@indigoai-us/hq-cli 5.5.1 → 5.5.2-sentry-rc.0

package/dist/commands/secrets.js

@@ -0,0 +1,756 @@
+import chalk from "chalk";
+import * as readline from "node:readline";
+import { spawn } from "node:child_process";
+import { ensureCognitoToken, DEFAULT_VAULT_API_URL, } from "../utils/cognito-session.js";
+import { readCache, writeCache, removeCacheEntry, clearAllCache, } from "../utils/secrets-cache.js";
+import { SECRET_NAME_PATTERN, GROUP_ID_PATTERN } from "./_patterns.js";
+function shellSingleQuote(value) {
+    return "'" + value.replace(/'/g, "'\\''") + "'";
+}
+// API Gateway v2 URL-decodes `%2F` before route matching, so a full-name
+// `encodeURIComponent` would collapse structural `/` separators into a single
+// segment the `/name/{proxy+}` route can't match.
+function buildSecretNamePath(companyUid, name) {
+    const encodedName = name
+        .split("/")
+        .map(encodeURIComponent)
+        .join("/");
+    return `/secrets/${encodeURIComponent(companyUid)}/name/${encodedName}`;
+}
+export async function vaultApiFetch(opts) {
+    const url = new URL(opts.path, DEFAULT_VAULT_API_URL);
+    if (opts.query) {
+        for (const [k, v] of Object.entries(opts.query)) {
+            url.searchParams.set(k, v);
+        }
+    }
+    return fetch(url.toString(), {
+        method: opts.method ?? "GET",
+        headers: {
+            Authorization: `Bearer ${opts.token}`,
+            "Content-Type": "application/json",
+        },
+        body: opts.body ? JSON.stringify(opts.body) : undefined,
+    });
+}
+async function resolveCompanyUid(token, slug) {
+    const res = await vaultApiFetch({
+        token,
+        path: `/entity/by-slug/company/${encodeURIComponent(slug)}`,
+    });
+    if (!res.ok) {
+        const body = await res.json().catch(() => ({}));
+        throw new Error(`Failed to resolve company slug '${slug}': ${body.error ?? res.statusText}`);
+    }
+    const data = (await res.json());
+    return data.entity.uid;
+}
+async function resolveCompanyFromMemberships(token) {
+    const res = await vaultApiFetch({
+        token,
+        path: "/membership/me",
+    });
+    if (!res.ok) {
+        throw new Error("Failed to fetch memberships — run `hq login` and try again");
+    }
+    const data = (await res.json());
+    const active = data.memberships.filter((m) => m.status === "active");
+    if (active.length === 0) {
+        throw new Error("No active company memberships found. Use --company <slug> to specify.");
+    }
+    if (active.length === 1) {
+        return active[0].companyUid;
+    }
+    const uids = active.map((m) => m.companyUid).join(", ");
+    throw new Error(`Multiple companies found (${uids}). Use --company <slug> to specify which one.`);
+}
+export async function getCompanyUid(token, companySlug) {
+    if (companySlug) {
+        return resolveCompanyUid(token, companySlug);
+    }
+    return resolveCompanyFromMemberships(token);
+}
+function parseDuration(input) {
+    const match = input.match(/^(\d+)(m|h|d)$/);
+    if (!match)
+        return null;
+    const value = parseInt(match[1], 10);
+    const unit = match[2];
+    if (unit === "m")
+        return value * 60 * 1000;
+    if (unit === "h")
+        return value * 60 * 60 * 1000;
+    if (unit === "d")
+        return value * 24 * 60 * 60 * 1000;
+    return null;
+}
+function confirmPrompt(message) {
+    const rl = readline.createInterface({
+        input: process.stdin,
+        output: process.stdout,
+    });
+    return new Promise((resolve) => {
+        rl.question(`${message} [y/N] `, (answer) => {
+            rl.close();
+            resolve(answer.trim().toLowerCase() === "y");
+        });
+    });
+}
+function readFromPipedStdin() {
+    return new Promise((resolve, reject) => {
+        let data = "";
+        process.stdin.setEncoding("utf8");
+        process.stdin.on("data", (chunk) => {
+            data += chunk;
+        });
+        process.stdin.on("end", () => resolve(data.replace(/\n$/, "")));
+        process.stdin.on("error", reject);
+    });
+}
+function promptSecretInteractively() {
+    return new Promise((resolve, reject) => {
+        process.stdout.write("Enter secret value: ");
