@indigoai-us/hq-cli 5.5.0 → 5.5.1

package/dist/commands/cloud.d.ts

@@ -1,6 +1,16 @@
 /**
- * hq sync commands — cloud sync management
- * Bridges hq-cli to @indigoai-us/hq-cloud
+ * `hq sync` commands — push/pull files between the local HQ tree and the
+ * company's S3 vault bucket.
+ *
+ * VLT-5 model: each command resolves a Cognito access token, asks
+ * vault-service for the company's bucket + STS-vended credentials, and
+ * runs the operation. No daemon, no init step (handled by `hq onboard`),
+ * no long-lived background process — every invocation is self-contained.
+ *
+ * Subcommands:
+ *   hq sync push [paths...]   — broadcast local file(s) to the vault
+ *   hq sync pull              — pull all permitted files from the vault
+ *   hq sync status            — show local journal summary
  */
 import { Command } from "commander";
 export declare function registerCloudCommands(program: Command): void;

package/dist/commands/cloud.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cloud.d.ts","sourceRoot":"","sources":["../../src/commands/cloud.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAGpC,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAoH5D"}
+{"version":3,"file":"cloud.d.ts","sourceRoot":"","sources":["../../src/commands/cloud.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAwBpC,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CA2L5D"}

package/dist/commands/cloud.js

@@ -1,106 +1,138 @@
 /**
- * hq sync commands — cloud sync management
- * Bridges hq-cli to @indigoai-us/hq-cloud
+ * `hq sync` commands — push/pull files between the local HQ tree and the
+ * company's S3 vault bucket.
+ *
+ * VLT-5 model: each command resolves a Cognito access token, asks
+ * vault-service for the company's bucket + STS-vended credentials, and
+ * runs the operation. No daemon, no init step (handled by `hq onboard`),
+ * no long-lived background process — every invocation is self-contained.
+ *
+ * Subcommands:
+ *   hq sync push [paths...]   — broadcast local file(s) to the vault
+ *   hq sync pull              — pull all permitted files from the vault
+ *   hq sync status            — show local journal summary
  */
-import { findHqRoot } from "../utils/manifest.js";
+import chalk from "chalk";
+import * as fs from "fs";
+import * as path from "path";
+import { share, sync, readJournal, getJournalPath, } from "@indigoai-us/hq-cloud";
+import { DEFAULT_HQ_ROOT, ensureCognitoToken, buildVaultConfig, } from "../utils/cognito-session.js";
 export function registerCloudCommands(program) {
     program
-        .command("init")
-        .description("Authenticate with IndigoAI and set up cloud sync")
-        .action(async () => {
-        try {
-            const hqRoot = findHqRoot();
-            const { initSync } = await import("@indigoai-us/hq-cloud");
-            await initSync(hqRoot);
-        }
-        catch (error) {
-            console.error("Error:", error instanceof Error ? error.message : error);
-            process.exit(1);
-        }
-    });
-    program
-        .command("start")
-        .description("Start the background sync daemon")
-        .action(async () => {
+        .command("push")
+        .description("Push local file(s) to the company vault on S3")
+        .argument("[paths...]", "Paths to push (defaults to current directory)")
+        .option("--hq-root <path>", `Local HQ tree root (default: ${DEFAULT_HQ_ROOT})`, DEFAULT_HQ_ROOT)
+        .option("--company <slug>", "Company slug or UID (defaults to active company in .hq/config.json)")
+        .option("--message <msg>", "Optional message attached to journal entries for these uploads")
+        .option("--on-conflict <strategy>", "Conflict strategy: overwrite | keep | abort (omit for interactive)")
+        .action(async (paths, options) => {
         try {
-            const hqRoot = findHqRoot();
-            const { startDaemon } = await import("@indigoai-us/hq-cloud");
-            await startDaemon(hqRoot);
-            console.log("Sync daemon started. Use 'hq sync status' to check.");
+            const targetPaths = paths && paths.length > 0 ? paths : [process.cwd()];
+            console.log(chalk.bold("\nHQ Sync — Push"));
+            console.log(`  HQ root:  ${options.hqRoot}`);
+            console.log(`  Company:  ${options.company ?? "(from .hq/config.json)"}`);
+            console.log(`  Paths:    ${targetPaths.join(", ")}\n`);
+            const accessToken = await ensureCognitoToken();
+            const result = await share({
+                paths: targetPaths,
+                company: options.company,
+                message: options.message,
+                onConflict: options.onConflict,
+                vaultConfig: buildVaultConfig(accessToken),
+                hqRoot: options.hqRoot,
+            });
+            if (result.aborted) {
+                console.log(chalk.yellow(`\n⚠ Push aborted (${result.filesUploaded} uploaded, ${result.filesSkipped} skipped)`));
+                process.exit(1);
+            }
+            console.log(chalk.green(`\n✓ Pushed ${result.filesUploaded} file(s) (${formatBytes(result.bytesUploaded)}, ${result.filesSkipped} skipped)`));
         }
-        catch (error) {
-            console.error("Error:", error instanceof Error ? error.message : error);
+        catch (err) {
+            console.error(chalk.red("\n✗ Push failed:"), err instanceof Error ? err.message : String(err));
             process.exit(1);
         }
     });
     program
-        .command("stop")
-        .description("Stop the sync daemon")
-        .action(async () => {
+        .command("pull")
+        .description("Pull permitted files from the company vault to local HQ")
+        .option("--hq-root <path>", `Local HQ tree root (default: ${DEFAULT_HQ_ROOT})`, DEFAULT_HQ_ROOT)
+        .option("--company <slug>", "Company slug or UID (defaults to active company in .hq/config.json)")
+        .option("--on-conflict <strategy>", "Conflict strategy: overwrite | keep | abort (omit for interactive)")
+        .action(async (options) => {
