@indigoai-us/hq-cli 5.5.0 → 5.5.2

package/dist/commands/onboard.js

@@ -0,0 +1,142 @@
+/**
+ * `hq onboard` — bootstrap an HQ vault: sign in to Cognito + provision
+ * the company entity, S3 bucket, KMS key, owner membership, and STS-vended
+ * credentials in one flow.
+ *
+ * This is the "the entire flow" entry point that VLT-9 was building toward:
+ * a real user can install hq-cli and run `hq onboard create-company` once
+ * to land in a fully provisioned vault, then use `hq sync push|pull` to
+ * round-trip files against S3.
+ *
+ * Subcommands:
+ *   hq onboard create-company  — provision a brand new company
+ *   hq onboard join            — accept an invite from another user
+ *   hq onboard resume          — resume a partially-completed flow from checkpoint
+ *   hq onboard dry-run         — show what create-company would do, without doing it
+ *
+ * Auth: we cache the Cognito access + refresh tokens at ~/.hq/cognito-tokens.json.
+ * If the cached token is missing or expired beyond the refresh window, the
+ * browser-OAuth flow opens automatically.
+ */
+import chalk from "chalk";
+import { runOnboardCli } from "@indigoai-us/hq-onboarding";
+import { DEFAULT_HQ_ROOT, ensureCognitoToken, buildVaultConfig, } from "../utils/cognito-session.js";
+// ---------------------------------------------------------------------------
+// Command registration
+// ---------------------------------------------------------------------------
+export function registerOnboardCommand(program) {
+    const onboard = program
+        .command("onboard")
+        .description("Provision an HQ vault: sign in, create company, S3 bucket, STS, sync");
+    onboard
+        .command("create-company")
+        .description("Sign in and provision a brand new HQ vault for a company")
+        .requiredOption("--slug <slug>", "Company slug (used as bucket name suffix)")
+        .requiredOption("--name <name>", "Company display name")
+        .requiredOption("--email <email>", "Your email (must match Cognito sign-in)")
+        .requiredOption("--person-name <name>", "Your display name")
+        .option("--hq-root <path>", `Local HQ tree root (default: ${DEFAULT_HQ_ROOT})`, DEFAULT_HQ_ROOT)
+        .action(async (options) => {
+        try {
+            console.log(chalk.bold(`\nHQ Onboard — Create Company`));
+            console.log(`  Company:  ${options.name} (${options.slug})`);
+            console.log(`  Person:   ${options.personName} <${options.email}>`);
+            console.log(`  HQ root:  ${options.hqRoot}\n`);
+            const accessToken = await ensureCognitoToken();
+            const result = await runOnboardCli({
+                mode: "create-company",
+                personName: options.personName,
+                personEmail: options.email,
+                companyName: options.name,
+                companySlug: options.slug,
+                vaultConfig: buildVaultConfig(accessToken),
+                hqRoot: options.hqRoot,
+            });
+            if (!result.success) {
+                console.error(chalk.red(`\n✗ Onboarding failed: ${result.error}`));
+                process.exit(1);
+            }
+        }
+        catch (err) {
+            console.error(chalk.red("\n✗ Error:"), err instanceof Error ? err.message : String(err));
+            process.exit(1);
+        }
+    });
+    onboard
+        .command("join")
+        .description("Accept an invite and join an existing company")
+        .requiredOption("--invite-token <token>", "Magic link token from your invite email")