+        if (process.stdin.isTTY) {
+            process.stdin.setRawMode(true);
+        }
+        let value = "";
+        process.stdin.setEncoding("utf8");
+        const cleanup = () => {
+            if (process.stdin.isTTY) {
+                process.stdin.setRawMode(false);
+            }
+            process.stdin.removeListener("data", onData);
+            process.stdin.removeListener("end", onEnd);
+            process.stdin.pause();
+        };
+        const onEnd = () => {
+            cleanup();
+            process.stdout.write("\n");
+            resolve(value);
+        };
+        const onData = (ch) => {
+            for (const c of ch) {
+                const code = c.codePointAt(0);
+                if (c === "\n" || c === "\r" || code === 4) {
+                    cleanup();
+                    process.stdout.write("\n");
+                    resolve(value);
+                    return;
+                }
+                else if (code === 3) {
+                    cleanup();
+                    reject(new Error("Aborted"));
+                    return;
+                }
+                else if (code === 0x1b) {
+                    return;
+                }
+                else if (code === 127) {
+                    if (value.length > 0) {
+                        value = value.slice(0, -1);
+                    }
+                }
+                else if (code >= 0x20) {
+                    value += c;
+                }
+            }
+        };
+        process.stdin.on("data", onData);
+        process.stdin.on("end", onEnd);
+        process.stdin.resume();
+    });
+}
+export function registerSecretsCommand(program) {
+    const secrets = program
+        .command("secrets")
+        .description("Manage secrets in HQ vault (SSM Parameter Store)")
+        .option("--company <slug>", "Company slug (resolves to companyUid)");
+    secrets
+        .command("set <name>")
+        .description("Create or update a secret")
+        .option("--from-stdin", "Read secret value from piped stdin")
+        .action(async (name, opts) => {
+        try {
+            if (!SECRET_NAME_PATTERN.test(name)) {
+                console.error(chalk.red(`Invalid secret name '${name}': must match ^[A-Z][A-Z0-9_]*(/[A-Z][A-Z0-9_]+)*$ (e.g. MY_API_KEY or DEV/MY_KEY)`));
+                process.exit(1);
+            }
+            let value;
+            if (opts.fromStdin) {
+                if (process.stdin.isTTY) {
+                    console.error(chalk.red("Error: --from-stdin requires piped input (e.g. echo 'val' | hq secrets set NAME --from-stdin)"));
+                    process.exit(1);
+                }
+                value = await readFromPipedStdin();
+            }
+            else {
+                if (!process.stdin.isTTY) {
+                    console.error(chalk.red("Error: stdin is not a terminal. Use --from-stdin for piped input."));
+                    process.exit(1);
+                }
+                value = await promptSecretInteractively();
+            }
+            if (!value) {
+                console.error(chalk.red("Error: secret value cannot be empty."));
+                process.exit(1);
+            }
+            if (Buffer.byteLength(value, "utf8") > 4096) {
+                console.error(chalk.red(`Secret value exceeds 4096-byte SSM limit (got ${Buffer.byteLength(value, "utf8")} bytes).`));
+                process.exit(1);
+            }
+            const token = await ensureCognitoToken();
+            const companySlug = secrets.opts().company;
+            const companyUid = await getCompanyUid(token, companySlug);
+            const res = await vaultApiFetch({
+                token,
+                path: `/secrets/${encodeURIComponent(companyUid)}`,
+                method: "POST",
+                body: { name, value },
+            });
+            if (!res.ok) {
+                const body = await res.json().catch(() => ({}));
+                console.error(chalk.red(`Failed to set secret: ${body.error ?? res.statusText}`));
+                process.exit(1);
+            }
+            removeCacheEntry(companyUid, name);
+            console.log(chalk.green(`Secret '${name}' saved.`));
+        }
