB,WAAW,CAAC,6BAA6B,CAAC,CAAC;AAE9C,6BAA6B,CAAC,WAAW,CAAC,CAAC;AAC3C,4BAA4B,CAAC,WAAW,CAAC,CAAC;AAC1C,4BAA4B,CAAC,WAAW,CAAC,CAAC;AAC1C,0BAA0B,CAAC,WAAW,CAAC,CAAC;AAExC,2CAA2C;AAC3C,qDAAqD;AACrD,oDAAoD;AACpD,6BAA6B,CAAC,OAAO,CAAC,CAAC;AACvC,4BAA4B,CAAC,OAAO,CAAC,CAAC;AAEtC,8BAA8B;AAC9B,MAAM,OAAO,GAAG,OAAO;KACpB,OAAO,CAAC,MAAM,CAAC;KACf,WAAW,CAAC,uDAAuD,CAAC,CAAC;AAExE,qBAAqB,CAAC,OAAO,CAAC,CAAC;AAE/B,4BAA4B;AAC5B,uBAAuB,CAAC,OAAO,CAAC,CAAC;AAEjC,6EAA6E;AAC7E,oBAAoB,CAAC,OAAO,CAAC,CAAC;AAC9B,qBAAqB,CAAC,OAAO,CAAC,CAAC;AAC/B,qBAAqB,CAAC,OAAO,CAAC,CAAC;AAC/B,oBAAoB,CAAC,OAAO,CAAC,CAAC;AAE9B,gEAAgE;AAChE,sBAAsB,CAAC,OAAO,CAAC,CAAC;AAEhC,OAAO,CAAC,KAAK,EAAE,CAAC"}
package/dist/utils/cognito-session.d.ts CHANGED
@@ -1,32 +1,43 @@
1
1
  /**
2
2
  * Shared Cognito session helpers for hq-cli commands.
3
3
  *
4
- * Consumed by `hq auth refresh` and the standalone `hq-auth-refresh` bin
5
- * invoked by the deploy skill (.claude/skills/deploy/SKILL.md step 4).
4
+ * Consumed by:
5
+ * - `hq onboard` and `hq sync push|pull` (need token + VaultServiceConfig)
6
+ * - `hq auth refresh` and the standalone `hq-auth-refresh` bin invoked by
7
+ * the deploy skill (.claude/skills/deploy/SKILL.md step 4)
6
8
  *
7
- * Defaults point at the shared hq-vault-dev Cognito pool. Override via env:
9
+ * Defaults point at the shared hq-vault-dev Cognito pool. They mirror
10
+ * tools/vlt-e2e/e2e-create-company-smoke.ts so the CLI and the in-tree demo script
11
+ * stay drift-free. Override any of them via env:
8
12
  *
9
13
  * AWS_REGION — e.g. us-east-1
10
14
  * HQ_COGNITO_DOMAIN — Cognito User Pool domain prefix
11
15
  * HQ_COGNITO_CLIENT_ID — App Client ID
12
16
  * HQ_COGNITO_CALLBACK_PORT — Loopback OAuth callback port
17
+ * HQ_VAULT_API_URL — vault-service API Gateway URL
13
18
  */
14
- import { type CognitoAuthConfig } from "@indigoai-us/hq-cloud";
19
+ import { type CognitoAuthConfig, type VaultServiceConfig } from "@indigoai-us/hq-cloud";
15
20
  export declare const DEFAULT_COGNITO: CognitoAuthConfig;
21
+ export declare const DEFAULT_VAULT_API_URL: string;
22
+ export declare const DEFAULT_HQ_ROOT: string;
16
23
  /**
17
24
  * Return a non-expired Cognito access token, refreshing or browser-logging-in
18
25
  * as needed. Cache lives at ~/.hq/cognito-tokens.json.
19
26
  *
20
- * Pass `interactive: false` from automated contexts where failing fast is
21
- * better than opening a browser.
27
+ * Pass `interactive: false` from automated contexts (e.g. the `hq-auth-refresh`
28
+ * bin invoked by the deploy skill) where failing fast is better than opening
29
+ * a browser.
22
30
  */
23
31
  export declare function ensureCognitoToken(options?: {
24
32
  interactive?: boolean;
25
33
  }): Promise<string>;
34
+ /** Build a VaultServiceConfig with the given access token. */
35
+ export declare function buildVaultConfig(authToken: string): VaultServiceConfig;
26
36
  /**
27
37
  * Refresh the cached Cognito session once and return the result. Used by
28
38
  * `hq auth refresh` and the `hq-auth-refresh` bin. Never opens a browser —
29
- * if no cached tokens exist or the refresh fails, throws.
39
+ * if no cached tokens exist or the refresh fails, returns `refreshed: false`
40
+ * with a reason string so the caller can decide what to do.
30
41
  */
31
42
  export declare function refreshCachedSession(): Promise<{
32
43
  refreshed: boolean;
package/dist/utils/cognito-session.d.ts.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"cognito-session.d.ts","sourceRoot":"","sources":["../../src/utils/cognito-session.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAKL,KAAK,iBAAiB,EACvB,MAAM,uBAAuB,CAAC;AAE/B,eAAO,MAAM,eAAe,EAAE,iBAQ7B,CAAC;AAEF;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CAAC,OAAO,GAAE;IAChD,WAAW,CAAC,EAAE,OAAO,CAAC;CAClB,GAAG,OAAO,CAAC,MAAM,CAAC,CA4BvB;AAED;;;;GAIG;AACH,wBAAsB,oBAAoB,IAAI,OAAO,CAAC;IACpD,SAAS,EAAE,OAAO,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC,CAcD"}
1
+ {"version":3,"file":"cognito-session.d.ts","sourceRoot":"","sources":["../../src/utils/cognito-session.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAKH,OAAO,EAKL,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACxB,MAAM,uBAAuB,CAAC;AAE/B,eAAO,MAAM,eAAe,EAAE,iBAO7B,CAAC;AAEF,eAAO,MAAM,qBAAqB,QAEwB,CAAC;AAE3D,eAAO,MAAM,eAAe,QAAgC,CAAC;AAE7D;;;;;;;GAOG;AACH,wBAAsB,kBAAkB,CAAC,OAAO,GAAE;IAChD,WAAW,CAAC,EAAE,OAAO,CAAC;CAClB,GAAG,OAAO,CAAC,MAAM,CAAC,CAmCvB;AAED,8DAA8D;AAC9D,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,kBAAkB,CAMtE;AAED;;;;;GAKG;AACH,wBAAsB,oBAAoB,IAAI,OAAO,CAAC;IACpD,SAAS,EAAE,OAAO,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC,CAcD"}
package/dist/utils/cognito-session.js CHANGED
@@ -1,16 +1,24 @@
1
1
  /**
2
2
  * Shared Cognito session helpers for hq-cli commands.
3
3
  *
4
- * Consumed by `hq auth refresh` and the standalone `hq-auth-refresh` bin
5
- * invoked by the deploy skill (.claude/skills/deploy/SKILL.md step 4).