+        .requiredOption("--email <email>", "Your email (must match Cognito sign-in)")
+        .requiredOption("--person-name <name>", "Your display name")
+        .option("--hq-root <path>", `Local HQ tree root (default: ${DEFAULT_HQ_ROOT})`, DEFAULT_HQ_ROOT)
+        .action(async (options) => {
+        try {
+            console.log(chalk.bold(`\nHQ Onboard — Join Company`));
+            console.log(`  Person:   ${options.personName} <${options.email}>`);
+            console.log(`  HQ root:  ${options.hqRoot}\n`);
+            const accessToken = await ensureCognitoToken();
+            const result = await runOnboardCli({
+                mode: "join-company",
+                personName: options.personName,
+                personEmail: options.email,
+                inviteToken: options.inviteToken,
+                vaultConfig: buildVaultConfig(accessToken),
+                hqRoot: options.hqRoot,
+            });
+            if (!result.success) {
+                console.error(chalk.red(`\n✗ Join failed: ${result.error}`));
+                process.exit(1);
+            }
+        }
+        catch (err) {
+            console.error(chalk.red("\n✗ Error:"), err instanceof Error ? err.message : String(err));
+            process.exit(1);
+        }
+    });
+    onboard
+        .command("resume")
+        .description("Resume a partially-completed onboarding flow from local checkpoint")
+        .option("--hq-root <path>", `Local HQ tree root (default: ${DEFAULT_HQ_ROOT})`, DEFAULT_HQ_ROOT)
+        .action(async (options) => {
+        try {
+            const accessToken = await ensureCognitoToken();
+            const result = await runOnboardCli({
+                mode: "resume",
+                vaultConfig: buildVaultConfig(accessToken),
+                hqRoot: options.hqRoot,
+            });
+            if (!result.success) {
+                console.error(chalk.red(`\n✗ Resume failed: ${result.error}`));
+                process.exit(1);
+            }
+        }
+        catch (err) {
+            console.error(chalk.red("\n✗ Error:"), err instanceof Error ? err.message : String(err));
+            process.exit(1);
+        }
+    });
+    onboard
+        .command("dry-run")
+        .description("Show what create-company would do, without provisioning anything")
+        .option("--hq-root <path>", `Local HQ tree root (default: ${DEFAULT_HQ_ROOT})`, DEFAULT_HQ_ROOT)
+        .action(async (options) => {
+        try {
+            // No auth needed for dry-run — runOnboardCli handles this branch
+            // without touching the vault-service.
+            const result = await runOnboardCli({
+                mode: "dry-run",
+                vaultConfig: buildVaultConfig("dry-run-no-token"),
+                hqRoot: options.hqRoot,
+            });
+            if (!result.success) {
+                console.error(chalk.red(`\n✗ Dry-run failed: ${result.error}`));
+                process.exit(1);
+            }
+        }
+        catch (err) {
+            console.error(chalk.red("\n✗ Error:"), err instanceof Error ? err.message : String(err));
+            process.exit(1);
+        }
+    });
+}
+//# sourceMappingURL=onboard.js.map