+        catch (err) {
+            console.error(chalk.red("Error:"), err instanceof Error ? err.message : String(err));
+            process.exit(1);
+        }
+    });
+    secrets
+        .command("get <name>")
+        .description("Get a secret's metadata (use --reveal for value)")
+        .option("--reveal", "Include the decrypted secret value")
+        .action(async (name, opts) => {
+        try {
+            const token = await ensureCognitoToken();
+            const companySlug = secrets.opts().company;
+            const companyUid = await getCompanyUid(token, companySlug);
+            const query = {};
+            if (opts.reveal) {
+                query.reveal = "true";
+            }
+            const res = await vaultApiFetch({
+                token,
+                path: buildSecretNamePath(companyUid, name),
+                query: Object.keys(query).length > 0 ? query : undefined,
+            });
+            if (!res.ok) {
+                const body = await res.json().catch(() => ({}));
+                console.error(chalk.red(`Failed to get secret: ${body.error ?? res.statusText}`));
+                process.exit(1);
+            }
+            const data = (await res.json());
+            const s = data.secret;
+            console.log(chalk.bold(`Secret: ${s.name}`));
+            if (s.lastModifiedDate) {
+                console.log(`  Last Modified: ${s.lastModifiedDate}`);
+            }
+            if (s.version != null) {
+                console.log(`  Version:       ${s.version}`);
+            }
+            if (opts.reveal && s.value != null) {
+                console.log(`  Value:         ${s.value}`);
+            }
+            else {
+                console.log(`  Value:         ${chalk.dim("[REDACTED]")}`);
+            }
+        }
+        catch (err) {
+            console.error(chalk.red("Error:"), err instanceof Error ? err.message : String(err));
+            process.exit(1);
+        }
+    });
+    secrets
+        .command("list")
+        .description("List all secrets for the company (including nested path-based names)")
+        .option("--prefix <path>", "Filter by path prefix (e.g. DEV or DEV/SUB); omit or pass empty string for all secrets")
+        .action(async (opts) => {
+        try {
+            // MUST match SECRET_PREFIX_PATTERN in hq-pro/src/vault-service/handlers/secrets.ts
+            let normalizedPrefix;
+            if (opts.prefix) {
+                const normalized = opts.prefix.replace(/^\/+|\/+$/g, "");
+                if (normalized.length === 0 ||
+                    !SECRET_NAME_PATTERN.test(normalized)) {
+                    console.error(chalk.red(`Invalid prefix '${opts.prefix}': must match ^[A-Z][A-Z0-9_]*(/[A-Z][A-Z0-9_]+)*$ (e.g. DEV or DEV/SUB)`));
+                    process.exit(1);
+                }
+                normalizedPrefix = normalized;
+            }
+            const token = await ensureCognitoToken();
+            const companySlug = secrets.opts().company;
+            const companyUid = await getCompanyUid(token, companySlug);
+            const query = {};
+            if (normalizedPrefix) {
+                query.prefix = normalizedPrefix;
+            }
+            const res = await vaultApiFetch({
+                token,
+                path: `/secrets/${encodeURIComponent(companyUid)}`,
+                query: Object.keys(query).length > 0 ? query : undefined,
+            });
+            if (!res.ok) {
+                const body = await res.json().catch(() => ({}));
+                console.error(chalk.red(`Failed to list secrets: ${body.error ?? res.statusText}`));
+                process.exit(1);
+            }
+            const data = (await res.json());
+            if (data.secrets.length === 0) {
+                console.log(chalk.dim("No secrets found."));
+                return;
+            }
+            const nameWidth = Math.max(4, ...data.secrets.map((s) => s.name.length));
+            const hasPermission = data.secrets.some((s) => s.permission !== undefined);
+            if (hasPermission) {
+                const accessWidth = Math.max(6, ...data.secrets.map((s) => (s.permission ?? "-").length));
