@indigoai-us/hq-cli 5.5.0 → 5.5.2-sentry-rc.0

package/src/utils/secrets-cache.ts

@@ -0,0 +1,130 @@
+import * as crypto from "node:crypto";
+import * as fs from "node:fs";
+import * as path from "node:path";
+import * as os from "node:os";
+
+const CACHE_DIR = path.join(os.homedir(), ".hq", "secrets-cache");
+const KEY_PATH = path.join(CACHE_DIR, ".key");
+const TTL_MS = 5 * 60 * 1000;
+const ALGORITHM = "aes-256-gcm";
+const IV_BYTES = 12;
+const AUTH_TAG_BYTES = 16;
+
+function ensureCacheDir(companyUid: string): void {
+  const dir = path.join(CACHE_DIR, companyUid);
+  fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+}
+
+function validateInputs(companyUid: string, name: string): boolean {
+  if (!companyUid || companyUid.includes("/") || companyUid.includes("..")) return false;
+  if (!/^[A-Z][A-Z0-9_]*(?:\/[A-Z][A-Z0-9_]+)*$/.test(name)) return false;
+  return true;
+}
+
+function getOrCreateKey(): Buffer {
+  try {
+    const key = fs.readFileSync(KEY_PATH);
+    if (key.length === 32) {
+      const mode = fs.statSync(KEY_PATH).mode & 0o777;
+      if (mode !== 0o600) {
+        process.stderr.write(`Warning: secrets cache key has permissions ${mode.toString(8)}, expected 600\n`);
+      }
+      return key;
+    }
+  } catch {
+    // Key doesn't exist or is unreadable — generate a new one
+  }
+  fs.mkdirSync(CACHE_DIR, { recursive: true, mode: 0o700 });
+  const key = crypto.randomBytes(32);
+  const tmpPath = `${KEY_PATH}.tmp.${process.pid}`;
+  fs.writeFileSync(tmpPath, key, { mode: 0o600 });
+  fs.renameSync(tmpPath, KEY_PATH);
+  return fs.readFileSync(KEY_PATH);
+}
+
+export function readCache(companyUid: string, name: string): string | null {
+  if (!validateInputs(companyUid, name)) return null;
+  const filePath = path.join(CACHE_DIR, companyUid, name);
+  let raw: Buffer;
+  try {
+    raw = fs.readFileSync(filePath);
+  } catch {
+    return null;
+  }
+
+  // Format: [8 bytes timestamp][12 bytes IV][16 bytes authTag][...ciphertext]
+  const headerLen = 8 + IV_BYTES + AUTH_TAG_BYTES;
+  if (raw.length < headerLen) return null;
+
+  const timestampMs = Number(raw.readBigInt64BE(0));
+  if (Date.now() - timestampMs > TTL_MS) {
+    try { fs.unlinkSync(filePath); } catch { /* ok */ }
+    return null;
+  }
+
+  const iv = raw.subarray(8, 8 + IV_BYTES);
+  const authTag = raw.subarray(8 + IV_BYTES, headerLen);
+  const ciphertext = raw.subarray(headerLen);
+
+  let key: Buffer;
+  try {
+    key = getOrCreateKey();
+  } catch {
+    return null;
+  }
+
+  try {
+    const decipher = crypto.createDecipheriv(ALGORITHM, key, iv);
+    decipher.setAuthTag(authTag);
+    const decrypted = Buffer.concat([decipher.update(ciphertext), decipher.final()]);
+    return decrypted.toString("utf8");
+  } catch {
+    try { fs.unlinkSync(filePath); } catch { /* ok */ }
+    return null;
+  }
+}
+
+export function writeCache(companyUid: string, name: string, value: string): void {
+  try {
+    if (!validateInputs(companyUid, name)) return;
+    ensureCacheDir(companyUid);
+    const key = getOrCreateKey();
+    const iv = crypto.randomBytes(IV_BYTES);
+    const cipher = crypto.createCipheriv(ALGORITHM, key, iv);
+    const encrypted = Buffer.concat([cipher.update(value, "utf8"), cipher.final()]);
+    const authTag = cipher.getAuthTag();
+
+    const timestamp = Buffer.alloc(8);
+    timestamp.writeBigInt64BE(BigInt(Date.now()));
+
+    const out = Buffer.concat([timestamp, iv, authTag, encrypted]);
+    const filePath = path.join(CACHE_DIR, companyUid, name);
+    fs.mkdirSync(path.dirname(filePath), { recursive: true, mode: 0o700 });
+    const tmpPath = `${filePath}.tmp.${process.pid}`;
+    fs.writeFileSync(tmpPath, out, { mode: 0o600 });
+    fs.renameSync(tmpPath, filePath);
+  } catch {
+    // Cache write failure is non-fatal
+  }
+}
+
+export function removeCacheEntry(companyUid: string, name: string): void {
+  if (!validateInputs(companyUid, name)) return;
+  const filePath = path.join(CACHE_DIR, companyUid, name);
+  try {
+    fs.unlinkSync(filePath);
+  } catch {
+    // Cache entry may not exist
+  }
+}
+
+export function clearAllCache(): { removed: number } {
+  let removed = 0;
+  try {
+    fs.rmSync(CACHE_DIR, { recursive: true, force: true });
+    removed = 1;
+  } catch {
+    // Cache dir may not exist
+  }
+  return { removed };
+}