package/dist/commands/onboard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"onboard.js","sourceRoot":"","sources":["../../src/commands/onboard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAGH,OAAO,KAAK,MAAM,OAAO,CAAC;AAE1B,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAC3D,OAAO,EACL,eAAe,EACf,kBAAkB,EAClB,gBAAgB,GACjB,MAAM,6BAA6B,CAAC;AAErC,8EAA8E;AAC9E,uBAAuB;AACvB,8EAA8E;AAE9E,MAAM,UAAU,sBAAsB,CAAC,OAAgB;IACrD,MAAM,OAAO,GAAG,OAAO;SACpB,OAAO,CAAC,SAAS,CAAC;SAClB,WAAW,CAAC,sEAAsE,CAAC,CAAC;IAEvF,OAAO;SACJ,OAAO,CAAC,gBAAgB,CAAC;SACzB,WAAW,CAAC,0DAA0D,CAAC;SACvE,cAAc,CAAC,eAAe,EAAE,2CAA2C,CAAC;SAC5E,cAAc,CAAC,eAAe,EAAE,sBAAsB,CAAC;SACvD,cAAc,CAAC,iBAAiB,EAAE,yCAAyC,CAAC;SAC5E,cAAc,CAAC,sBAAsB,EAAE,mBAAmB,CAAC;SAC3D,MAAM,CACL,kBAAkB,EAClB,gCAAgC,eAAe,GAAG,EAClD,eAAe,CAChB;SACA,MAAM,CAAC,KAAK,EAAE,OAMd,EAAE,EAAE;QACH,IAAI,CAAC;YACH,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC,CAAC;YACzD,OAAO,CAAC,GAAG,CAAC,eAAe,OAAO,CAAC,IAAI,KAAK,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC;YAC7D,OAAO,CAAC,GAAG,CAAC,eAAe,OAAO,CAAC,UAAU,KAAK,OAAO,CAAC,KAAK,GAAG,CAAC,CAAC;YACpE,OAAO,CAAC,GAAG,CAAC,eAAe,OAAO,CAAC,MAAM,IAAI,CAAC,CAAC;YAE/C,MAAM,WAAW,GAAG,MAAM,kBAAkB,EAAE,CAAC;YAC/C,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC;gBACjC,IAAI,EAAE,gBAAgB;gBACtB,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,WAAW,EAAE,OAAO,CAAC,KAAK;gBAC1B,WAAW,EAAE,OAAO,CAAC,IAAI;gBACzB,WAAW,EAAE,OAAO,CAAC,IAAI;gBACzB,WAAW,EAAE,gBAAgB,CAAC,WAAW,CAAC;gBAC1C,MAAM,EAAE,OAAO,CAAC,MAAM;aACvB,CAAC,CAAC;YAEH,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACpB,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,0BAA0B,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;gBACnE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CACX,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,EACvB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CACjD,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,OAAO;SACJ,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,+CAA+C,CAAC;SAC5D,cAAc,CAAC,wBAAwB,EAAE,yCAAyC,CAAC;SACnF,cAAc,CAAC,iBAAiB,EAAE,yCAAyC,CAAC;SAC5E,cAAc,CAAC,sBAAsB,EAAE,mBAAmB,CAAC;SAC3D,MAAM,CACL,kBAAkB,EAClB,gCAAgC,eAAe,GAAG,EAClD,eAAe,CAChB;SACA,MAAM,CAAC,KAAK,EAAE,OAKd,EAAE,EAAE;QACH,IAAI,CAAC;YACH,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC,CAAC;YACvD,OAAO,CAAC,GAAG,CAAC,eAAe,OAAO,CAAC,UAAU,KAAK,OAAO,CAAC,KAAK,GAAG,CAAC,CAAC;YACpE,OAAO,CAAC,GAAG,CAAC,eAAe,OAAO,CAAC,MAAM,IAAI,CAAC,CAAC;YAE/C,MAAM,WAAW,GAAG,MAAM,kBAAkB,EAAE,CAAC;YAC/C,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC;gBACjC,IAAI,EAAE,cAAc;gBACpB,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,WAAW,EAAE,OAAO,CAAC,KAAK;gBAC1B,WAAW,EAAE,OAAO,CAAC,WAAW;gBAChC,WAAW,EAAE,gBAAgB,CAAC,WAAW,CAAC;gBAC1C,MAAM,EAAE,OAAO,CAAC,MAAM;aACvB,CAAC,CAAC;YAEH,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACpB,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,oBAAoB,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;gBAC7D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CACX,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,EACvB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CACjD,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,OAAO;SACJ,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,oEAAoE,CAAC;SACjF,MAAM,CACL,kBAAkB,EAClB,gCAAgC,eAAe,GAAG,EAClD,eAAe,CAChB;SACA,MAAM,CAAC,KAAK,EAAE,OAA2B,EAAE,EAAE;QAC5C,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,MAAM,kBAAkB,EAAE,CAAC;YAC/C,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC;gBACjC,IAAI,EAAE,QAAQ;gBACd,WAAW,EAAE,gBAAgB,CAAC,WAAW,CAAC;gBAC1C,MAAM,EAAE,OAAO,CAAC,MAAM;aACvB,CAAC,CAAC;YACH,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACpB,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,sBAAsB,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;gBAC/D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CACX,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,EACvB