4
+ * Consumed by:
5
+ * - `hq onboard` and `hq sync push|pull` (need token + VaultServiceConfig)
6
+ * - `hq auth refresh` and the standalone `hq-auth-refresh` bin invoked by
7
+ * the deploy skill (.claude/skills/deploy/SKILL.md step 4)
6
8
  *
7
- * Defaults point at the shared hq-vault-dev Cognito pool. Override via env:
9
+ * Defaults point at the shared hq-vault-dev Cognito pool. They mirror
10
+ * tools/vlt-e2e/e2e-create-company-smoke.ts so the CLI and the in-tree demo script
11
+ * stay drift-free. Override any of them via env:
8
12
  *
9
13
  * AWS_REGION — e.g. us-east-1
10
14
  * HQ_COGNITO_DOMAIN — Cognito User Pool domain prefix
11
15
  * HQ_COGNITO_CLIENT_ID — App Client ID
12
16
  * HQ_COGNITO_CALLBACK_PORT — Loopback OAuth callback port
17
+ * HQ_VAULT_API_URL — vault-service API Gateway URL
13
18
  */
19
+ import * as os from "os";
20
+ import * as path from "path";
21
+ import chalk from "chalk";
14
22
  import { loadCachedTokens, isExpiring, refreshTokens, browserLogin, } from "@indigoai-us/hq-cloud";
15
23
  export const DEFAULT_COGNITO = {
16
24
  region: process.env.AWS_REGION ?? "us-east-1",
@@ -20,12 +28,16 @@ export const DEFAULT_COGNITO = {
20
28
  ? Number(process.env.HQ_COGNITO_CALLBACK_PORT)
21
29
  : 8765,
22
30
  };
31
+ export const DEFAULT_VAULT_API_URL = process.env.HQ_VAULT_API_URL ??
32
+ "https://tqdwdqxv75.execute-api.us-east-1.amazonaws.com";
33
+ export const DEFAULT_HQ_ROOT = path.join(os.homedir(), "hq");
23
34
  /**
24
35
  * Return a non-expired Cognito access token, refreshing or browser-logging-in
25
36
  * as needed. Cache lives at ~/.hq/cognito-tokens.json.
26
37
  *
27
- * Pass `interactive: false` from automated contexts where failing fast is
28
- * better than opening a browser.
38
+ * Pass `interactive: false` from automated contexts (e.g. the `hq-auth-refresh`
39
+ * bin invoked by the deploy skill) where failing fast is better than opening
40
+ * a browser.
29
41
  */
30
42
  export async function ensureCognitoToken(options = {}) {
31
43
  const interactive = options.interactive ?? true;
@@ -35,23 +47,38 @@ export async function ensureCognitoToken(options = {}) {
35
47
  }
36
48
  if (cached) {
37
49
  try {
50
+ if (interactive) {
51
+ console.log(chalk.dim(" Refreshing expiring HQ session..."));
52
+ }
38
53
  const refreshed = await refreshTokens(DEFAULT_COGNITO, cached.refreshToken);
39
54
  return refreshed.accessToken;
40
55
  }
41
- catch {
42
- // fall through to browser login
56
+ catch (err) {
57
+ if (interactive) {
58
+ console.log(chalk.dim(` Refresh failed (${err instanceof Error ? err.message : err}), falling back to browser login`));
59
+ }
43
60
  }
44
61
  }
45
62
  if (!interactive) {
46
63
  throw new Error("No valid HQ session and interactive login is disabled. Run `hq login` first.");
47
64
  }
65
+ console.log(chalk.cyan(" No cached HQ session — launching browser sign-in..."));
48
66
  const tokens = await browserLogin(DEFAULT_COGNITO);
49
67
  return tokens.accessToken;
50
68
  }
69
+ /** Build a VaultServiceConfig with the given access token. */
70
+ export function buildVaultConfig(authToken) {
71
+ return {
72
+ apiUrl: DEFAULT_VAULT_API_URL,
73
+ authToken,
74
+ region: DEFAULT_COGNITO.region,
75
+ };
76
+ }
51
77
  /**
52
78
  * Refresh the cached Cognito session once and return the result. Used by
53
79
  * `hq auth refresh` and the `hq-auth-refresh` bin. Never opens a browser —
54
- * if no cached tokens exist or the refresh fails, throws.
80
+ * if no cached tokens exist or the refresh fails, returns `refreshed: false`
81
+ * with a reason string so the caller can decide what to do.
55
82
  */
56
83
  export async function refreshCachedSession() {
57
84
  const cached = loadCachedTokens();
package/dist/utils/cognito-session.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"cognito-session.js","sourceRoot":"","sources":["../../src/utils/cognito-session.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EACL,gBAAgB,EAChB,UAAU,EACV,aAAa,EACb,YAAY,GAEb,MAAM,uBAAuB,CAAC;AAE/B,MAAM,CAAC,MAAM,eAAe,GAAsB;IAChD,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,WAAW;IAC7C,cAAc,EAAE,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,cAAc;IAC/D,QAAQ,EACN,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,4BAA4B;IAClE,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,wBAAwB;QACxC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC;QAC9C,CAAC,CAAC,IAAI;CACT,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,UAErC,EAAE;IACJ,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,IAAI,CAAC;IAChD,MAAM,MAAM,GAAG,gBAAgB,EAAE,CAAC;IAElC,IAAI,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC;QACvC,OAAO,MAAM,CAAC,WAAW,CAAC;IAC5B,CAAC;IAED,IAAI,MAAM,EAAE,CAAC;QACX,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,MAAM,aAAa,CACnC,eAAe,EACf,MAAM,CAAC,YAAY,CACpB,CAAC;YACF,OAAO,SAAS,CAAC,WAAW,