         try {
-            const hqRoot = findHqRoot();
-            const { stopDaemon } = await import("@indigoai-us/hq-cloud");
-            await stopDaemon(hqRoot);
-            console.log("Sync daemon stopped.");
+            console.log(chalk.bold("\nHQ Sync — Pull"));
+            console.log(`  HQ root:  ${options.hqRoot}`);
+            console.log(`  Company:  ${options.company ?? "(from .hq/config.json)"}\n`);
+            const accessToken = await ensureCognitoToken();
+            const result = await sync({
+                company: options.company,
+                onConflict: options.onConflict,
+                vaultConfig: buildVaultConfig(accessToken),
+                hqRoot: options.hqRoot,
+            });
+            if (result.aborted) {
+                console.log(chalk.yellow(`\n⚠ Pull aborted (${result.filesDownloaded} downloaded, ${result.filesSkipped} skipped, ${result.conflicts} conflicts)`));
+                process.exit(1);
+            }
+            console.log(chalk.green(`\n✓ Pulled ${result.filesDownloaded} file(s) (${formatBytes(result.bytesDownloaded)}, ${result.filesSkipped} skipped, ${result.conflicts} conflicts)`));
         }
-        catch (error) {
-            console.error("Error:", error instanceof Error ? error.message : error);
+        catch (err) {
+            console.error(chalk.red("\n✗ Pull failed:"), err instanceof Error ? err.message : String(err));
             process.exit(1);
         }
     });
     program
         .command("status")
-        .description("Show sync status")
-        .action(async () => {
+        .description("Show local sync journal summary")
+        .option("--hq-root <path>", `Local HQ tree root (default: ${DEFAULT_HQ_ROOT})`, DEFAULT_HQ_ROOT)
+        .action((options) => {
         try {
-            const hqRoot = findHqRoot();
-            const { getStatus } = await import("@indigoai-us/hq-cloud");
-            const status = await getStatus(hqRoot);
-            console.log(`  State:      ${status.running ? "running" : "stopped"}`);
-            console.log(`  Last sync:  ${status.lastSync || "never"}`);
-            console.log(`  Files:      ${status.fileCount} tracked`);
-            console.log(`  Bucket:     ${status.bucket || "not configured"}`);
-            if (status.errors.length > 0) {
-                console.log(`  Errors:     ${status.errors.length}`);
-                for (const err of status.errors.slice(0, 5)) {
-                    console.log(`    - ${err}`);
+            const journalPath = getJournalPath(options.hqRoot);
+            if (!fs.existsSync(journalPath)) {
+                console.log(chalk.dim("No sync journal yet — run `hq sync push` or `hq sync pull` to create one."));
+                console.log(chalk.dim(`  Expected at: ${journalPath}`));
+                return;
+            }
+            const journal = readJournal(options.hqRoot);
+            const entries = Object.entries(journal.files ?? {});
+            const lastSyncTimes = entries
+                .map(([, entry]) => entry.syncedAt)
+                .filter((t) => typeof t === "string")
+                .sort();
+            const lastSync = lastSyncTimes.at(-1) ?? "never";
+            const totalBytes = entries.reduce((acc, [, entry]) => acc + (entry.size ?? 0), 0);
+            const configPath = path.join(options.hqRoot, ".hq", "config.json");
+            let activeCompany;
+            if (fs.existsSync(configPath)) {
+                try {
+                    const cfg = JSON.parse(fs.readFileSync(configPath, "utf-8"));
+                    activeCompany = cfg.activeCompany;
+                }
+                catch {
+                    // ignore
                 }
             }
+            console.log(chalk.bold("\nHQ Sync — Status"));
+            console.log(`  HQ root:        ${options.hqRoot}`);
+            console.log(`  Active company: ${activeCompany ?? chalk.dim("(none)")}`);
+            console.log(`  Tracked files:  ${entries.length}`);
+            console.log(`  Total size:     ${formatBytes(totalBytes)}`);
+            console.log(`  Last sync:      ${lastSync}`);
+            console.log(`  Journal:        ${journalPath}`);
         }
-        catch (error) {
-            console.error("Error:", error instanceof Error ? error.message : error);
-            process.exit(1);
-        }
-    });
-    program
-        .command("push")
-        .description("Force push all local changes to cloud")
-        .action(async () => {
-        try {
-            const hqRoot = findHqRoot();
-            const { pushAll } = await import("@indigoai-us/hq-cloud");
-            const result = await pushAll(hqRoot);
-            console.log(`Pushed ${result.filesUploaded} files to cloud.`);
-        }
-        catch (error) {
-            console.error("Error:", error instanceof Error ? error.message : error);
-            process.exit(1);
-        }
-    });
-    program
-        .command("pull")
-        .description("Force pull all cloud changes to local")
-        .action(async () => {
-        try {
-            const hqRoot = findHqRoot();
-            const { pullAll } = await import("@indigoai-us/hq-cloud");
-            const result = await pullAll(hqRoot);
-            console.log(`Pulled ${result.filesDownloaded} files from cloud.`);
-        }
-        catch (error) {
-            console.error("Error:", error instanceof Error ? error.message : error);
+        catch (err) {
+            console.error(chalk.red("✗ Status failed:"), err instanceof Error ? err.message : String(err));
             process.exit(1);
         }
     });
 }
+function formatBytes(bytes) {
+    if (bytes === 0)
+        return "0 B";
+    const units = ["B", "KB", "MB", "GB"];
+    const exponent = Math.min(Math.floor(Math.log(bytes) / Math.log(1024)), units.length - 1);
+    const value = bytes / Math.pow(1024, exponent);
+    return `${value.toFixed(value >= 100 || exponent === 0 ? 0 : 1)} ${units[exponent]}`;
+}
 //# sourceMappingURL=cloud.js.map