+                const header = `${"NAME".padEnd(nameWidth)}  ${"ACCESS".padEnd(accessWidth)}  LAST MODIFIED`;
+                console.log(chalk.bold(header));
+                for (const s of data.secrets) {
+                    const access = s.permission ?? "-";
+                    const modified = s.lastModifiedDate ?? "-";
+                    console.log(`${s.name.padEnd(nameWidth)}  ${access.padEnd(accessWidth)}  ${modified}`);
+                }
+            }
+            else {
+                const header = `${"NAME".padEnd(nameWidth)}  LAST MODIFIED`;
+                console.log(chalk.bold(header));
+                for (const s of data.secrets) {
+                    const modified = s.lastModifiedDate ?? "-";
+                    console.log(`${s.name.padEnd(nameWidth)}  ${modified}`);
+                }
+            }
+        }
+        catch (err) {
+            console.error(chalk.red("Error:"), err instanceof Error ? err.message : String(err));
+            process.exit(1);
+        }
+    });
+    secrets
+        .command("delete <name>")
+        .description("Delete a secret")
+        .option("--force", "Skip confirmation prompt")
+        .action(async (name, opts) => {
+        try {
+            if (!SECRET_NAME_PATTERN.test(name)) {
+                console.error(chalk.red(`Invalid secret name '${name}': must match ^[A-Z][A-Z0-9_]*(/[A-Z][A-Z0-9_]+)*$ (e.g. MY_API_KEY or DEV/MY_KEY)`));
+                process.exit(1);
+            }
+            if (!opts.force) {
+                const confirmed = await confirmPrompt(`Delete secret '${name}'? This cannot be undone.`);
+                if (!confirmed) {
+                    console.log(chalk.dim("Aborted."));
+                    return;
+                }
+            }
+            const token = await ensureCognitoToken();
+            const companySlug = secrets.opts().company;
+            const companyUid = await getCompanyUid(token, companySlug);
+            const res = await vaultApiFetch({
+                token,
+                path: buildSecretNamePath(companyUid, name),
+                method: "DELETE",
+            });
+            if (!res.ok) {
+                const body = await res.json().catch(() => ({}));
+                console.error(chalk.red(`Failed to delete secret: ${body.error ?? res.statusText}`));
+                process.exit(1);
+            }
+            removeCacheEntry(companyUid, name);
+            console.log(chalk.green(`Secret '${name}' deleted.`));
+        }
+        catch (err) {
+            console.error(chalk.red("Error:"), err instanceof Error ? err.message : String(err));
+            process.exit(1);
+        }
+    });
+    secrets
+        .command("exec")
+        .description("Run a command with secrets injected as env vars")
+        .requiredOption("--only <keys>", "Comma-separated list of secret names to inject (required)")
+        .allowUnknownOption(true)
+        .action(async (_opts, cmd) => {
+        try {
+            const rawArgs = cmd.args;
+            const dashIndex = process.argv.indexOf("--");
+            let childArgs;
+            if (dashIndex !== -1) {
+                childArgs = process.argv.slice(dashIndex + 1);
+            }
+            else {
+                childArgs = rawArgs;
+            }
+            if (childArgs.length === 0) {
+                console.error(chalk.red("Error: no command specified. Usage: hq secrets exec --only KEY1,KEY2 -- <command>"));
+                process.exit(1);
+            }
+            const keys = _opts.only.split(",").map((k) => k.trim()).filter(Boolean);
+            if (keys.length === 0) {
+                console.error(chalk.red("Error: --only requires at least one secret name."));
+                process.exit(1);
+            }
+            for (const key of keys) {
+                if (!SECRET_NAME_PATTERN.test(key)) {
+                    console.error(chalk.red(`Invalid secret name '${key}': must match ^[A-Z][A-Z0-9_]*(/[A-Z][A-Z0-9_]+)*$`));
+                    process.exit(1);
+                }
+            }
+            const token = await ensureCognitoToken();
+            const companySlug = secrets.opts().company;