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CACjD,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,OAAO;SACJ,OAAO,CAAC,SAAS,CAAC;SAClB,WAAW,CAAC,kEAAkE,CAAC;SAC/E,MAAM,CACL,kBAAkB,EAClB,gCAAgC,eAAe,GAAG,EAClD,eAAe,CAChB;SACA,MAAM,CAAC,KAAK,EAAE,OAA2B,EAAE,EAAE;QAC5C,IAAI,CAAC;YACH,iEAAiE;YACjE,sCAAsC;YACtC,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC;gBACjC,IAAI,EAAE,SAAS;gBACf,WAAW,EAAE,gBAAgB,CAAC,kBAAkB,CAAC;gBACjD,MAAM,EAAE,OAAO,CAAC,MAAM;aACvB,CAAC,CAAC;YACH,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACpB,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,uBAAuB,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;gBAChE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CACX,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,EACvB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CACjD,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/commands/pack-install.d.ts

@@ -0,0 +1,44 @@
+/**
+ * hq install <source> — content-pack installer (US-003, hq-core v12.0.0+)
+ *
+ * Source patterns and transports:
+ *   @scope/name[@version]          → npm (default pin = latest, frozen on install)
+ *   https://... | git@... | *.git  → git (SHA-pinned by default; --branch to follow)
+ *   github:owner/repo[#...]        → git (sugar — expands to https://github.com/owner/repo.git)
+ *   ./path | ../path | /path | file:... → local (path recorded as-is)
+ *
+ * Git fragment grammar (after '#'):
+ *   '#<ref>'                → whole repo at ref (tag / branch / SHA)
+ *   '#<subpath>'            → subdirectory of repo at default branch
+ *   '#<subpath>@<ref>'      → subdirectory at ref
+ * Fragment disambiguation: if the token after '#' contains '/' it's a subpath;
+ * otherwise it's a ref. Subpath enables monorepo-hosted packs (e.g.
+ * 'github:indigoai-us/hq#packages/hq-pack-gstack@abc1234') without a separate
+ * registry or release tarball.
+ *
+ * Distinct from pkg-install.ts (entitlement-gated registry flow against the
+ * proprietary HQ registry — that still runs for plain slugs). Spec:
+ * knowledge/public/hq-core/package-yaml-spec.md.
+ *
+ * Flow:
+ *   1. Classify source → transport
+ *   2. Fetch payload to tmpdir (npm pack | git clone | rsync)
+ *   3. Parse + validate package.yaml (10 checks from spec)
+ *   4. Evaluate `conditional` predicate — skip if exits non-zero
+ *   5. Confirm hooks if `contributes.hooks` non-empty (unless --allow-hooks)
+ *   6. Move into packages/{name}/
+ *   7. Append entry to modules.yaml with strategy: package
+ *   8. Run scan-packages.sh to wire contributions into host paths
+ */
+/**
+ * sourceMatchesPackPattern — exported for the dispatcher in pkg-install.ts
+ * so it can decide whether to route to the new content-pack handler or fall
+ * back to the legacy registry flow.
+ */
+export declare function sourceMatchesPackPattern(source: string): boolean;
+export interface InstallPackOptions {
+    allowHooks?: boolean;
+    followBranch?: boolean;
+}
+export declare function installPack(source: string, opts?: InstallPackOptions): Promise<void>;
+//# sourceMappingURL=pack-install.d.ts.map

package/dist/commands/pack-install.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pack-install.d.ts","sourceRoot":"","sources":["../../src/commands/pack-install.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AA0GH;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAOhE;AAybD,MAAM,WAAW,kBAAkB;IACjC,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED,wBAAsB,WAAW,CAC/B,MAAM,EAAE,MAAM,EACd,IAAI,GAAE,kBAAuB,GAC5B,OAAO,CAAC,IAAI,CAAC,CAoEf"}