package/dist/commands/cloud.js.map

@@ -1 +1 @@
-{"version":3,"file":"cloud.js","sourceRoot":"","sources":["../../src/commands/cloud.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAElD,MAAM,UAAU,qBAAqB,CAAC,OAAgB;IACpD,OAAO;SACJ,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,kDAAkD,CAAC;SAC/D,MAAM,CAAC,KAAK,IAAI,EAAE;QACjB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;YAC5B,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;YAC3D,MAAM,QAAQ,CAAC,MAAM,CAAC,CAAC;QACzB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CACX,QAAQ,EACR,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAC/C,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,OAAO;SACJ,OAAO,CAAC,OAAO,CAAC;SAChB,WAAW,CAAC,kCAAkC,CAAC;SAC/C,MAAM,CAAC,KAAK,IAAI,EAAE;QACjB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;YAC5B,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;YAC9D,MAAM,WAAW,CAAC,MAAM,CAAC,CAAC;YAC1B,OAAO,CAAC,GAAG,CAAC,qDAAqD,CAAC,CAAC;QACrE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CACX,QAAQ,EACR,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAC/C,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,OAAO;SACJ,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,sBAAsB,CAAC;SACnC,MAAM,CAAC,KAAK,IAAI,EAAE;QACjB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;YAC5B,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;YAC7D,MAAM,UAAU,CAAC,MAAM,CAAC,CAAC;YACzB,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;QACtC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CACX,QAAQ,EACR,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAC/C,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,OAAO;SACJ,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,kBAAkB,CAAC;SAC/B,MAAM,CAAC,KAAK,IAAI,EAAE;QACjB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;YAC5B,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;YAC5D,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,CAAC;YACvC,OAAO,CAAC,GAAG,CAAC,iBAAiB,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;YACvE,OAAO,CAAC,GAAG,CAAC,iBAAiB,MAAM,CAAC,QAAQ,IAAI,OAAO,EAAE,CAAC,CAAC;YAC3D,OAAO,CAAC,GAAG,CAAC,iBAAiB,MAAM,CAAC,SAAS,UAAU,CAAC,CAAC;YACzD,OAAO,CAAC,GAAG,CAAC,iBAAiB,MAAM,CAAC,MAAM,IAAI,gBAAgB,EAAE,CAAC,CAAC;YAClE,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC7B,OAAO,CAAC,GAAG,CAAC,iBAAiB,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;gBACrD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;oBAC5C,OAAO,CAAC,GAAG,CAAC,SAAS,GAAG,EAAE,CAAC,CAAC;gBAC9B,CAAC;YACH,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CACX,QAAQ,EACR,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAC/C,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,OAAO;SACJ,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,uCAAuC,CAAC;SACpD,MAAM,CAAC,KAAK,IAAI,EAAE;QACjB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;YAC5B,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;YAC1D,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;YACrC,OAAO,CAAC,GAAG,CAAC,UAAU,MAAM,CAAC,aAAa,kBAAkB,CAAC,CAAC;QAChE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CACX,QAAQ,EACR,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAC/C,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,OAAO;SACJ,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,uCAAuC,CAAC;SACpD,MAAM,CAAC,KAAK,IAAI,EAAE;QACjB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;YAC5B,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;YAC1D,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;YACrC,OAAO,CAAC,GAAG,CAAC,UAAU,MAAM,CAAC,eAAe,oBAAoB,CAAC,CAAC;QACpE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CACX,QAAQ,EACR,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAC/C,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC"}
+{"version":3,"file":"cloud.js","sourceRoot":"","sources":["../../src/commands/cloud.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAGH,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAE7B,OAAO,EACL,KAAK,EACL,IAAI,EACJ,WAAW,EACX,cAAc,GAEf,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EACL,eAAe,EACf,kBAAkB,EAClB,gBAAgB,GACjB,MAAM,6BAA6B,CAAC;AAOrC,MAAM,UAAU,qBAAqB,CAAC,OAAgB;IACpD,OAAO;SACJ,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,+CAA+C,CAAC;SAC5D,QAAQ,CAAC,YAAY,EAAE,+CAA+C,CAAC;SACvE,MAAM,CACL,kBAAkB,EAClB,gCAAgC,eAAe,GAAG,EAClD,eAAe,CAChB;SACA,MAAM,CACL,kBAAkB,EAClB,qEAAqE,CACtE;SACA,MAAM,CACL,iBAAiB,EACjB,gEAAgE,CACjE;SACA,MAAM,CACL,0BAA0B,EAC1B,oEAAoE,CACrE;SACA,MAAM,CACL,KAAK,EACH,KAAe,EACf,OAGC,EACD,EAAE;QACF,IAAI,CAAC;YACH,MAAM,WAAW,GACf,KAAK,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;YAEtD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,CAAC;YAC5C,OAAO,CAAC,GAAG,CAAC,eAAe,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;YAC7C,OAAO,CAAC,GAAG,CAAC,eAAe,OAAO,CAAC,OAAO,IAAI,wBAAwB,EAAE,CAAC,CAAC;YAC1E,OAAO,CAAC,GAAG,CAAC,eAAe,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAEvD,MAAM,WAAW,GAAG,MAAM,kBAAkB,EAAE,CAAC;YAC/C,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC;gBACzB,KAAK,EAAE,WAAW;gBAClB,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,WAAW,EAAE,gBAAgB,CAAC,WAAW,CAAC;gBAC1C,MAAM,EAAE,OAAO,CAAC,MAAM;aACvB,CAAC,CAAC;YAEH,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;gBACnB,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,MAAM,CACV,qBAAqB,MAAM,CAAC,aAAa,cAAc,MAAM,CAAC,YAAY,WAAW,CACtF,CACF,CAAC;gBACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;YAED,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,KAAK,CACT,cAAc,MAAM,CAAC,aAAa,aAAa,WAAW,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,MAAM,CAAC,YAAY,WAAW,CACpH,CACF,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CACX,KAAK,CAAC,GAAG,CAAC,kBAAkB,CAAC,EAC7B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CACjD,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CACF,CAAC;IAEJ,OAAO;SACJ,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,yDAAyD,CAAC;SACtE,MAAM,CACL,kBAAkB,EAClB,gCAAgC,eAAe,GAAG,EAClD,eAAe,CAChB;SACA,MAAM,CACL,kBAAkB,EAClB,qEAAqE,CACtE;SACA,MAAM,CACL,0BAA0B,EAC1B,oEAAoE,CACrE;SACA,MAAM,CACL,KAAK,EACH,OAEC,EACD,EAAE;QACF,IAAI,CAAC;YACH,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,CAAC;YAC5C,OAAO,CAAC,GAAG,CAAC,eAAe,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;YAC7C,OAAO,CAAC,GAAG,CAAC,eAAe,OAAO,CAAC,OAAO,IAAI,wBAAwB,IAAI,CAAC,CAAC;YAE5E,MAAM,WAAW,GAAG,MAAM,kBAAkB,EAAE,CAAC;YAC/C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC;gBACxB,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,WAAW,EAAE,gBAAgB,CAAC,WAAW,CAAC;gBAC1C,MAAM,EAAE,OAAO,CAAC,MAAM;aACvB,CAAC,CAAC;YAEH,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;gBACnB,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,MAAM,CACV,qBAAqB,MAAM,CAAC,eAAe,gBAAgB,MAAM,CAAC,YAAY,aAAa,MAAM,CAAC,SAAS,aAAa,CACzH,CACF,CAAC;gBACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;YAED,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,KAAK,CACT,cAAc,MAAM,CAAC,eAAe,aAAa,WAAW,CAAC,MAAM,CAAC,eAAe,CAAC,KAAK,MAAM,CAAC,YAAY,aAAa,MAAM,CAAC,SAAS,aAAa,CACvJ,CACF,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CACX,KAAK,CAAC,GAAG,CAAC,kBAAkB,CAAC,EAC7B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CACjD,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CACF,CAAC;IAEJ,OAAO;SACJ,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,iCAAiC,CAAC;SAC9C,MAAM,CACL,kBAAkB,EAClB,gCAAgC,eAAe,GAAG,EAClD,eAAe,CAChB;SACA,MAAM,CAAC,CAAC,OAA2B,EAAE,EAAE;QACtC,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,cAAc,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YACnD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;gBAChC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,2EAA2E,CAAC,CAAC,CAAC;gBACpG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,kBAAkB,WAAW,EAAE,CAAC,CAAC,CAAC;gBACxD,OAAO;YACT,CAAC;YAED,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YAC5C,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;YACpD,MAAM,aAAa,GAAG,OAAO;iBAC1B,GAAG,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC;iBAClC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;iBACjD,IAAI,EAAE,CAAC;YACV,MAAM,QAAQ,GAAG,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC;YACjD,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAC/B,CAAC,GAAG,EAAE,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC,EAC3C,CAAC,CACF,CAAC;YAEF,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,EAAE,aAAa,CAAC,CAAC;YACnE,IAAI,aAAiC,CAAC;YACtC,IAAI,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC9B,IAAI,CAAC;oBACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;oBAC7D,aAAa,GAAG,GAAG,CAAC,aAAa,CAAC;gBACpC,CAAC;gBAAC,MAAM,CAAC;oBACP,SAAS;gBACX,CAAC;YACH,CAAC;YAED,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,CAAC;YAC9C,OAAO,CAAC,GAAG,CAAC,qBAAqB,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;YACnD,OAAO,CAAC,GAAG,CAAC,qBAAqB,aAAa,IAAI,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;YACzE,OAAO,CAAC,GAAG,CAAC,qBAAqB,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;YACnD,OAAO,CAAC,GAAG,CAAC,qBAAqB,WAAW,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;YAC5D,OAAO,CAAC,GAAG,CAAC,qBAAqB,QAAQ,EAAE,CAAC,CAAC;YAC7C,OAAO,CAAC,GAAG,CAAC,qBAAqB,WAAW,EAAE,CAAC,CAAC;QAClD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CACX,KAAK,CAAC,GAAG,CAAC,kBAAkB,CAAC,EAC7B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CACjD,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC;AAED,SAAS,WAAW,CAAC,KAAa;IAChC,IAAI,KAAK,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9B,MAAM,KAAK,GAAG,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACtC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CACvB,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,EAC5C,KAAK,CAAC,MAAM,GAAG,CAAC,CACjB,CAAC;IACF,MAAM,KAAK,GAAG,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC/C,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,IAAI,GAAG,IAAI,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;AACvF,CAAC"}