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,gCAAgC;QAClC,CAAC;IACH,CAAC;IAED,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CACb,8EAA8E,CAC/E,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,eAAe,CAAC,CAAC;IACnD,OAAO,MAAM,CAAC,WAAW,CAAC;AAC5B,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB;IAIxC,MAAM,MAAM,GAAG,gBAAgB,EAAE,CAAC;IAClC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IAC3D,CAAC;IACD,IAAI,CAAC;QACH,MAAM,aAAa,CAAC,eAAe,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;QAC1D,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IAC7B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,SAAS,EAAE,KAAK;YAChB,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;SACzD,CAAC;IACJ,CAAC;AACH,CAAC"}
1
+ {"version":3,"file":"cognito-session.js","sourceRoot":"","sources":["../../src/utils/cognito-session.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EACL,gBAAgB,EAChB,UAAU,EACV,aAAa,EACb,YAAY,GAGb,MAAM,uBAAuB,CAAC;AAE/B,MAAM,CAAC,MAAM,eAAe,GAAsB;IAChD,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,WAAW;IAC7C,cAAc,EAAE,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,cAAc;IAC/D,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,4BAA4B;IAC1E,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,wBAAwB;QACxC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC;QAC9C,CAAC,CAAC,IAAI;CACT,CAAC;AAEF,MAAM,CAAC,MAAM,qBAAqB,GAChC,OAAO,CAAC,GAAG,CAAC,gBAAgB;IAC5B,wDAAwD,CAAC;AAE3D,MAAM,CAAC,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,IAAI,CAAC,CAAC;AAE7D;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,UAErC,EAAE;IACJ,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,IAAI,CAAC;IAChD,MAAM,MAAM,GAAG,gBAAgB,EAAE,CAAC;IAElC,IAAI,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC;QACvC,OAAO,MAAM,CAAC,WAAW,CAAC;IAC5B,CAAC;IAED,IAAI,MAAM,EAAE,CAAC;QACX,IAAI,CAAC;YACH,IAAI,WAAW,EAAE,CAAC;gBAChB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,qCAAqC,CAAC,CAAC,CAAC;YAChE,CAAC;YACD,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,eAAe,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;YAC5E,OAAO,SAAS,CAAC,WAAW,CAAC;QAC/B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,WAAW,EAAE,CAAC;gBAChB,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,GAAG,CACP,qBAAqB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,kCAAkC,CAChG,CACF,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CACb,8EAA8E,CAC/E,CAAC;IACJ,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,uDAAuD,CAAC,CAAC,CAAC;IACjF,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,eAAe,CAAC,CAAC;IACnD,OAAO,MAAM,CAAC,WAAW,CAAC;AAC5B,CAAC;AAED,8DAA8D;AAC9D,MAAM,UAAU,gBAAgB,CAAC,SAAiB;IAChD,OAAO;QACL,MAAM,EAAE,qBAAqB;QAC7B,SAAS;QACT,MAAM,EAAE,eAAe,CAAC,MAAM;KAC/B,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB;IAIxC,MAAM,MAAM,GAAG,gBAAgB,EAAE,CAAC;IAClC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IAC3D,CAAC;IACD,IAAI,CAAC;QACH,MAAM,aAAa,CAAC,eAAe,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;QAC1D,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IAC7B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,SAAS,EAAE,KAAK;YAChB,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;SACzD,CAAC;IACJ,CAAC;AACH,CAAC"}
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@indigoai-us/hq-cli",
3
- "version": "5.4.0",
3
+ "version": "5.5.1",
4
4
  "description": "HQ by Indigo management CLI — modules and cloud sync",
5
5
  "main": "dist/index.js",
6
6
  "bin": {
@@ -13,7 +13,8 @@
13
13
  "clean": "rm -rf dist"
14
14
  },
15
15
  "dependencies": {
16
- "@indigoai-us/hq-cloud": "5.1.0",
16
+ "@indigoai-us/hq-cloud": "^5.1.0",
17
+ "@indigoai-us/hq-onboarding": "0.1.0",
17
18
  "chalk": "^5.3.0",
18
19
  "commander": "^12.1.0",
19
20
  "js-yaml": "^4.1.0",
@@ -29,7 +30,13 @@
29
30
  "url": "https://github.com/indigoai-us/hq.git",
30
31
  "directory": "packages/hq-cli"
31
32
  },
32
- "keywords": ["hq", "ai", "modules", "sync", "cloud"],
33
+ "keywords": [
34
+ "hq",
35
+ "ai",
36
+ "modules",
37
+ "sync",
38
+ "cloud"
39
+ ],
33
40
  "license": "MIT",
34
41
  "type": "module"
35
42
  }
package/src/commands/cloud.ts CHANGED
@@ -1,125 +1,238 @@
1
1
  /**
2
- * hq sync commands — cloud sync management
3
- * Bridges hq-cli to @indigoai-us/hq-cloud
2
+ * `hq sync` commands — push/pull files between the local HQ tree and the
3
+ * company's S3 vault bucket.
4
+ *
5
+ * VLT-5 model: each command resolves a Cognito access token, asks
6
+ * vault-service for the company's bucket + STS-vended credentials, and
7
+ * runs the operation. No daemon, no init step (handled by `hq onboard`),
8
+ * no long-lived background process — every invocation is self-contained.
9
+ *
10
+ * Subcommands:
11
+ * hq sync push [paths...] — broadcast local file(s) to the vault
12
+ * hq sync pull — pull all permitted files from the vault
13
+ * hq sync status — show local journal summary
4
14
  */
5
15
 