package/tsconfig.json

@@ -4,5 +4,6 @@
     "outDir": "dist",
     "rootDir": "src"
   },
-  "include": ["src"]
+  "include": ["src"],
+  "exclude": ["src/**/*.test.ts"]
 }

package/dist/utils/auth.d.ts

@@ -1,27 +0,0 @@
-/**
- * Auth utilities — OAuth PKCE flow for Clerk (US-004)
- *
- * Token values are NEVER written to stdout or logs.
- */
-import type { AuthToken } from './token-store.js';
-/**
- * Start the OAuth PKCE auth flow:
- * 1. Generate PKCE code_verifier + code_challenge
- * 2. Start local HTTP server on a random port for the callback
- * 3. Open browser to Clerk auth URL
- * 4. Wait for callback with auth code
- * 5. Exchange code for token via registry /auth/token endpoint
- * 6. Return AuthToken
- */
-export declare function startAuthFlow(registryUrl: string): Promise<AuthToken>;
-/**
- * Get a valid auth token:
- * 1. Load from store
- * 2. If expired or within 5 min buffer: try refresh
- * 3. If refresh fails: throw with message to re-login
- * 4. Return valid token
- *
- * Token values are NEVER written to stdout.
- */
-export declare function getAuthToken(): Promise<AuthToken>;
-//# sourceMappingURL=auth.d.ts.map

package/dist/utils/auth.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/utils/auth.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAOH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAgClD;;;;;;;;GAQG;AACH,wBAAsB,aAAa,CACjC,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,SAAS,CAAC,CA6FpB;AAED;;;;;;;;GAQG;AACH,wBAAsB,YAAY,IAAI,OAAO,CAAC,SAAS,CAAC,CAkCvD"}