package/dist/commands/onboard.d.ts

@@ -0,0 +1,23 @@
+/**
+ * `hq onboard` — bootstrap an HQ vault: sign in to Cognito + provision
+ * the company entity, S3 bucket, KMS key, owner membership, and STS-vended
+ * credentials in one flow.
+ *
+ * This is the "the entire flow" entry point that VLT-9 was building toward:
+ * a real user can install hq-cli and run `hq onboard create-company` once
+ * to land in a fully provisioned vault, then use `hq sync push|pull` to
+ * round-trip files against S3.
+ *
+ * Subcommands:
+ *   hq onboard create-company  — provision a brand new company
+ *   hq onboard join            — accept an invite from another user
+ *   hq onboard resume          — resume a partially-completed flow from checkpoint
+ *   hq onboard dry-run         — show what create-company would do, without doing it
+ *
+ * Auth: we cache the Cognito access + refresh tokens at ~/.hq/cognito-tokens.json.
+ * If the cached token is missing or expired beyond the refresh window, the
+ * browser-OAuth flow opens automatically.
+ */
+import { Command } from "commander";
+export declare function registerOnboardCommand(program: Command): void;
+//# sourceMappingURL=onboard.d.ts.map

package/dist/commands/onboard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"onboard.d.ts","sourceRoot":"","sources":["../../src/commands/onboard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAcpC,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CA6J7D"}