6
16
  import { Command } from "commander";
7
- import { findHqRoot } from "../utils/manifest.js";
17
+ import chalk from "chalk";
18
+ import * as fs from "fs";
19
+ import * as path from "path";
20
+
21
+ import {
22
+ share,
23
+ sync,
24
+ readJournal,
25
+ getJournalPath,
26
+ type ConflictStrategy,
27
+ } from "@indigoai-us/hq-cloud";
28
+
29
+ import {
30
+ DEFAULT_HQ_ROOT,
31
+ ensureCognitoToken,
32
+ buildVaultConfig,
33
+ } from "../utils/cognito-session.js";
34
+
35
+ interface CommonSyncOptions {
36
+ hqRoot: string;
37
+ company?: string;
38
+ }
8
39
 
9
40
  export function registerCloudCommands(program: Command): void {
10
41
  program
11
- .command("init")
12
- .description("Authenticate with IndigoAI and set up cloud sync")
13
- .action(async () => {
14
- try {
15
- const hqRoot = findHqRoot();
16
- const { initSync } = await import("@indigoai-us/hq-cloud");
17
- await initSync(hqRoot);
18
- } catch (error) {
19
- console.error(
20
- "Error:",
21
- error instanceof Error ? error.message : error
22
- );
23
- process.exit(1);
24
- }
25
- });
42
+ .command("push")
43
+ .description("Push local file(s) to the company vault on S3")
44
+ .argument("[paths...]", "Paths to push (defaults to current directory)")
45
+ .option(
46
+ "--hq-root <path>",
47
+ `Local HQ tree root (default: ${DEFAULT_HQ_ROOT})`,
48
+ DEFAULT_HQ_ROOT,
49
+ )
50
+ .option(
51
+ "--company <slug>",
52
+ "Company slug or UID (defaults to active company in .hq/config.json)",
53
+ )
54
+ .option(
55
+ "--message <msg>",
56
+ "Optional message attached to journal entries for these uploads",
57
+ )
58
+ .option(
59
+ "--on-conflict <strategy>",
60
+ "Conflict strategy: overwrite | keep | abort (omit for interactive)",
61
+ )
62
+ .action(
63
+ async (
64
+ paths: string[],
65
+ options: CommonSyncOptions & {
66
+ message?: string;
67
+ onConflict?: ConflictStrategy;
68
+ },
69
+ ) => {
70
+ try {
71
+ const targetPaths =
72
+ paths && paths.length > 0 ? paths : [process.cwd()];
26
73
 