package/dist/utils/auth.js

@@ -1,155 +0,0 @@
-/**
- * Auth utilities — OAuth PKCE flow for Clerk (US-004)
- *
- * Token values are NEVER written to stdout or logs.
- */
-import * as crypto from 'crypto';
-import * as http from 'http';
-import { exec } from 'child_process';
-import { saveToken, loadToken, isTokenExpired } from './token-store.js';
-import { getRegistryUrl } from './registry-client.js';
-/**
- * Generate a cryptographically random PKCE code verifier (43-128 chars, URL-safe).
- */
-function generateCodeVerifier() {
-    return crypto.randomBytes(32).toString('base64url');
-}
-/**
- * Derive the PKCE code challenge from the verifier (S256).
- */
-function generateCodeChallenge(verifier) {
-    return crypto.createHash('sha256').update(verifier).digest('base64url');
-}
-/**
- * Open a URL in the default browser (macOS / Linux).
- */
-function openBrowser(url) {
-    const command = process.platform === 'darwin' ? `open "${url}"` : `xdg-open "${url}"`;
-    exec(command, (err) => {
-        if (err) {
-            // Non-fatal — user can manually open the URL
-            console.error(`Could not open browser automatically. Please visit:\n  ${url}`);
-        }
-    });
-}
-/**
- * Start the OAuth PKCE auth flow:
- * 1. Generate PKCE code_verifier + code_challenge
- * 2. Start local HTTP server on a random port for the callback
- * 3. Open browser to Clerk auth URL
- * 4. Wait for callback with auth code
- * 5. Exchange code for token via registry /auth/token endpoint
- * 6. Return AuthToken
- */
-export async function startAuthFlow(registryUrl) {
-    const codeVerifier = generateCodeVerifier();
-    const codeChallenge = generateCodeChallenge(codeVerifier);
-    return new Promise((resolve, reject) => {
-        const server = http.createServer(async (req, res) => {
-            try {
-                const url = new URL(req.url ?? '/', `http://localhost`);
-                if (url.pathname !== '/callback') {
-                    res.writeHead(404);
-                    res.end('Not found');
-                    return;
-                }
-                const code = url.searchParams.get('code');
-                const error = url.searchParams.get('error');
-                if (error) {
-                    res.writeHead(200, { 'Content-Type': 'text/html' });
-                    res.end('<html><body><h2>Authentication failed</h2><p>You can close this window.</p></body></html>');
-                    server.close();
-                    reject(new Error(`Auth failed: ${error}`));
-                    return;
-                }
-                if (!code) {
-                    res.writeHead(400, { 'Content-Type': 'text/html' });
-                    res.end('<html><body><h2>Missing auth code</h2><p>You can close this window.</p></body></html>');
-                    server.close();
-                    reject(new Error('No authorization code received'));
-                    return;
-                }
-                // Exchange code for token
-                const tokenResponse = await fetch(`${registryUrl}/auth/token`, {
-                    method: 'POST',
-                    headers: { 'Content-Type': 'application/json' },
-                    body: JSON.stringify({
-                        code,
-                        code_verifier: codeVerifier,
-                        redirect_uri: `http://localhost:${server.address().port}/callback`,
-                    }),
-                });
-                if (!tokenResponse.ok) {
-                    const body = await tokenResponse.text();
-                    res.writeHead(200, { 'Content-Type': 'text/html' });
-                    res.end('<html><body><h2>Token exchange failed</h2><p>You can close this window.</p></body></html>');
-                    server.close();
-                    reject(new Error(`Token exchange failed (${tokenResponse.status}): ${body}`));
-                    return;
-                }
-                const tokenData = (await tokenResponse.json());
-                res.writeHead(200, { 'Content-Type': 'text/html' });
-                res.end('<html><body><h2>Authenticated!</h2><p>You can close this window and return to the terminal.</p></body></html>');
-                server.close();
-                resolve(tokenData);
-            }
-            catch (err) {
-                server.close();
-                reject(err);
-            }
-        });
-        // Listen on random port
-        server.listen(0, '127.0.0.1', () => {
-            const addr = server.address();
-            const redirectUri = `http://localhost:${addr.port}/callback`;
-            const authUrl = `${registryUrl}/auth/login?redirect_uri=${encodeURIComponent(redirectUri)}&code_challenge=${codeChallenge}&code_challenge_method=S256`;
-            console.log('Opening browser for authentication...');
-            openBrowser(authUrl);
-            console.log(`\nIf the browser doesn't open, visit:\n  ${authUrl}\n`);
-        });
-        // Timeout after 2 minutes
-        setTimeout(() => {
-            server.close();
-            reject(new Error('Authentication timed out after 2 minutes'));
-        }, 120_000);
-    });
-}
-/**
- * Get a valid auth token:
- * 1. Load from store
- * 2. If expired or within 5 min buffer: try refresh
- * 3. If refresh fails: throw with message to re-login
- * 4. Return valid token
- *
- * Token values are NEVER written to stdout.
- */
-export async function getAuthToken() {
-    const token = await loadToken();
-    if (!token) {
-        throw new Error("Not logged in. Run 'hq login' to authenticate.");
-    }
-    if (!isTokenExpired(token)) {
-        return token;
-    }
-    // Attempt refresh
-    try {
-        const registryUrl = getRegistryUrl();
-        const refreshResponse = await fetch(`${registryUrl}/auth/refresh`, {
-            method: 'POST',
-            headers: { 'Content-Type': 'application/json' },
-            body: JSON.stringify({
-                clerk_session_token: token.clerk_session_token,
-            }),
-        });
-        if (refreshResponse.ok) {
-            const refreshedToken = (await refreshResponse.json());
-            await saveToken(refreshedToken);
-            return refreshedToken;
-        }
-    }
-    catch {
-        // Refresh failed — fall through to error
-    }
-    throw new Error("Session expired. Run 'hq login' to re-authenticate.");
-}
-//# sourceMappingURL=auth.js.map