package/dist/commands/onboard.js

@@ -0,0 +1,142 @@
+/**
+ * `hq onboard` — bootstrap an HQ vault: sign in to Cognito + provision
+ * the company entity, S3 bucket, KMS key, owner membership, and STS-vended
+ * credentials in one flow.
+ *
+ * This is the "the entire flow" entry point that VLT-9 was building toward:
+ * a real user can install hq-cli and run `hq onboard create-company` once
+ * to land in a fully provisioned vault, then use `hq sync push|pull` to
+ * round-trip files against S3.
+ *
+ * Subcommands:
+ *   hq onboard create-company  — provision a brand new company
+ *   hq onboard join            — accept an invite from another user
+ *   hq onboard resume          — resume a partially-completed flow from checkpoint
+ *   hq onboard dry-run         — show what create-company would do, without doing it
+ *
+ * Auth: we cache the Cognito access + refresh tokens at ~/.hq/cognito-tokens.json.
+ * If the cached token is missing or expired beyond the refresh window, the
+ * browser-OAuth flow opens automatically.
+ */
+import chalk from "chalk";
+import { runOnboardCli } from "@indigoai-us/hq-onboarding";
+import { DEFAULT_HQ_ROOT, ensureCognitoToken, buildVaultConfig, } from "../utils/cognito-session.js";
+// ---------------------------------------------------------------------------
+// Command registration
+// ---------------------------------------------------------------------------
+export function registerOnboardCommand(program) {
+    const onboard = program
+        .command("onboard")
+        .description("Provision an HQ vault: sign in, create company, S3 bucket, STS, sync");
+    onboard
+        .command("create-company")
+        .description("Sign in and provision a brand new HQ vault for a company")
+        .requiredOption("--slug <slug>", "Company slug (used as bucket name suffix)")
+        .requiredOption("--name <name>", "Company display name")
+        .requiredOption("--email <email>", "Your email (must match Cognito sign-in)")
+        .requiredOption("--person-name <name>", "Your display name")
+        .option("--hq-root <path>", `Local HQ tree root (default: ${DEFAULT_HQ_ROOT})`, DEFAULT_HQ_ROOT)
+        .action(async (options) => {
+        try {
+            console.log(chalk.bold(`\nHQ Onboard — Create Company`));
+            console.log(`  Company:  ${options.name} (${options.slug})`);
+            console.log(`  Person:   ${options.personName} <${options.email}>`);
+            console.log(`  HQ root:  ${options.hqRoot}\n`);
+            const accessToken = await ensureCognitoToken();
+            const result = await runOnboardCli({
+                mode: "create-company",
+                personName: options.personName,
+                personEmail: options.email,
+                companyName: options.name,
+                companySlug: options.slug,
+                vaultConfig: buildVaultConfig(accessToken),
+                hqRoot: options.hqRoot,
+            });
+            if (!result.success) {
+                console.error(chalk.red(`\n✗ Onboarding failed: ${result.error}`));
+                process.exit(1);
+            }
+        }
+        catch (err) {
+            console.error(chalk.red("\n✗ Error:"), err instanceof Error ? err.message : String(err));
+            process.exit(1);
+        }
+    });
+    onboard
+        .command("join")
+        .description("Accept an invite and join an existing company")
+        .requiredOption("--invite-token <token>", "Magic link token from your invite email")
+        .requiredOption("--email <email>", "Your email (must match Cognito sign-in)")
+        .requiredOption("--person-name <name>", "Your display name")
+        .option("--hq-root <path>", `Local HQ tree root (default: ${DEFAULT_HQ_ROOT})`, DEFAULT_HQ_ROOT)
+        .action(async (options) => {
+        try {
+            console.log(chalk.bold(`\nHQ Onboard — Join Company`));
+            console.log(`  Person:   ${options.personName} <${options.email}>`);
+            console.log(`  HQ root:  ${options.hqRoot}\n`);
+            const accessToken = await ensureCognitoToken();
+            const result = await runOnboardCli({
+                mode: "join-company",
+                personName: options.personName,
+                personEmail: options.email,
+                inviteToken: options.inviteToken,
+                vaultConfig: buildVaultConfig(accessToken),
+                hqRoot: options.hqRoot,
+            });
+            if (!result.success) {
+                console.error(chalk.red(`\n✗ Join failed: ${result.error}`));
+                process.exit(1);
+            }
+        }
+        catch (err) {
+            console.error(chalk.red("\n✗ Error:"), err instanceof Error ? err.message : String(err));
+            process.exit(1);
+        }
+    });
+    onboard
+        .command("resume")
+        .description("Resume a partially-completed onboarding flow from local checkpoint")
+        .option("--hq-root <path>", `Local HQ tree root (default: ${DEFAULT_HQ_ROOT})`, DEFAULT_HQ_ROOT)
+        .action(async (options) => {
+        try {
+            const accessToken = await ensureCognitoToken();
+            const result = await runOnboardCli({
+                mode: "resume",
+                vaultConfig: buildVaultConfig(accessToken),
+                hqRoot: options.hqRoot,
+            });
+            if (!result.success) {
+                console.error(chalk.red(`\n✗ Resume failed: ${result.error}`));
+                process.exit(1);
+            }
+        }
+        catch (err) {
+            console.error(chalk.red("\n✗ Error:"), err instanceof Error ? err.message : String(err));
+            process.exit(1);
+        }
+    });
+    onboard
+        .command("dry-run")
+        .description("Show what create-company would do, without provisioning anything")
+        .option("--hq-root <path>", `Local HQ tree root (default: ${DEFAULT_HQ_ROOT})`, DEFAULT_HQ_ROOT)
+        .action(async (options) => {
+        try {
+            // No auth needed for dry-run — runOnboardCli handles this branch
+            // without touching the vault-service.
+            const result = await runOnboardCli({
+                mode: "dry-run",
+                vaultConfig: buildVaultConfig("dry-run-no-token"),
+                hqRoot: options.hqRoot,
+            });
+            if (!result.success) {
+                console.error(chalk.red(`\n✗ Dry-run failed: ${result.error}`));
+                process.exit(1);
+            }
+        }
+        catch (err) {
+            console.error(chalk.red("\n✗ Error:"), err instanceof Error ? err.message : String(err));
+            process.exit(1);
+        }
+    });
+}
+//# sourceMappingURL=onboard.js.map