27
- program
28
- .command("start")
29
- .description("Start the background sync daemon")
30
- .action(async () => {
31
- try {
32
- const hqRoot = findHqRoot();
33
- const { startDaemon } = await import("@indigoai-us/hq-cloud");
34
- await startDaemon(hqRoot);
35
- console.log("Sync daemon started. Use 'hq sync status' to check.");
36
- } catch (error) {
37
- console.error(
38
- "Error:",
39
- error instanceof Error ? error.message : error
40
- );
41
- process.exit(1);
42
- }
43
- });
74
+ console.log(chalk.bold("\nHQ Sync — Push"));
75
+ console.log(` HQ root: ${options.hqRoot}`);
76
+ console.log(` Company: ${options.company ?? "(from .hq/config.json)"}`);
77
+ console.log(` Paths: ${targetPaths.join(", ")}\n`);
44
78
 
45
- program
46
- .command("stop")
47
- .description("Stop the sync daemon")
48
- .action(async () => {
49
- try {
50
- const hqRoot = findHqRoot();
51
- const { stopDaemon } = await import("@indigoai-us/hq-cloud");
52
- await stopDaemon(hqRoot);
53
- console.log("Sync daemon stopped.");
54
- } catch (error) {
55
- console.error(
56
- "Error:",
57
- error instanceof Error ? error.message : error
58
- );
59
- process.exit(1);
60
- }
61
- });
79
+ const accessToken = await ensureCognitoToken();
80
+ const result = await share({
81
+ paths: targetPaths,
82
+ company: options.company,
83
+ message: options.message,
84
+ onConflict: options.onConflict,
85
+ vaultConfig: buildVaultConfig(accessToken),
86
+ hqRoot: options.hqRoot,
87
+ });
88
+
89
+ if (result.aborted) {
90
+ console.log(
91
+ chalk.yellow(
92
+ `\n⚠ Push aborted (${result.filesUploaded} uploaded, ${result.filesSkipped} skipped)`,
93
+ ),
94
+ );
95
+ process.exit(1);
96
+ }
97
+
98
+ console.log(
99
+ chalk.green(
100
+ `\n✓ Pushed ${result.filesUploaded} file(s) (${formatBytes(result.bytesUploaded)}, ${result.filesSkipped} skipped)`,
101
+ ),
102
+ );
103
+ } catch (err) {
104
+ console.error(
105
+ chalk.red("\n✗ Push failed:"),
106
+ err instanceof Error ? err.message : String(err),
107
+ );
108
+ process.exit(1);
109
+ }
110
+ },
111
+ );
62
112
 