+            const companyUid = await getCompanyUid(token, companySlug);
+            const revealed = await Promise.all(keys.map(async (key) => {
+                const cached = readCache(companyUid, key);
+                if (cached !== null) {
+                    return { key, value: cached };
+                }
+                const res = await vaultApiFetch({
+                    token,
+                    path: buildSecretNamePath(companyUid, key),
+                    query: { reveal: "true" },
+                });
+                if (!res.ok) {
+                    const body = await res.json().catch(() => ({}));
+                    throw new Error(`Failed to fetch secret '${key}': ${body.error ?? res.statusText}`);
+                }
+                const data = (await res.json());
+                if (data.secret.value == null) {
+                    throw new Error(`Secret '${key}' has no value (reveal may not be permitted).`);
+                }
+                writeCache(companyUid, key, data.secret.value);
+                return { key, value: data.secret.value };
+            }));
+            const secretEnv = {};
+            for (const { key, value } of revealed) {
+                secretEnv[key] = value;
+            }
+            const [childCmd, ...childCmdArgs] = childArgs;
+            const child = spawn(childCmd, childCmdArgs, {
+                stdio: "inherit",
+                env: { ...process.env, ...secretEnv },
+            });
+            child.on("error", (err) => {
+                console.error(chalk.red(`Failed to start command '${childCmd}': ${err.message}`));
+                process.exit(1);
+            });
+            child.on("close", (code, signal) => {
+                if (signal) {
+                    process.kill(process.pid, signal);
+                }
+                process.exit(code ?? 1);
+            });
+        }
+        catch (err) {
+            console.error(chalk.red("Error:"), err instanceof Error ? err.message : String(err));
+            process.exit(1);
+        }
+    });
+    secrets
+        .command("env")
+        .description("Print 'export KEY=VALUE' lines suitable for: source <(hq secrets env --only K1,K2)")
+        .requiredOption("--only <keys>", "Comma-separated list of secret names to print (required)")
+        .action(async (opts) => {
+        try {
+            const redact = process.stdout.isTTY;
+            if (redact) {
+                console.error(chalk.yellow("stdout is a terminal — values redacted. Use: source <(hq secrets env --only KEY1,KEY2)"));
+            }
+            const keys = opts.only.split(",").map((k) => k.trim()).filter(Boolean);
+            if (keys.length === 0) {
+                console.error(chalk.red("Error: --only requires at least one secret name."));
+                process.exit(1);
+            }
+            for (const key of keys) {
+                if (!SECRET_NAME_PATTERN.test(key)) {
+                    console.error(chalk.red(`Invalid secret name '${key}': must match ^[A-Z][A-Z0-9_]*(/[A-Z][A-Z0-9_]+)*$`));
+                    process.exit(1);
+                }
+            }
+            const token = await ensureCognitoToken();
+            const companySlug = secrets.opts().company;
+            const companyUid = await getCompanyUid(token, companySlug);
+            const revealed = await Promise.all(keys.map(async (key) => {
+                const cached = readCache(companyUid, key);
+                if (cached !== null) {
+                    return { key, value: cached };
+                }
+                const res = await vaultApiFetch({
+                    token,
+                    path: buildSecretNamePath(companyUid, key),
+                    query: { reveal: "true" },
+                });
+                if (!res.ok) {
+                    const body = await res.json().catch(() => ({}));
+                    throw new Error(`Failed to fetch secret '${key}': ${body.error ?? res.statusText}`);
+                }
+                const data = (await res.json());
+                if (data.secret.value == null) {
+                    throw new Error(`Secret '${key}' has no value (reveal may not be permitted).`);
+                }