package/dist/commands/onboard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"onboard.js","sourceRoot":"","sources":["../../src/commands/onboard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAGH,OAAO,KAAK,MAAM,OAAO,CAAC;AAE1B,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAC3D,OAAO,EACL,eAAe,EACf,kBAAkB,EAClB,gBAAgB,GACjB,MAAM,6BAA6B,CAAC;AAErC,8EAA8E;AAC9E,uBAAuB;AACvB,8EAA8E;AAE9E,MAAM,UAAU,sBAAsB,CAAC,OAAgB;IACrD,MAAM,OAAO,GAAG,OAAO;SACpB,OAAO,CAAC,SAAS,CAAC;SAClB,WAAW,CAAC,sEAAsE,CAAC,CAAC;IAEvF,OAAO;SACJ,OAAO,CAAC,gBAAgB,CAAC;SACzB,WAAW,CAAC,0DAA0D,CAAC;SACvE,cAAc,CAAC,eAAe,EAAE,2CAA2C,CAAC;SAC5E,cAAc,CAAC,eAAe,EAAE,sBAAsB,CAAC;SACvD,cAAc,CAAC,iBAAiB,EAAE,yCAAyC,CAAC;SAC5E,cAAc,CAAC,sBAAsB,EAAE,mBAAmB,CAAC;SAC3D,MAAM,CACL,kBAAkB,EAClB,gCAAgC,eAAe,GAAG,EAClD,eAAe,CAChB;SACA,MAAM,CAAC,KAAK,EAAE,OAMd,EAAE,EAAE;QACH,IAAI,CAAC;YACH,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC,CAAC;YACzD,OAAO,CAAC,GAAG,CAAC,eAAe,OAAO,CAAC,IAAI,KAAK,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC;YAC7D,OAAO,CAAC,GAAG,CAAC,eAAe,OAAO,CAAC,UAAU,KAAK,OAAO,CAAC,KAAK,GAAG,CAAC,CAAC;YACpE,OAAO,CAAC,GAAG,CAAC,eAAe,OAAO,CAAC,MAAM,IAAI,CAAC,CAAC;YAE/C,MAAM,WAAW,GAAG,MAAM,kBAAkB,EAAE,CAAC;YAC/C,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC;gBACjC,IAAI,EAAE,gBAAgB;gBACtB,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,WAAW,EAAE,OAAO,CAAC,KAAK;gBAC1B,WAAW,EAAE,OAAO,CAAC,IAAI;gBACzB,WAAW,EAAE,OAAO,CAAC,IAAI;gBACzB,WAAW,EAAE,gBAAgB,CAAC,WAAW,CAAC;gBAC1C,MAAM,EAAE,OAAO,CAAC,MAAM;aACvB,CAAC,CAAC;YAEH,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACpB,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,0BAA0B,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;gBACnE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CACX,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,EACvB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CACjD,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,OAAO;SACJ,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,+CAA+C,CAAC;SAC5D,cAAc,CAAC,wBAAwB,EAAE,yCAAyC,CAAC;SACnF,cAAc,CAAC,iBAAiB,EAAE,yCAAyC,CAAC;SAC5E,cAAc,CAAC,sBAAsB,EAAE,mBAAmB,CAAC;SAC3D,MAAM,CACL,kBAAkB,EAClB,gCAAgC,eAAe,GAAG,EAClD,eAAe,CAChB;SACA,MAAM,CAAC,KAAK,EAAE,OAKd,EAAE,EAAE;QACH,IAAI,CAAC;YACH,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC,CAAC;YACvD,OAAO,CAAC,GAAG,CAAC,eAAe,OAAO,CAAC,UAAU,KAAK,OAAO,CAAC,KAAK,GAAG,CAAC,CAAC;YACpE,OAAO,CAAC,GAAG,CAAC,eAAe,OAAO,CAAC,MAAM,IAAI,CAAC,CAAC;YAE/C,MAAM,WAAW,GAAG,MAAM,kBAAkB,EAAE,CAAC;YAC/C,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC;gBACjC,IAAI,EAAE,cAAc;gBACpB,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,WAAW,EAAE,OAAO,CAAC,KAAK;gBAC1B,WAAW,EAAE,OAAO,CAAC,WAAW;gBAChC,WAAW,EAAE,gBAAgB,CAAC,WAAW,CAAC;gBAC1C,MAAM,EAAE,OAAO,CAAC,MAAM;aACvB,CAAC,CAAC;YAEH,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACpB,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,oBAAoB,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;gBAC7D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CACX,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,EACvB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CACjD,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,OAAO;SACJ,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,oEAAoE,CAAC;SACjF,MAAM,CACL,kBAAkB,EAClB,gCAAgC,eAAe,GAAG,EAClD,eAAe,CAChB;SACA,MAAM,CAAC,KAAK,EAAE,OAA2B,EAAE,EAAE;QAC5C,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,MAAM,kBAAkB,EAAE,CAAC;YAC/C,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC;gBACjC,IAAI,EAAE,QAAQ;gBACd,WAAW,EAAE,gBAAgB,CAAC,WAAW,CAAC;gBAC1C,MAAM,EAAE,OAAO,CAAC,MAAM;aACvB,CAAC,CAAC;YACH,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACpB,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,sBAAsB,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;gBAC/D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CACX,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,EACvB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CACjD,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,OAAO;SACJ,OAAO,CAAC,SAAS,CAAC;SAClB,WAAW,CAAC,kEAAkE,CAAC;SAC/E,MAAM,CACL,kBAAkB,EAClB,gCAAgC,eAAe,GAAG,EAClD,eAAe,CAChB;SACA,MAAM,CAAC,KAAK,EAAE,OAA2B,EAAE,EAAE;QAC5C,IAAI,CAAC;YACH,iEAAiE;YACjE,sCAAsC;YACtC,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC;gBACjC,IAAI,EAAE,SAAS;gBACf,WAAW,EAAE,gBAAgB,CAAC,kBAAkB,CAAC;gBACjD,MAAM,EAAE,OAAO,CAAC,MAAM;aACvB,CAAC,CAAC;YACH,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACpB,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,uBAAuB,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;gBAChE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CACX,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,EACvB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CACjD,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/index.js