package/dist/utils/auth.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/utils/auth.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,MAAM,MAAM,QAAQ,CAAC;AACjC,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AACrC,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AACxE,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAGtD;;GAEG;AACH,SAAS,oBAAoB;IAC3B,OAAO,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AACtD,CAAC;AAED;;GAEG;AACH,SAAS,qBAAqB,CAAC,QAAgB;IAC7C,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;AAC1E,CAAC;AAED;;GAEG;AACH,SAAS,WAAW,CAAC,GAAW;IAC9B,MAAM,OAAO,GACX,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,GAAG,GAAG,CAAC,CAAC,CAAC,aAAa,GAAG,GAAG,CAAC;IACxE,IAAI,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;QACpB,IAAI,GAAG,EAAE,CAAC;YACR,6CAA6C;YAC7C,OAAO,CAAC,KAAK,CACX,0DAA0D,GAAG,EAAE,CAChE,CAAC;QACJ,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,WAAmB;IAEnB,MAAM,YAAY,GAAG,oBAAoB,EAAE,CAAC;IAC5C,MAAM,aAAa,GAAG,qBAAqB,CAAC,YAAY,CAAC,CAAC;IAE1D,OAAO,IAAI,OAAO,CAAY,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAChD,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;YAClD,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,kBAAkB,CAAC,CAAC;gBAExD,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW,EAAE,CAAC;oBACjC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;oBACnB,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;oBACrB,OAAO;gBACT,CAAC;gBAED,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;gBAC1C,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;gBAE5C,IAAI,KAAK,EAAE,CAAC;oBACV,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;oBACpD,GAAG,CAAC,GAAG,CACL,2FAA2F,CAC5F,CAAC;oBACF,MAAM,CAAC,KAAK,EAAE,CAAC;oBACf,MAAM,CAAC,IAAI,KAAK,CAAC,gBAAgB,KAAK,EAAE,CAAC,CAAC,CAAC;oBAC3C,OAAO;gBACT,CAAC;gBAED,IAAI,CAAC,IAAI,EAAE,CAAC;oBACV,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;oBACpD,GAAG,CAAC,GAAG,CACL,uFAAuF,CACxF,CAAC;oBACF,MAAM,CAAC,KAAK,EAAE,CAAC;oBACf,MAAM,CAAC,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC,CAAC;oBACpD,OAAO;gBACT,CAAC;gBAED,0BAA0B;gBAC1B,MAAM,aAAa,GAAG,MAAM,KAAK,CAAC,GAAG,WAAW,aAAa,EAAE;oBAC7D,MAAM,EAAE,MAAM;oBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;oBAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;wBACnB,IAAI;wBACJ,aAAa,EAAE,YAAY;wBAC3B,YAAY,EAAE,oBAAqB,MAAM,CAAC,OAAO,EAAuB,CAAC,IAAI,WAAW;qBACzF,CAAC;iBACH,CAAC,CAAC;gBAEH,IAAI,CAAC,aAAa,CAAC,EAAE,EAAE,CAAC;oBACtB,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,IAAI,EAAE,CAAC;oBACxC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;oBACpD,GAAG,CAAC,GAAG,CACL,2FAA2F,CAC5F,CAAC;oBACF,MAAM,CAAC,KAAK,EAAE,CAAC;oBACf,MAAM,CACJ,IAAI,KAAK,CAAC,0BAA0B,aAAa,CAAC,MAAM,MAAM,IAAI,EAAE,CAAC,CACtE,CAAC;oBACF,OAAO;gBACT,CAAC;gBAED,MAAM,SAAS,GAAG,CAAC,MAAM,aAAa,CAAC,IAAI,EAAE,CAAc,CAAC;gBAE5D,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;gBACpD,GAAG,CAAC,GAAG,CACL,+GAA+G,CAChH,CAAC;gBACF,MAAM,CAAC,KAAK,EAAE,CAAC;gBACf,OAAO,CAAC,SAAS,CAAC,CAAC;YACrB,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,CAAC,KAAK,EAAE,CAAC;gBACf,MAAM,CAAC,GAAG,CAAC,CAAC;YACd,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,wBAAwB;QACxB,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE;YACjC,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,EAAsB,CAAC;YAClD,MAAM,WAAW,GAAG,oBAAoB,IAAI,CAAC,IAAI,WAAW,CAAC;YAC7D,MAAM,OAAO,GAAG,GAAG,WAAW,4BAA4B,kBAAkB,CAAC,WAAW,CAAC,mBAAmB,aAAa,6BAA6B,CAAC;YAEvJ,OAAO,CAAC,GAAG,CAAC,uCAAuC,CAAC,CAAC;YACrD,WAAW,CAAC,OAAO,CAAC,CAAC;YACrB,OAAO,CAAC,GAAG,CAAC,4CAA4C,OAAO,IAAI,CAAC,CAAC;QACvE,CAAC,CAAC,CAAC;QAEH,0BAA0B;QAC1B,UAAU,CAAC,GAAG,EAAE;YACd,MAAM,CAAC,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC,CAAC;QAChE,CAAC,EAAE,OAAO,CAAC,CAAC;IACd,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY;IAChC,MAAM,KAAK,GAAG,MAAM,SAAS,EAAE,CAAC;IAEhC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,CAAC;IAED,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,kBAAkB;IAClB,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,cAAc,EAAE,CAAC;QACrC,MAAM,eAAe,GAAG,MAAM,KAAK,CAAC,GAAG,WAAW,eAAe,EAAE;YACjE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;aAC/C,CAAC;SACH,CAAC,CAAC;QAEH,IAAI,eAAe,CAAC,EAAE,EAAE,CAAC;YACvB,MAAM,cAAc,GAAG,CAAC,MAAM,eAAe,CAAC,IAAI,EAAE,CAAc,CAAC;YACnE,MAAM,SAAS,CAAC,cAAc,CAAC,CAAC;YAChC,OAAO,cAAc,CAAC;QACxB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,yCAAyC;IAC3C,CAAC;IAED,MAAM,IAAI,KAAK,CACb,qDAAqD,CACtD,CAAC;AACJ,CAAC"}