+                writeCache(companyUid, key, data.secret.value);
+                return { key, value: data.secret.value };
+            }));
+            for (const { key, value } of revealed) {
+                const out = redact ? "[REDACTED]" : value;
+                process.stdout.write(`export ${key}=${shellSingleQuote(out)}\n`);
+            }
+        }
+        catch (err) {
+            console.error(chalk.red("Error:"), err instanceof Error ? err.message : String(err));
+            process.exit(1);
+        }
+    });
+    secrets
+        .command("generate-link <name>")
+        .description("Generate a one-time link for someone to submit a secret value")
+        .option("--expires <duration>", "Token expiry duration (e.g. 24h, 2d, 30m)", "24h")
+        .action(async (name, opts) => {
+        try {
+            if (!SECRET_NAME_PATTERN.test(name)) {
+                console.error(chalk.red(`Invalid secret name '${name}': must match ^[A-Z][A-Z0-9_]*(/[A-Z][A-Z0-9_]+)*$ (e.g. MY_API_KEY or DEV/MY_KEY)`));
+                process.exit(1);
+            }
+            const expiresInMs = parseDuration(opts.expires);
+            if (expiresInMs === null) {
+                console.error(chalk.red(`Invalid duration '${opts.expires}'. Use formats like 30m, 12h, 2d.`));
+                process.exit(1);
+            }
+            const MAX_EXPIRY_MS = 7 * 24 * 60 * 60 * 1000;
+            if (expiresInMs > MAX_EXPIRY_MS) {
+                console.error(chalk.red("Maximum expiry is 7 days (7d)."));
+                process.exit(1);
+            }
+            const token = await ensureCognitoToken();
+            const companySlug = secrets.opts().company;
+            const companyUid = await getCompanyUid(token, companySlug);
+            const res = await vaultApiFetch({
+                token,
+                path: buildSecretNamePath(companyUid, name),
+                method: "POST",
+                body: { expiresInMs },
+                query: { action: "generate-token" },
+            });
+            if (!res.ok) {
+                const body = await res.json().catch(() => ({}));
+                console.error(chalk.red(`Failed to generate link: ${body.error ?? res.statusText}`));
+                process.exit(1);
+            }
+            const data = (await res.json());
+            console.log(chalk.green("Secret input link generated:"));
+            console.log(`\n  ${data.url}\n`);
+            console.log(chalk.dim(`  Secret:  ${data.secretName}`));
+            console.log(chalk.dim(`  Expires: ${data.expiresAt}`));
+            console.log(chalk.dim("  One-time use — link is invalidated after first submission."));
+        }
+        catch (err) {
+            console.error(chalk.red("Error:"), err instanceof Error ? err.message : String(err));
+            process.exit(1);
+        }
+    });
+    secrets
+        .command("share <path>")
+        .description("Share a secret with a person or group")
+        .requiredOption("--with <principal>", "Email address or group id to share with")
+        .requiredOption("--permission <level>", "Permission level: read | write | admin")
+        .action(async (path, opts) => {
+        try {
+            if (!SECRET_NAME_PATTERN.test(path)) {
+                console.error(chalk.red(`Invalid secret path '${path}': must match ^[A-Z][A-Z0-9_]*(/[A-Z][A-Z0-9_]+)*$ (e.g. MY_KEY or PROD/DB_PASSWORD)`));
+                process.exit(1);
+            }
+            if (!["read", "write", "admin"].includes(opts.permission)) {
+                console.error(chalk.red(`Invalid permission '${opts.permission}': must be one of read, write, admin`));
+                process.exit(1);
+            }
+            const isEmail = /^[^\s]+@[^\s]+$/.test(opts.with);
+            if (!isEmail && !GROUP_ID_PATTERN.test(opts.with)) {
+                console.error(chalk.red(`Invalid principal '${opts.with}': must be an email address or a group id matching grp_<alphanumeric>`));
+                process.exit(1);
+            }
+            const granteeType = isEmail ? "email" : "group";
+            const granteeId = opts.with;
+            const token = await ensureCognitoToken();