@@ -11,6 +11,7 @@ import { registerCloudCommands } from "./commands/cloud.js";
 import { registerLoginCommand } from "./commands/login.js";
 import { registerLogoutCommand } from "./commands/logout.js";
 import { registerWhoamiCommand } from "./commands/whoami.js";
+import { registerOnboardCommand } from "./commands/onboard.js";
 import { registerPackageInstallCommand } from "./commands/pkg-install.js";
 import { registerPackageRemoveCommand } from "./commands/pkg-remove.js";
 import { registerPackageUpdateCommand } from "./commands/pkg-update.js";
@@ -50,10 +51,12 @@ const syncCmd = program
 registerCloudCommands(syncCmd);
 // Team commands (top-level)
 registerTeamSyncCommand(program);
-// Auth commands (top-level)
+// Auth commands (top-level — registry auth via Clerk, separate from Cognito)
 registerLoginCommand(program);
 registerLogoutCommand(program);
 registerWhoamiCommand(program);
 registerAuthCommands(program);
+// Onboarding (top-level — Cognito + vault-service provisioning)
+registerOnboardCommand(program);
 program.parse();
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAEA;;GAEG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EAAE,6BAA6B,EAAE,MAAM,2BAA2B,CAAC;AAC1E,OAAO,EAAE,4BAA4B,EAAE,MAAM,0BAA0B,CAAC;AACxE,OAAO,EAAE,4BAA4B,EAAE,MAAM,0BAA0B,CAAC;AACxE,OAAO,EAAE,0BAA0B,EAAE,MAAM,wBAAwB,CAAC;AACpE,OAAO,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AAClE,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAE1D,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;AAE9B,OAAO;KACJ,IAAI,CAAC,IAAI,CAAC;KACV,WAAW,CAAC,uDAAuD,CAAC;KACpE,OAAO,CAAC,OAAO,CAAC,CAAC;AAEpB,qCAAqC;AACrC,MAAM,UAAU,GAAG,OAAO;KACvB,OAAO,CAAC,SAAS,CAAC;KAClB,WAAW,CAAC,4BAA4B,CAAC,CAAC;AAE7C,kBAAkB,CAAC,UAAU,CAAC,CAAC;AAC/B,mBAAmB,CAAC,UAAU,CAAC,CAAC;AAChC,mBAAmB,CAAC,UAAU,CAAC,CAAC;AAChC,qBAAqB,CAAC,UAAU,CAAC,CAAC;AAElC,sCAAsC;AACtC,MAAM,WAAW,GAAG,OAAO;KACxB,OAAO,CAAC,UAAU,CAAC;KACnB,WAAW,CAAC,6BAA6B,CAAC,CAAC;AAE9C,6BAA6B,CAAC,WAAW,CAAC,CAAC;AAC3C,4BAA4B,CAAC,WAAW,CAAC,CAAC;AAC1C,4BAA4B,CAAC,WAAW,CAAC,CAAC;AAC1C,0BAA0B,CAAC,WAAW,CAAC,CAAC;AAExC,2CAA2C;AAC3C,qDAAqD;AACrD,oDAAoD;AACpD,6BAA6B,CAAC,OAAO,CAAC,CAAC;AACvC,4BAA4B,CAAC,OAAO,CAAC,CAAC;AAEtC,8BAA8B;AAC9B,MAAM,OAAO,GAAG,OAAO;KACpB,OAAO,CAAC,MAAM,CAAC;KACf,WAAW,CAAC,uDAAuD,CAAC,CAAC;AAExE,qBAAqB,CAAC,OAAO,CAAC,CAAC;AAE/B,4BAA4B;AAC5B,uBAAuB,CAAC,OAAO,CAAC,CAAC;AAEjC,4BAA4B;AAC5B,oBAAoB,CAAC,OAAO,CAAC,CAAC;AAC9B,qBAAqB,CAAC,OAAO,CAAC,CAAC;AAC/B,qBAAqB,CAAC,OAAO,CAAC,CAAC;AAC/B,oBAAoB,CAAC,OAAO,CAAC,CAAC;AAE9B,OAAO,CAAC,KAAK,EAAE,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAEA;;GAEG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAC/D,OAAO,EAAE,6BAA6B,EAAE,MAAM,2BAA2B,CAAC;AAC1E,OAAO,EAAE,4BAA4B,EAAE,MAAM,0BAA0B,CAAC;AACxE,OAAO,EAAE,4BAA4B,EAAE,MAAM,0BAA0B,CAAC;AACxE,OAAO,EAAE,0BAA0B,EAAE,MAAM,wBAAwB,CAAC;AACpE,OAAO,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AAClE,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAE1D,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;AAE9B,OAAO;KACJ,IAAI,CAAC,IAAI,CAAC;KACV,WAAW,CAAC,uDAAuD,CAAC;KACpE,OAAO,CAAC,OAAO,CAAC,CAAC;AAEpB,qCAAqC;AACrC,MAAM,UAAU,GAAG,OAAO;KACvB,OAAO,CAAC,SAAS,CAAC;KAClB,WAAW,CAAC,4BAA4B,CAAC,CAAC;AAE7C,kBAAkB,CAAC,UAAU,CAAC,CAAC;AAC/B,mBAAmB,CAAC,UAAU,CAAC,CAAC;AAChC,mBAAmB,CAAC,UAAU,CAAC,CAAC;AAChC,qBAAqB,CAAC,UAAU,CAAC,CAAC;AAElC,sCAAsC;AACtC,MAAM,WAAW,GAAG,OAAO;KACxB,OAAO,CAAC,UAAU,CAAC;KACnB,WAAW,CAAC,6BAA6B,CAAC,CAAC;AAE9C,6BAA6B,CAAC,WAAW,CAAC,CAAC;AAC3C,4BAA4B,CAAC,WAAW,CAAC,CAAC;AAC1C,4BAA4B,CAAC,WAAW,CAAC,CAAC;AAC1C,0BAA0B,CAAC,WAAW,CAAC,CAAC;AAExC,2CAA2C;AAC3C,qDAAqD;AACrD,oDAAoD;AACpD,6BAA6B,CAAC,OAAO,CAAC,CAAC;AACvC,4BAA4B,CAAC,OAAO,CAAC,CAAC;AAEtC,8BAA8B;AAC9B,MAAM,OAAO,GAAG,OAAO;KACpB,OAAO,CAAC,MAAM,CAAC;KACf,WAAW,CAAC,uDAAuD,CAAC,CAAC;AAExE,qBAAqB,CAAC,OAAO,CAAC,CAAC;AAE/B,4BAA4B;AAC5B,uBAAuB,CAAC,OAAO,CAAC,CAAC;AAEjC,6EAA6E;AAC7E,oBAAoB,CAAC,OAAO,CAAC,CAAC;AAC9B,qBAAqB,CAAC,OAAO,CAAC,CAAC;AAC/B,qBAAqB,CAAC,OAAO,CAAC,CAAC;AAC/B,oBAAoB,CAAC,OAAO,CAAC,CAAC;AAE9B,gEAAgE;AAChE,sBAAsB,CAAC,OAAO,CAAC,CAAC;AAEhC,OAAO,CAAC,KAAK,EAAE,CAAC"}

