@indigoai-us/hq-cli 5.47.9 → 5.47.11

package/dist/commands/members.js

@@ -1,11 +1,12 @@
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="b2b63537-b45f-59d6-8783-172b7edcacd6")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="40f5379c-742e-5cd5-aba2-931856dc7dd3")}catch(e){}}();
 import chalk from "chalk";
 import { ensureCognitoToken } from "../utils/cognito-session.js";
 import { vaultApiFetch, getCompanyUid } from "../utils/vault-api.js";
 const EMAIL_PATTERN = /^[^\s]+@[^\s]+$/;
 const PERSON_UID_PATTERN = /^prs_[A-Za-z0-9_-]+$/;
 export const VALID_ROLES = new Set(["owner", "admin", "member", "guest"]);
+const VALID_MEMBER_SET_ROLES = new Set(["admin", "member"]);
 export function detectTarget(target) {
     if (EMAIL_PATTERN.test(target)) {
         return { type: "email", value: target.trim().toLowerCase() };
@@ -250,11 +251,46 @@ export async function revokeInvite(token, tokenOrKey, companyUid) {
         throw new InviteHttpError(res.status, err.message ?? err.error ?? res.statusText, err.code);
     }
 }
+async function setMemberRole(token, companyUid, membershipKey, newRole) {
+    if (!VALID_MEMBER_SET_ROLES.has(newRole)) {
+        throw new Error(`Invalid role '${newRole}': must be one of admin, member`);
+    }
+    const res = await vaultApiFetch({
+        token,
+        path: "/membership/role",
+        method: "POST",
+        body: { companyUid, membershipKey, newRole },
+    });
+    if (!res.ok) {
+        const err = (await res.json().catch(() => ({})));
+        throw new InviteHttpError(res.status, err.message ?? err.error ?? res.statusText, err.code);
+    }
+}
 export function registerMembersCommand(program) {
     const members = program
         .command("members")
         .description("Manage company memberships and invites")
         .option("--company <slug>", "Company slug (resolves to companyUid)");
+    members
+        .command("set-role <membershipKey> <role>")
+        .description("Change a member or agent role to admin or member")
+        .action(async (membershipKey, role) => {
+        try {
+            const token = await ensureCognitoToken();
+            const companySlug = members.opts().company;
+            const companyUid = await getCompanyUid(token, companySlug);
+            await setMemberRole(token, companyUid, membershipKey, role);
+            console.log(chalk.green(`Updated role for '${membershipKey}' to ${role}`));
+        }
+        catch (err) {
+            if (err instanceof InviteHttpError) {
+                console.error(chalk.red(err.message));
+                process.exit(1);
+            }
+            console.error(chalk.red("Error:"), err instanceof Error ? err.message : String(err));
+            process.exit(1);
+        }
+    });
     members
         .command("invite <target>")
         .description("Invite a person to the company by email or personUid (sends an invitation email by default)")
@@ -461,4 +497,4 @@ export function registerMembersCommand(program) {
     });
 }
 //# sourceMappingURL=members.js.map
-//# debugId=b2b63537-b45f-59d6-8783-172b7edcacd6
+//# debugId=40f5379c-742e-5cd5-aba2-931856dc7dd3