+            const companySlug = secrets.opts().company;
+            const companyUid = await getCompanyUid(token, companySlug);
+            const res = await vaultApiFetch({
+                token,
+                path: `/secrets/${encodeURIComponent(companyUid)}/acl/grant`,
+                method: "POST",
+                body: { path, granteeType, granteeId, permission: opts.permission },
+            });
+            if (!res.ok) {
+                const body = await res.json().catch(() => ({}));
+                if (res.status === 401) {
+                    console.error(chalk.red("Not authenticated — please run `hq login`"));
+                }
+                else if (res.status === 403) {
+                    console.error(chalk.red("Not authorized to share this secret"));
+                }
+                else if (res.status === 404) {
+                    console.error(chalk.red("ACL record not found for this path — has the secret been created?"));
+                }
+                else if (res.status === 409) {
+                    console.error(chalk.red("Concurrent modification — please retry"));
+                }
+                else if (res.status >= 500) {
+                    console.error(chalk.red(`Server error: ${body.error ?? res.statusText}`));
+                }
+                else {
+                    console.error(chalk.red(body.message ?? body.error ?? "Invalid request"));
+                }
+                process.exit(1);
+            }
+            console.log(chalk.green(`Shared '${path}' with ${opts.with} (${opts.permission})`));
+        }
+        catch (err) {
+            console.error(chalk.red("Error:"), err instanceof Error ? err.message : String(err));
+            process.exit(1);
+        }
+    });
+    secrets
+        .command("unshare <path>")
+        .description("Remove a grant from a secret")
+        .requiredOption("--from <principal>", "Email address or group id to remove")
+        .action(async (path, opts) => {
+        try {
+            if (!SECRET_NAME_PATTERN.test(path)) {
+                console.error(chalk.red(`Invalid secret path '${path}': must match ^[A-Z][A-Z0-9_]*(/[A-Z][A-Z0-9_]+)*$ (e.g. MY_KEY or PROD/DB_PASSWORD)`));
+                process.exit(1);
+            }
+            const isEmailFrom = /^[^\s]+@[^\s]+$/.test(opts.from);
+            if (!isEmailFrom && !GROUP_ID_PATTERN.test(opts.from)) {
+                console.error(chalk.red(`Invalid principal '${opts.from}': must be an email address or a group id matching grp_<alphanumeric>`));
+                process.exit(1);
+            }
+            const granteeType = isEmailFrom ? "email" : "group";
+            const granteeId = opts.from;
+            const token = await ensureCognitoToken();
+            const companySlug = secrets.opts().company;
+            const companyUid = await getCompanyUid(token, companySlug);
+            const res = await vaultApiFetch({
+                token,
+                path: `/secrets/${encodeURIComponent(companyUid)}/acl/revoke`,
+                method: "POST",
+                body: { path, granteeType, granteeId },
+            });
+            if (!res.ok) {
+                const body = await res.json().catch(() => ({}));
+                if (res.status === 401) {
+                    console.error(chalk.red("Not authenticated — please run `hq login`"));
+                }
+                else if (res.status === 403) {
+                    console.error(chalk.red("Not authorized to modify this secret's ACL"));
+                }
+                else if (res.status === 404) {
+                    console.log(chalk.green(`Grant already absent for '${path}' / ${opts.from}`));
+                    return;
+                }
+                else if (res.status >= 500) {
+                    console.error(chalk.red(`Server error: ${body.error ?? res.statusText}`));
+                }
+                else {
+                    console.error(chalk.red(body.message ?? body.error ?? "Invalid request"));
+                }
+                process.exit(1);
+            }
+            console.log(chalk.green(`Removed grant for ${opts.from} on '${path}'`));
+        }
+        catch (err) {