package/dist/utils/token-store.d.ts

@@ -1,28 +0,0 @@
-/**
- * Auth token store — manages ~/.hq/auth.json with secure file permissions (US-004)
- */
-export interface AuthToken {
-    clerk_session_token: string;
-    user_id: string;
-    email: string;
-    expires_at: string;
-}
-/**
- * Save auth token to ~/.hq/auth.json with 0600 permissions.
- * Token content is never logged or written to stdout.
- */
-export declare function saveToken(token: AuthToken): Promise<void>;
-/**
- * Load auth token from ~/.hq/auth.json.
- * Returns null if file is missing, unreadable, or contains invalid JSON.
- */
-export declare function loadToken(): Promise<AuthToken | null>;
-/**
- * Delete the auth token file.
- */
-export declare function clearToken(): Promise<void>;
-/**
- * Check if a token is expired or within 5 minutes of expiry.
- */
-export declare function isTokenExpired(token: AuthToken): boolean;
-//# sourceMappingURL=token-store.d.ts.map

package/dist/utils/token-store.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"token-store.d.ts","sourceRoot":"","sources":["../../src/utils/token-store.ts"],"names":[],"mappings":"AAAA;;GAEG;AAMH,MAAM,WAAW,SAAS;IACxB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;CACpB;AAWD;;;GAGG;AACH,wBAAsB,SAAS,CAAC,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAI/D;AAED;;;GAGG;AACH,wBAAsB,SAAS,IAAI,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAsB3D;AAED;;GAEG;AACH,wBAAsB,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC,CAQhD;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,SAAS,GAAG,OAAO,CAIxD"}