63
113
  program
64
- .command("status")
65
- .description("Show sync status")
66
- .action(async () => {
67
- try {
68
- const hqRoot = findHqRoot();
69
- const { getStatus } = await import("@indigoai-us/hq-cloud");
70
- const status = await getStatus(hqRoot);
71
- console.log(` State: ${status.running ? "running" : "stopped"}`);
72
- console.log(` Last sync: ${status.lastSync || "never"}`);
73
- console.log(` Files: ${status.fileCount} tracked`);
74
- console.log(` Bucket: ${status.bucket || "not configured"}`);
75
- if (status.errors.length > 0) {
76
- console.log(` Errors: ${status.errors.length}`);
77
- for (const err of status.errors.slice(0, 5)) {
78
- console.log(` - ${err}`);
114
+ .command("pull")
115
+ .description("Pull permitted files from the company vault to local HQ")
116
+ .option(
117
+ "--hq-root <path>",
118
+ `Local HQ tree root (default: ${DEFAULT_HQ_ROOT})`,
119
+ DEFAULT_HQ_ROOT,
120
+ )
121
+ .option(
122
+ "--company <slug>",
123
+ "Company slug or UID (defaults to active company in .hq/config.json)",
124
+ )
125
+ .option(
126
+ "--on-conflict <strategy>",
127
+ "Conflict strategy: overwrite | keep | abort (omit for interactive)",
128
+ )
129
+ .action(
130
+ async (
131
+ options: CommonSyncOptions & {
132
+ onConflict?: ConflictStrategy;
133
+ },
134
+ ) => {
135
+ try {
136
+ console.log(chalk.bold("\nHQ Sync — Pull"));
137
+ console.log(` HQ root: ${options.hqRoot}`);
138
+ console.log(` Company: ${options.company ?? "(from .hq/config.json)"}\n`);
139
+
140
+ const accessToken = await ensureCognitoToken();
141
+ const result = await sync({
142
+ company: options.company,
143
+ onConflict: options.onConflict,
144
+ vaultConfig: buildVaultConfig(accessToken),
145
+ hqRoot: options.hqRoot,
146
+ });
147
+
148
+ if (result.aborted) {
149
+ console.log(
150
+ chalk.yellow(
151
+ `\n⚠ Pull aborted (${result.filesDownloaded} downloaded, ${result.filesSkipped} skipped, ${result.conflicts} conflicts)`,
152
+ ),
153
+ );
154
+ process.exit(1);
79
155
  }
156
+
157
+ console.log(
158
+ chalk.green(
159
+ `\n✓ Pulled ${result.filesDownloaded} file(s) (${formatBytes(result.bytesDownloaded)}, ${result.filesSkipped} skipped, ${result.conflicts} conflicts)`,
160
+ ),
161
+ );
162
+ } catch (err) {
163
+ console.error(
164
+ chalk.red("\n✗ Pull failed:"),
165
+ err instanceof Error ? err.message : String(err),
166
+ );
167
+ process.exit(1);
80
168
  }
81
- } catch (error) {
82
- console.error(
83
- "Error:",
84
- error instanceof Error ? error.message : error
85
- );
86
- process.exit(1);
87
- }
88
- });
169
+ },
170
+ );
89
171
 
90
172
  program
91
- .command("push")
92
- .description("Force push all local changes to cloud")
93
- .action(async () => {
173
+ .command("status")
174
+ .description("Show local sync journal summary")
175
+ .option(
176
+ "--hq-root <path>",
177
+ `Local HQ tree root (default: ${DEFAULT_HQ_ROOT})`,
178
+ DEFAULT_HQ_ROOT,
179
+ )
180
+ .action((options: { hqRoot: string }) => {
94
181
  try {
95
- const hqRoot = findHqRoot();
96
- const { pushAll } = await import("@indigoai-us/hq-cloud");
97
- const result = await pushAll(hqRoot);
98
- console.log(`Pushed ${result.filesUploaded} files to cloud.`);
99
- } catch (error) {
100
- console.error(
101
- "Error:",
102
- error instanceof Error ? error.message : error
182
+ const journalPath = getJournalPath(options.hqRoot);
183
+ if (!fs.existsSync(journalPath)) {
184
+ console.log(chalk.dim("No sync journal yet — run `hq sync push` or `hq sync pull` to create one."));
185
+ console.log(chalk.dim(` Expected at: ${journalPath}`));
186
+ return;
187
+ }
188
+
189
+ const journal = readJournal(options.hqRoot);
190
+ const entries = Object.entries(journal.files ?? {});
191
+ const lastSyncTimes = entries
192
+ .map(([, entry]) => entry.syncedAt)
193
+ .filter((t): t is string => typeof t === "string")
194
+ .sort();
195
+ const lastSync = lastSyncTimes.at(-1) ?? "never";
196
+ const totalBytes = entries.reduce(
197
+ (acc, [, entry]) => acc + (entry.size ?? 0),
198
+ 0,
103
199
  );
104
- process.exit(1);
105
- }
106
- });
107
200
 