+            console.error(chalk.red("Error:"), err instanceof Error ? err.message : String(err));
+            process.exit(1);
+        }
+    });
+    secrets
+        .command("acl <path>")
+        .description("Show the ACL (access control list) for a secret path")
+        .action(async (path) => {
+        try {
+            if (!SECRET_NAME_PATTERN.test(path)) {
+                console.error(chalk.red(`Invalid secret path '${path}': must match ^[A-Z][A-Z0-9_]*(/[A-Z][A-Z0-9_]+)*$ (e.g. MY_KEY or PROD/DB_PASSWORD)`));
+                process.exit(1);
+            }
+            const token = await ensureCognitoToken();
+            const companySlug = secrets.opts().company;
+            const companyUid = await getCompanyUid(token, companySlug);
+            const secretPath = path;
+            const res = await vaultApiFetch({
+                token,
+                path: `/secrets/${encodeURIComponent(companyUid)}/acl`,
+                query: { path: secretPath },
+            });
+            if (!res.ok) {
+                const body = await res.json().catch(() => ({}));
+                if (res.status === 401) {
+                    console.error(chalk.red("Not authenticated — please run `hq login`"));
+                }
+                else if (res.status === 403) {
+                    console.error(chalk.red("Not authorized to view this secret's ACL"));
+                }
+                else if (res.status === 404) {
+                    console.error(chalk.red(`No ACL record exists for '${path}'`));
+                }
+                else if (res.status >= 500) {
+                    console.error(chalk.red(`Server error: ${body.error ?? res.statusText}`));
+                }
+                else {
+                    console.error(chalk.red(body.message ?? body.error ?? "Invalid request"));
+                }
+                process.exit(1);
+            }
+            const data = (await res.json());
+            const acl = data.acl;
+            const aclStatus = acl.open ? "open" : "restricted";
+            console.log(chalk.green(`ACL for ${acl.path} (${aclStatus})`));
+            console.log(`Creator: ${acl.creatorUid}`);
+            if (acl.entries.length === 0) {
+                if (acl.open) {
+                    console.log(chalk.gray("Open ACL — all active members have read access."));
+                }
+                else {
+                    console.log(chalk.gray("No explicit grants — only creator has access."));
+                }
+                return;
+            }
+            console.log("Entries:");
+            const TYPE_W = Math.max(4, ...acl.entries.map((e) => e.granteeType.length));
+            const GRANTEE_W = Math.max(7, ...acl.entries.map((e) => e.granteeId.length));
+            const PERM_W = Math.max(10, ...acl.entries.map((e) => e.permission.length));
+            const BY_W = Math.max(10, ...acl.entries.map((e) => e.grantedBy.length));
+            const tableHeader = [
+                "TYPE".padEnd(TYPE_W),
+                "GRANTEE".padEnd(GRANTEE_W),
+                "PERMISSION".padEnd(PERM_W),
+                "GRANTED_BY".padEnd(BY_W),
+                "GRANTED_AT",
+            ].join("  ");
+            console.log(chalk.bold(tableHeader));
+            for (const e of acl.entries) {
+                const grantedAt = e.grantedAt.slice(0, 10);
+                console.log([
+                    e.granteeType.padEnd(TYPE_W),
+                    e.granteeId.padEnd(GRANTEE_W),
+                    e.permission.padEnd(PERM_W),
+                    e.grantedBy.padEnd(BY_W),
+                    grantedAt,
+                ].join("  "));
+            }
+        }
+        catch (err) {
+            console.error(chalk.red("Error:"), err instanceof Error ? err.message : String(err));
+            process.exit(1);
+        }
+    });
+    const cache = secrets
+        .command("cache")
+        .description("Manage the local secrets cache");
+    cache
+        .command("clear")
+        .description("Clear all cached secrets")
+        .action(async () => {
+        clearAllCache();
+        console.log(chalk.green("Secrets cache cleared."));
+    });
+}
+//# sourceMappingURL=secrets.js.map