package/dist/utils/token-store.js

@@ -1,68 +0,0 @@
-/**
- * Auth token store — manages ~/.hq/auth.json with secure file permissions (US-004)
- */
-import * as fs from 'fs';
-import * as path from 'path';
-import * as os from 'os';
-const HQ_DIR = path.join(os.homedir(), '.hq');
-const AUTH_FILE = path.join(HQ_DIR, 'auth.json');
-function ensureHqDir() {
-    if (!fs.existsSync(HQ_DIR)) {
-        fs.mkdirSync(HQ_DIR, { recursive: true, mode: 0o700 });
-    }
-}
-/**
- * Save auth token to ~/.hq/auth.json with 0600 permissions.
- * Token content is never logged or written to stdout.
- */
-export async function saveToken(token) {
-    ensureHqDir();
-    const content = JSON.stringify(token, null, 2);
-    fs.writeFileSync(AUTH_FILE, content, { mode: 0o600 });
-}
-/**
- * Load auth token from ~/.hq/auth.json.
- * Returns null if file is missing, unreadable, or contains invalid JSON.
- */
-export async function loadToken() {
-    try {
-        if (!fs.existsSync(AUTH_FILE)) {
-            return null;
-        }
-        const content = fs.readFileSync(AUTH_FILE, 'utf-8');
-        const parsed = JSON.parse(content);
-        // Validate required fields
-        if (typeof parsed.clerk_session_token !== 'string' ||
-            typeof parsed.user_id !== 'string' ||
-            typeof parsed.email !== 'string' ||
-            typeof parsed.expires_at !== 'string') {
-            return null;
-        }
-        return parsed;
-    }
-    catch {
-        return null;
-    }
-}
-/**
- * Delete the auth token file.
- */
-export async function clearToken() {
-    try {
-        if (fs.existsSync(AUTH_FILE)) {
-            fs.unlinkSync(AUTH_FILE);
-        }
-    }
-    catch {
-        // Ignore errors — file may already be gone
-    }
-}
-/**
- * Check if a token is expired or within 5 minutes of expiry.
- */
-export function isTokenExpired(token) {
-    const expiresAt = new Date(token.expires_at).getTime();
-    const bufferMs = 5 * 60 * 1000; // 5 minutes
-    return Date.now() >= expiresAt - bufferMs;
-}
-//# sourceMappingURL=token-store.js.map

package/dist/utils/token-store.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"token-store.js","sourceRoot":"","sources":["../../src/utils/token-store.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AASzB,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,KAAK,CAAC,CAAC;AAC9C,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;AAEjD,SAAS,WAAW;IAClB,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3B,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACzD,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,KAAgB;IAC9C,WAAW,EAAE,CAAC;IACd,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAC/C,EAAE,CAAC,aAAa,CAAC,SAAS,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;AACxD,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS;IAC7B,IAAI,CAAC;QACH,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC9B,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QACpD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAEnC,2BAA2B;QAC3B,IACE,OAAO,MAAM,CAAC,mBAAmB,KAAK,QAAQ;YAC9C,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ;YAClC,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ;YAChC,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ,EACrC,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,MAAmB,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU;IAC9B,IAAI,CAAC;QACH,IAAI,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC7B,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,2CAA2C;IAC7C,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,cAAc,CAAC,KAAgB;IAC7C,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,CAAC;IACvD,MAAM,QAAQ,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,YAAY;IAC5C,OAAO,IAAI,CAAC,GAAG,EAAE,IAAI,SAAS,GAAG,QAAQ,CAAC;AAC5C,CAAC"}