108
- program
109
- .command("pull")
110
- .description("Force pull all cloud changes to local")
111
- .action(async () => {
112
- try {
113
- const hqRoot = findHqRoot();
114
- const { pullAll } = await import("@indigoai-us/hq-cloud");
115
- const result = await pullAll(hqRoot);
116
- console.log(`Pulled ${result.filesDownloaded} files from cloud.`);
117
- } catch (error) {
201
+ const configPath = path.join(options.hqRoot, ".hq", "config.json");
202
+ let activeCompany: string | undefined;
203
+ if (fs.existsSync(configPath)) {
204
+ try {
205
+ const cfg = JSON.parse(fs.readFileSync(configPath, "utf-8"));
206
+ activeCompany = cfg.activeCompany;
207
+ } catch {
208
+ // ignore
209
+ }
210
+ }
211
+
212
+ console.log(chalk.bold("\nHQ Sync — Status"));
213
+ console.log(` HQ root: ${options.hqRoot}`);
214
+ console.log(` Active company: ${activeCompany ?? chalk.dim("(none)")}`);
215
+ console.log(` Tracked files: ${entries.length}`);
216
+ console.log(` Total size: ${formatBytes(totalBytes)}`);
217
+ console.log(` Last sync: ${lastSync}`);
218
+ console.log(` Journal: ${journalPath}`);
219
+ } catch (err) {
118
220
  console.error(
119
- "Error:",
120
- error instanceof Error ? error.message : error
221
+ chalk.red("✗ Status failed:"),
222
+ err instanceof Error ? err.message : String(err),
121
223
  );
122
224
  process.exit(1);
123
225
  }
124
226
  });
125
227
  }
228
+
229
+ function formatBytes(bytes: number): string {
230
+ if (bytes === 0) return "0 B";
231
+ const units = ["B", "KB", "MB", "GB"];
232
+ const exponent = Math.min(
233
+ Math.floor(Math.log(bytes) / Math.log(1024)),
234
+ units.length - 1,
235
+ );
236
+ const value = bytes / Math.pow(1024, exponent);
237
+ return `${value.toFixed(value >= 100 || exponent === 0 ? 0 : 1)} ${units[exponent]}`;
238
+ }
package/src/commands/onboard.ts ADDED
@@ -0,0 +1,193 @@
1
+ /**
2
+ * `hq onboard` — bootstrap an HQ vault: sign in to Cognito + provision
3
+ * the company entity, S3 bucket, KMS key, owner membership, and STS-vended
4
+ * credentials in one flow.
5
+ *
6
+ * This is the "the entire flow" entry point that VLT-9 was building toward:
7
+ * a real user can install hq-cli and run `hq onboard create-company` once
8
+ * to land in a fully provisioned vault, then use `hq sync push|pull` to
9
+ * round-trip files against S3.
10
+ *
11
+ * Subcommands:
12
+ * hq onboard create-company — provision a brand new company
13
+ * hq onboard join — accept an invite from another user
14
+ * hq onboard resume — resume a partially-completed flow from checkpoint
15
+ * hq onboard dry-run — show what create-company would do, without doing it
16
+ *
17
+ * Auth: we cache the Cognito access + refresh tokens at ~/.hq/cognito-tokens.json.
18
+ * If the cached token is missing or expired beyond the refresh window, the
19
+ * browser-OAuth flow opens automatically.
20
+ */
21
+
22
+ import { Command } from "commander";
23
+ import chalk from "chalk";
24
+
25
+ import { runOnboardCli } from "@indigoai-us/hq-onboarding";
26
+ import {
27
+ DEFAULT_HQ_ROOT,
28
+ ensureCognitoToken,
29
+ buildVaultConfig,
30
+ } from "../utils/cognito-session.js";
31
+
32
+ // ---------------------------------------------------------------------------
33
+ // Command registration
34
+ // ---------------------------------------------------------------------------
35
+
36
+ export function registerOnboardCommand(program: Command): void {
37
+ const onboard = program
38
+ .command("onboard")
39
+ .description("Provision an HQ vault: sign in, create company, S3 bucket, STS, sync");
40
+
41
+ onboard
42
+ .command("create-company")
43
+ .description("Sign in and provision a brand new HQ vault for a company")
44
+ .requiredOption("--slug <slug>", "Company slug (used as bucket name suffix)")
45
+ .requiredOption("--name <name>", "Company display name")
46
+ .requiredOption("--email <email>", "Your email (must match Cognito sign-in)")
47
+ .requiredOption("--person-name <name>", "Your display name")
48
+ .option(
49
+ "--hq-root <path>",
50
+ `Local HQ tree root (default: ${DEFAULT_HQ_ROOT})`,
51
+ DEFAULT_HQ_ROOT,
52
+ )
53
+ .action(async (options: {
54
+ slug: string;
55
+ name: string;
56
+ email: string;
57
+ personName: string;
58
+ hqRoot: string;
59
+ }) => {
60
+ try {
61
+ console.log(chalk.bold(`\nHQ Onboard — Create Company`));
62
+ console.log(` Company: ${options.name} (${options.slug})`);
63
+ console.log(` Person: ${options.personName} <${options.email}>`);
64
+ console.log(` HQ root: ${options.hqRoot}\n`);
65
+
66
+ const accessToken = await ensureCognitoToken();
67
+ const result = await runOnboardCli({
68
+ mode: "create-company",
69
+ personName: options.personName,
70
+ personEmail: options.email,
71
+ companyName: options.name,
72
+ companySlug: options.slug,
73
+ vaultConfig: buildVaultConfig(accessToken),
74
+ hqRoot: options.hqRoot,
75
+ });
76
+
77
+ if (!result.success) {
78
+ console.error(chalk.red(`\n✗ Onboarding failed: ${result.error}`));
79
+ process.exit(1);
80
+ }
81
+ } catch (err) {
82
+ console.error(
83
+ chalk.red("\n✗ Error:"),
84
+ err instanceof Error ? err.message : String(err),
85
+ );
86
+ process.exit(1);
87
+ }
88
+ });
89
+
90
+ onboard
91
+ .command("join")
92
+ .description("Accept an invite and join an existing company")
93
+ .requiredOption("--invite-token <token>", "Magic link token from your invite email")
94
+ .requiredOption("--email <email>", "Your email (must match Cognito sign-in)")
95
+ .requiredOption("--person-name <name>", "Your display name")
96
+ .option(
97
+ "--hq-root <path>",
98
+ `Local HQ tree root (default: ${DEFAULT_HQ_ROOT})`,
99
+ DEFAULT_HQ_ROOT,
100
+ )
101
+ .action(async (options: {
102
+ inviteToken: string;
103
+ email: string;
104
+ personName: string;
105
+ hqRoot: string;
106
+ }) => {
107
+ try {
108
+ console.log(chalk.bold(`\nHQ Onboard — Join Company`));
109
+ console.log(` Person: ${options.personName} <${options.email}>`);
110
+ console.log(` HQ root: ${options.hqRoot}\n`);
111
+
112
+ const accessToken = await ensureCognitoToken();
113
+ const result = await runOnboardCli({
114
+ mode: "join-company",
115
+ personName: options.personName,
116
+ personEmail: options.email,
117
+ inviteToken: options.inviteToken,
118
+ vaultConfig: buildVaultConfig(accessToken),
119
+ hqRoot: options.hqRoot,
120
+ });
121
+
122
+ if (!result.success) {
123
+ console.error(chalk.red(`\n✗ Join failed: ${result.error}`));
124
+ process.exit(1);
125
+ }
126
+ } catch (err) {
127
+ console.error(
128
+ chalk.red("\n✗ Error:"),
129
+ err instanceof Error ? err.message : String(err),
130
+ );
131
+ process.exit(1);
132
+ }
133
+ });
134
+
135
+ onboard
136
+ .command("resume")
137
+ .description("Resume a partially-completed onboarding flow from local checkpoint")
138
+ .option(
139
+ "--hq-root <path>",
140
+ `Local HQ tree root (default: ${DEFAULT_HQ_ROOT})`,
141
+ DEFAULT_HQ_ROOT,
142
+ )
143
+ .action(async (options: { hqRoot: string }) => {
144
+ try {
145
+ const accessToken = await ensureCognitoToken();
146
+ const result = await runOnboardCli({
147
+ mode: "resume",
148
+ vaultConfig: buildVaultConfig(accessToken),
149
+ hqRoot: options.hqRoot,
150
+ });
151
+ if (!result.success) {
152
+ console.error(chalk.red(`\n✗ Resume failed: ${result.error}`));
153
+ process.exit(1);
154
+ }
155
+ } catch (err) {
156
+ console.error(
157
+ chalk.red("\n✗ Error:"),
158
+ err instanceof Error ? err.message : String(err),
159
+ );
160
+ process.exit(1);
161
+ }
162
+ });
163
+
164
+ onboard
165
+ .command("dry-run")
166
+ .description("Show what create-company would do, without provisioning anything")
167
+ .option(
168
+ "--hq-root <path>",
169
+ `Local HQ tree root (default: ${DEFAULT_HQ_ROOT})`,
170
+ DEFAULT_HQ_ROOT,
171
+ )
172
+ .action(async (options: { hqRoot: string }) => {
173
+ try {
174
+ // No auth needed for dry-run — runOnboardCli handles this branch
175
+ // without touching the vault-service.
176
+ const result = await runOnboardCli({
177
+ mode: "dry-run",
178
+ vaultConfig: buildVaultConfig("dry-run-no-token"),
179
+ hqRoot: options.hqRoot,
180
+ });
181
+ if (!result.success) {
182
+ console.error(chalk.red(`\n✗ Dry-run failed: ${result.error}`));
183
+ process.exit(1);
184
+ }
185
+ } catch (err) {
186
+ console.error(
187
+ chalk.red("\n✗ Error:"),
188
+ err instanceof Error ? err.message : String(err),
189
+ );
190
+ process.exit(1);
191
+ }
192
+ });
193
+ }
package/src/index.ts CHANGED
@@ -13,6 +13,7 @@ import { registerCloudCommands } from "./commands/cloud.js";
13
13
  import { registerLoginCommand } from "./commands/login.js";
14
14
  import { registerLogoutCommand } from "./commands/logout.js";
15
15
  import { registerWhoamiCommand } from "./commands/whoami.js";
16
+ import { registerOnboardCommand } from "./commands/onboard.js";
16
17
  import { registerPackageInstallCommand } from "./commands/pkg-install.js";
17
18
  import { registerPackageRemoveCommand } from "./commands/pkg-remove.js";
18
19
  import { registerPackageUpdateCommand } from "./commands/pkg-update.js";
@@ -25,7 +26,7 @@ const program = new Command();
25
26
  program
26
27
  .name("hq")
27
28
  .description("HQ management CLI — modules, packages, and cloud sync")
28
- .version("5.4.0");
29
+ .version("5.5.0");
29
30
 