package/dist/commands/run.js

@@ -1,19 +1,36 @@
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="a1b39bbf-1f26-59e7-af70-6ecf01f2ce7e")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="26bb7e02-3864-5c66-8232-3abc8fc17dc1")}catch(e){}}();
 import { spawn } from 'node:child_process';
 import * as path from 'node:path';
 import * as fs from 'node:fs';
 import { internal } from 'varlock';
 import { ensureCognitoToken } from '../utils/cognito-session.js';
+import { computeSha256 } from '../utils/integrity.js';
 import { vaultApiFetch, getCompanyUid } from '../utils/vault-api.js';
 import { discoverSchemas } from '../run/discover-schemas.js';
 import { installHqPlugin, prewarmHqSecrets } from '../run/hq-plugin.js';
+async function buildRunUsage(scriptPath) {
+    if (!scriptPath) {
+        return undefined;
+    }
+    const resolvedPath = path.resolve(scriptPath);
+    return {
+        channel: 'run',
+        script: {
+            scriptId: resolvedPath,
+            path: resolvedPath,
+            sha256: await computeSha256(resolvedPath),
+            attestationLevel: 'self-asserted-hash',
+        },
+    };
+}
 export function registerRunCommand(program) {
     program
         .command('run')
         .description('Load secrets from .env.schema and run a command with them injected')
         .option('--company <slug>', 'Company slug (overrides @hqCompany in schema)')
         .option('--schema <path>', 'Explicit schema path (skips walk-up discovery)')
+        .option('--script <path>', 'Attach local script identity for script-locked secrets')
         .option('--check', 'Resolve schema and validate vars without executing the command')
         .allowUnknownOption(true)
         .action(async (opts) => {
@@ -53,22 +70,34 @@ export function registerRunCommand(program) {
             }
             const token = await ensureCognitoToken();
             const uid = await getCompanyUid(token, slug);
-            const fetchBatch = async (companyUid, names) => {
+            const usage = await buildRunUsage(opts.script);
+            const fetchBatch = async (companyUid, names, requestUsage) => {
                 const res = await vaultApiFetch({
                     token,
                     path: `/secrets/${encodeURIComponent(companyUid)}/load`,
                     method: 'POST',
-                    body: { names },
+                    body: requestUsage ? { names, usage: requestUsage } : { names },
                 });
                 if (!res.ok) {
                     const body = await res.json().catch(() => ({}));
-                    throw new Error(`Failed to batch-load secrets: ${body.error ?? res.statusText}`);
+                    const message = typeof body.message === 'string'
+                        ? body.message
+                        : typeof body.error === 'string'
+                            ? body.error
+                            : res.statusText;
+                    if (res.status >= 400 &&
+                        res.status < 500 &&
+                        typeof body.code === 'string') {
+                        throw new Error(message);
+                    }
+                    throw new Error(`Failed to batch-load secrets: ${message}`);
                 }
                 return res.json();
             };
             const pluginOpts = {
                 companyOverride: opts.company,
                 resolveCompanyUid: async () => uid,
+                usage,
                 fetchBatch,
             };
             // LAST entry = highest precedence; .env.local files trail .env.schema files so any .env.local beats any schema regardless of depth.
@@ -116,4 +145,4 @@ export function registerRunCommand(program) {
     });
 }
 //# sourceMappingURL=run.js.map
-//# debugId=a1b39bbf-1f26-59e7-af70-6ecf01f2ce7e
+//# debugId=26bb7e02-3864-5c66-8232-3abc8fc17dc1

package/dist/commands/secrets.d.ts

@@ -2,6 +2,40 @@ import { Command } from "commander";
 import { vaultApiFetch, getCompanyUid, getEntityUid } from "../utils/vault-api.js";
 export type { VaultApiOptions } from "../utils/vault-api.js";
 export { vaultApiFetch, getCompanyUid, getEntityUid };
-export declare function loadRevealedSecrets(token: string, companyUid: string, keys: string[]): Promise<Map<string, string>>;
+export type SecretTier = "standard" | "sensitive" | "nuclear";
+export type SecretScriptLockMode = "off" | "enforced";
+export type SecretUsageChannel = "run" | "exec" | "env" | "reveal" | "submit-link";
+export interface SecretScriptUsage {
+    scriptId: string;
+    path: string;
+    sha256: string;
+    attestationLevel: string;
+}
+export interface SecretUsage {
+    channel: SecretUsageChannel;
+    reason?: string;
+    script?: SecretScriptUsage;
+}
+export interface SecretMetadata {
+    tier?: SecretTier;
+    scriptLock?: {
+        mode?: SecretScriptLockMode;
+        requiredAttestation?: string;
+    };
+    cacheTtlMs?: number;
+}
+export interface SecretLoadSuccessRow extends SecretMetadata {
+    name: string;
+    value?: string;
+}
+export interface SecretLoadResponse {
+    secrets: SecretLoadSuccessRow[];
+    errors: Array<{
+        name: string;
+        code: string;
+        message?: string;
+    }>;
+}
+export declare function loadRevealedSecrets(token: string, companyUid: string, keys: string[], usage?: SecretUsage): Promise<Map<string, string>>;
 export declare function registerSecretsCommand(program: Command): void;
 //# sourceMappingURL=secrets.d.ts.map