package/src/utils/auth.ts

@@ -1,193 +0,0 @@
-/**
- * Auth utilities — OAuth PKCE flow for Clerk (US-004)
- *
- * Token values are NEVER written to stdout or logs.
- */
-
-import * as crypto from 'crypto';
-import * as http from 'http';
-import { exec } from 'child_process';
-import { saveToken, loadToken, isTokenExpired } from './token-store.js';
-import { getRegistryUrl } from './registry-client.js';
-import type { AuthToken } from './token-store.js';
-
-/**
- * Generate a cryptographically random PKCE code verifier (43-128 chars, URL-safe).
- */
-function generateCodeVerifier(): string {
-  return crypto.randomBytes(32).toString('base64url');
-}
-
-/**
- * Derive the PKCE code challenge from the verifier (S256).
- */
-function generateCodeChallenge(verifier: string): string {
-  return crypto.createHash('sha256').update(verifier).digest('base64url');
-}
-
-/**
- * Open a URL in the default browser (macOS / Linux).
- */
-function openBrowser(url: string): void {
-  const command =
-    process.platform === 'darwin' ? `open "${url}"` : `xdg-open "${url}"`;
-  exec(command, (err) => {
-    if (err) {
-      // Non-fatal — user can manually open the URL
-      console.error(
-        `Could not open browser automatically. Please visit:\n  ${url}`
-      );
-    }
-  });
-}
-
-/**
- * Start the OAuth PKCE auth flow:
- * 1. Generate PKCE code_verifier + code_challenge
- * 2. Start local HTTP server on a random port for the callback
- * 3. Open browser to Clerk auth URL
- * 4. Wait for callback with auth code
- * 5. Exchange code for token via registry /auth/token endpoint
- * 6. Return AuthToken
- */
-export async function startAuthFlow(
-  registryUrl: string
-): Promise<AuthToken> {
-  const codeVerifier = generateCodeVerifier();
-  const codeChallenge = generateCodeChallenge(codeVerifier);
-
-  return new Promise<AuthToken>((resolve, reject) => {
-    const server = http.createServer(async (req, res) => {
-      try {
-        const url = new URL(req.url ?? '/', `http://localhost`);
-
-        if (url.pathname !== '/callback') {
-          res.writeHead(404);
-          res.end('Not found');
-          return;
-        }
-
-        const code = url.searchParams.get('code');
-        const error = url.searchParams.get('error');
-
-        if (error) {
-          res.writeHead(200, { 'Content-Type': 'text/html' });
-          res.end(
-            '<html><body><h2>Authentication failed</h2><p>You can close this window.</p></body></html>'
-          );
-          server.close();
-          reject(new Error(`Auth failed: ${error}`));
-          return;
-        }
-
-        if (!code) {
-          res.writeHead(400, { 'Content-Type': 'text/html' });
-          res.end(
-            '<html><body><h2>Missing auth code</h2><p>You can close this window.</p></body></html>'
-          );
-          server.close();
-          reject(new Error('No authorization code received'));
-          return;
-        }
-
-        // Exchange code for token
-        const tokenResponse = await fetch(`${registryUrl}/auth/token`, {
-          method: 'POST',
-          headers: { 'Content-Type': 'application/json' },
-          body: JSON.stringify({
-            code,
-            code_verifier: codeVerifier,
-            redirect_uri: `http://localhost:${(server.address() as { port: number }).port}/callback`,
-          }),
-        });
-
-        if (!tokenResponse.ok) {
-          const body = await tokenResponse.text();
-          res.writeHead(200, { 'Content-Type': 'text/html' });
-          res.end(
-            '<html><body><h2>Token exchange failed</h2><p>You can close this window.</p></body></html>'
-          );
-          server.close();
-          reject(
-            new Error(`Token exchange failed (${tokenResponse.status}): ${body}`)
-          );
-          return;
-        }
-
-        const tokenData = (await tokenResponse.json()) as AuthToken;
-
-        res.writeHead(200, { 'Content-Type': 'text/html' });
-        res.end(
-          '<html><body><h2>Authenticated!</h2><p>You can close this window and return to the terminal.</p></body></html>'
-        );
-        server.close();
-        resolve(tokenData);
-      } catch (err) {
-        server.close();
-        reject(err);
-      }
-    });
-
-    // Listen on random port
-    server.listen(0, '127.0.0.1', () => {
-      const addr = server.address() as { port: number };
-      const redirectUri = `http://localhost:${addr.port}/callback`;
-      const authUrl = `${registryUrl}/auth/login?redirect_uri=${encodeURIComponent(redirectUri)}&code_challenge=${codeChallenge}&code_challenge_method=S256`;
-
-      console.log('Opening browser for authentication...');
-      openBrowser(authUrl);
-      console.log(`\nIf the browser doesn't open, visit:\n  ${authUrl}\n`);
-    });
-
-    // Timeout after 2 minutes
-    setTimeout(() => {
-      server.close();
-      reject(new Error('Authentication timed out after 2 minutes'));
-    }, 120_000);
-  });
-}
-
-/**
- * Get a valid auth token:
- * 1. Load from store
- * 2. If expired or within 5 min buffer: try refresh
- * 3. If refresh fails: throw with message to re-login
- * 4. Return valid token
- *
- * Token values are NEVER written to stdout.
- */
-export async function getAuthToken(): Promise<AuthToken> {
-  const token = await loadToken();
-
-  if (!token) {
-    throw new Error("Not logged in. Run 'hq login' to authenticate.");
-  }
-
-  if (!isTokenExpired(token)) {
-    return token;
-  }
-
-  // Attempt refresh
-  try {
-    const registryUrl = getRegistryUrl();
-    const refreshResponse = await fetch(`${registryUrl}/auth/refresh`, {
-      method: 'POST',
-      headers: { 'Content-Type': 'application/json' },
-      body: JSON.stringify({
-        clerk_session_token: token.clerk_session_token,
-      }),
-    });
-
-    if (refreshResponse.ok) {
-      const refreshedToken = (await refreshResponse.json()) as AuthToken;
-      await saveToken(refreshedToken);
-      return refreshedToken;
-    }
-  } catch {
-    // Refresh failed — fall through to error
-  }
-
-  throw new Error(
-    "Session expired. Run 'hq login' to re-authenticate."
-  );
-}