30
31
  // Module management subcommand group
31
32
  const modulesCmd = program
@@ -63,10 +64,13 @@ registerCloudCommands(syncCmd);
63
64
  // Team commands (top-level)
64
65
  registerTeamSyncCommand(program);
65
66
 
66
- // Auth commands (top-level)
67
+ // Auth commands (top-level — registry auth via Clerk, separate from Cognito)
67
68
  registerLoginCommand(program);
68
69
  registerLogoutCommand(program);
69
70
  registerWhoamiCommand(program);
70
71
  registerAuthCommands(program);
71
72
 
73
+ // Onboarding (top-level — Cognito + vault-service provisioning)
74
+ registerOnboardCommand(program);
75
+
72
76
  program.parse();
package/src/utils/cognito-session.ts CHANGED
@@ -1,41 +1,56 @@
1
1
  /**
2
2
  * Shared Cognito session helpers for hq-cli commands.
3
3
  *
4
- * Consumed by `hq auth refresh` and the standalone `hq-auth-refresh` bin
5
- * invoked by the deploy skill (.claude/skills/deploy/SKILL.md step 4).
4
+ * Consumed by:
5
+ * - `hq onboard` and `hq sync push|pull` (need token + VaultServiceConfig)
6
+ * - `hq auth refresh` and the standalone `hq-auth-refresh` bin invoked by
7
+ * the deploy skill (.claude/skills/deploy/SKILL.md step 4)
6
8
  *
7
- * Defaults point at the shared hq-vault-dev Cognito pool. Override via env:
9
+ * Defaults point at the shared hq-vault-dev Cognito pool. They mirror
10
+ * tools/vlt-e2e/e2e-create-company-smoke.ts so the CLI and the in-tree demo script
11
+ * stay drift-free. Override any of them via env:
8
12
  *
9
13
  * AWS_REGION — e.g. us-east-1
10
14
  * HQ_COGNITO_DOMAIN — Cognito User Pool domain prefix
11
15
  * HQ_COGNITO_CLIENT_ID — App Client ID
12
16
  * HQ_COGNITO_CALLBACK_PORT — Loopback OAuth callback port
17
+ * HQ_VAULT_API_URL — vault-service API Gateway URL
13
18
  */
14
19
 
20
+ import * as os from "os";
21
+ import * as path from "path";
22
+ import chalk from "chalk";
15
23
  import {
16
24
  loadCachedTokens,
17
25
  isExpiring,
18
26
  refreshTokens,
19
27
  browserLogin,
20
28
  type CognitoAuthConfig,
29
+ type VaultServiceConfig,
21
30
  } from "@indigoai-us/hq-cloud";
22
31
 
23
32
  export const DEFAULT_COGNITO: CognitoAuthConfig = {
24
33
  region: process.env.AWS_REGION ?? "us-east-1",
25
34
  userPoolDomain: process.env.HQ_COGNITO_DOMAIN ?? "hq-vault-dev",
26
- clientId:
27
- process.env.HQ_COGNITO_CLIENT_ID ?? "4mmujmjq3srakdueg656b9m0mp",
35
+ clientId: process.env.HQ_COGNITO_CLIENT_ID ?? "4mmujmjq3srakdueg656b9m0mp",
28
36
  port: process.env.HQ_COGNITO_CALLBACK_PORT
29
37
  ? Number(process.env.HQ_COGNITO_CALLBACK_PORT)
30
38
  : 8765,
31
39
  };
32
40
 
41
+ export const DEFAULT_VAULT_API_URL =
42
+ process.env.HQ_VAULT_API_URL ??
43
+ "https://tqdwdqxv75.execute-api.us-east-1.amazonaws.com";
44
+
45
+ export const DEFAULT_HQ_ROOT = path.join(os.homedir(), "hq");
46
+
33
47
  /**
34
48
  * Return a non-expired Cognito access token, refreshing or browser-logging-in
35
49
  * as needed. Cache lives at ~/.hq/cognito-tokens.json.
36
50
  *
37
- * Pass `interactive: false` from automated contexts where failing fast is
38
- * better than opening a browser.
51
+ * Pass `interactive: false` from automated contexts (e.g. the `hq-auth-refresh`
52
+ * bin invoked by the deploy skill) where failing fast is better than opening
53
+ * a browser.
39
54
  */
40
55
  export async function ensureCognitoToken(options: {
41
56
  interactive?: boolean;
@@ -49,13 +64,19 @@ export async function ensureCognitoToken(options: {
49
64
 
50
65
  if (cached) {
51
66
  try {
52
- const refreshed = await refreshTokens(
53
- DEFAULT_COGNITO,
54
- cached.refreshToken,
55
- );
67
+ if (interactive) {
68
+ console.log(chalk.dim(" Refreshing expiring HQ session..."));
69
+ }
70
+ const refreshed = await refreshTokens(DEFAULT_COGNITO, cached.refreshToken);
56
71
  return refreshed.accessToken;
57
- } catch {
58
- // fall through to browser login
72
+ } catch (err) {
73
+ if (interactive) {
74
+ console.log(
75
+ chalk.dim(
76
+ ` Refresh failed (${err instanceof Error ? err.message : err}), falling back to browser login`,
77
+ ),
78
+ );
79
+ }
59
80
  }
60
81
  }
61
82
 
@@ -65,14 +86,25 @@ export async function ensureCognitoToken(options: {
65
86
  );
66
87
  }
67
88
 
89
+ console.log(chalk.cyan(" No cached HQ session — launching browser sign-in..."));
68
90
  const tokens = await browserLogin(DEFAULT_COGNITO);
69
91
  return tokens.accessToken;
70
92
  }
71
93
 
94
+ /** Build a VaultServiceConfig with the given access token. */
95
+ export function buildVaultConfig(authToken: string): VaultServiceConfig {
96
+ return {
97
+ apiUrl: DEFAULT_VAULT_API_URL,
98
+ authToken,
99
+ region: DEFAULT_COGNITO.region,
100
+ };
101
+ }
102
+
72
103
  /**
73
104
  * Refresh the cached Cognito session once and return the result. Used by
74
105
  * `hq auth refresh` and the `hq-auth-refresh` bin. Never opens a browser —
75
- * if no cached tokens exist or the refresh fails, throws.
106
+ * if no cached tokens exist or the refresh fails, returns `refreshed: false`
107
+ * with a reason string so the caller can decide what to do.
76
108
  */
77
109
  export async function refreshCachedSession(): Promise<{
78
110
  refreshed: boolean;