package/dist/utils/cognito-session.d.ts

@@ -1,32 +1,43 @@
 /**
  * Shared Cognito session helpers for hq-cli commands.
  *
- * Consumed by `hq auth refresh` and the standalone `hq-auth-refresh` bin
- * invoked by the deploy skill (.claude/skills/deploy/SKILL.md step 4).
+ * Consumed by:
+ *   - `hq onboard` and `hq sync push|pull` (need token + VaultServiceConfig)
+ *   - `hq auth refresh` and the standalone `hq-auth-refresh` bin invoked by
+ *     the deploy skill (.claude/skills/deploy/SKILL.md step 4)
  *
- * Defaults point at the shared hq-vault-dev Cognito pool. Override via env:
+ * Defaults point at the shared hq-vault-dev Cognito pool. They mirror
+ * tools/vlt-e2e/e2e-create-company-smoke.ts so the CLI and the in-tree demo script
+ * stay drift-free. Override any of them via env:
  *
  *   AWS_REGION                 — e.g. us-east-1
  *   HQ_COGNITO_DOMAIN          — Cognito User Pool domain prefix
  *   HQ_COGNITO_CLIENT_ID       — App Client ID
  *   HQ_COGNITO_CALLBACK_PORT   — Loopback OAuth callback port
+ *   HQ_VAULT_API_URL           — vault-service API Gateway URL
  */
-import { type CognitoAuthConfig } from "@indigoai-us/hq-cloud";
+import { type CognitoAuthConfig, type VaultServiceConfig } from "@indigoai-us/hq-cloud";
 export declare const DEFAULT_COGNITO: CognitoAuthConfig;
+export declare const DEFAULT_VAULT_API_URL: string;
+export declare const DEFAULT_HQ_ROOT: string;
 /**
  * Return a non-expired Cognito access token, refreshing or browser-logging-in
  * as needed. Cache lives at ~/.hq/cognito-tokens.json.
  *
- * Pass `interactive: false` from automated contexts where failing fast is
- * better than opening a browser.
+ * Pass `interactive: false` from automated contexts (e.g. the `hq-auth-refresh`
+ * bin invoked by the deploy skill) where failing fast is better than opening
+ * a browser.
  */
 export declare function ensureCognitoToken(options?: {
     interactive?: boolean;
 }): Promise<string>;
+/** Build a VaultServiceConfig with the given access token. */
+export declare function buildVaultConfig(authToken: string): VaultServiceConfig;
 /**
  * Refresh the cached Cognito session once and return the result. Used by
  * `hq auth refresh` and the `hq-auth-refresh` bin. Never opens a browser —
- * if no cached tokens exist or the refresh fails, throws.
+ * if no cached tokens exist or the refresh fails, returns `refreshed: false`
+ * with a reason string so the caller can decide what to do.
  */
 export declare function refreshCachedSession(): Promise<{
     refreshed: boolean;

package/dist/utils/cognito-session.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cognito-session.d.ts","sourceRoot":"","sources":["../../src/utils/cognito-session.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAKL,KAAK,iBAAiB,EACvB,MAAM,uBAAuB,CAAC;AAE/B,eAAO,MAAM,eAAe,EAAE,iBAQ7B,CAAC;AAEF;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CAAC,OAAO,GAAE;IAChD,WAAW,CAAC,EAAE,OAAO,CAAC;CAClB,GAAG,OAAO,CAAC,MAAM,CAAC,CA4BvB;AAED;;;;GAIG;AACH,wBAAsB,oBAAoB,IAAI,OAAO,CAAC;IACpD,SAAS,EAAE,OAAO,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC,CAcD"}
+{"version":3,"file":"cognito-session.d.ts","sourceRoot":"","sources":["../../src/utils/cognito-session.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAKH,OAAO,EAKL,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACxB,MAAM,uBAAuB,CAAC;AAE/B,eAAO,MAAM,eAAe,EAAE,iBAO7B,CAAC;AAEF,eAAO,MAAM,qBAAqB,QAEwB,CAAC;AAE3D,eAAO,MAAM,eAAe,QAAgC,CAAC;AAE7D;;;;;;;GAOG;AACH,wBAAsB,kBAAkB,CAAC,OAAO,GAAE;IAChD,WAAW,CAAC,EAAE,OAAO,CAAC;CAClB,GAAG,OAAO,CAAC,MAAM,CAAC,CAmCvB;AAED,8DAA8D;AAC9D,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,kBAAkB,CAMtE;AAED;;;;;GAKG;AACH,wBAAsB,oBAAoB,IAAI,OAAO,CAAC;IACpD,SAAS,EAAE,OAAO,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC,CAcD"}