@indigoai-us/hq-cli 5.5.2 → 5.5.3

package/dist/bin/hq-auth-refresh.js

@@ -9,19 +9,32 @@
  * Exit 0 on refresh, exit 1 if no cached session or refresh failed.
  * Writes the refreshed tokens to ~/.hq/cognito-tokens.json.
  */
+
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="28774b80-becb-5fb9-b676-dee74c26d73d")}catch(e){}}();
+import { initSentry, Sentry } from "../sentry.js";
 import { refreshCachedSession } from "../utils/cognito-session.js";
-async function main() {
-    const result = await refreshCachedSession();
-    if (result.refreshed) {
-        process.exit(0);
+initSentry();
+(async () => {
+    let exitCode = 1;
+    try {
+        const result = await refreshCachedSession();
+        if (result.refreshed) {
+            exitCode = 0;
+        }
+        else {
+            if (result.reason) {
+                process.stderr.write(`hq-auth-refresh: ${result.reason}\n`);
+            }
+        }
     }
-    if (result.reason) {
-        process.stderr.write(`hq-auth-refresh: ${result.reason}\n`);
+    catch (err) {
+        Sentry.captureException(err);
+        process.stderr.write(`hq-auth-refresh: ${err instanceof Error ? err.message : String(err)}\n`);
     }
-    process.exit(1);
-}
-main().catch((err) => {
-    process.stderr.write(`hq-auth-refresh: ${err instanceof Error ? err.message : String(err)}\n`);
-    process.exit(1);
-});
-//# sourceMappingURL=hq-auth-refresh.js.map
+    finally {
+        await Sentry.flush(2000);
+        process.exit(exitCode);
+    }
+})();
+//# sourceMappingURL=hq-auth-refresh.js.map
+//# debugId=28774b80-becb-5fb9-b676-dee74c26d73d

package/dist/commands/_patterns.d.ts

@@ -0,0 +1,3 @@
+export declare const SECRET_NAME_PATTERN: RegExp;
+export declare const GROUP_ID_PATTERN: RegExp;
+//# sourceMappingURL=_patterns.d.ts.map

package/dist/commands/_patterns.js

@@ -0,0 +1,6 @@
+
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="61b178c5-2bd1-5503-bbee-ecb98a9d72f5")}catch(e){}}();
+export const SECRET_NAME_PATTERN = /^[A-Z][A-Z0-9_]*(?:\/[A-Z][A-Z0-9_]+)*$/;
+export const GROUP_ID_PATTERN = /^grp_[A-Za-z0-9_-]+$/;
+//# sourceMappingURL=_patterns.js.map
+//# debugId=61b178c5-2bd1-5503-bbee-ecb98a9d72f5

package/dist/commands/add.js

@@ -1,6 +1,8 @@
 /**
  * hq modules add command (US-003)
  */
+
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="4b8dd2fb-2564-590a-b294-7deeff926e4b")}catch(e){}}();
 import { findHqRoot, addModule, parseRepoName, isValidRepoUrl } from '../utils/manifest.js';
 export function registerAddCommand(program) {
     program
@@ -58,4 +60,5 @@ export function registerAddCommand(program) {
         }
     });
 }
-//# sourceMappingURL=add.js.map
+//# sourceMappingURL=add.js.map
+//# debugId=4b8dd2fb-2564-590a-b294-7deeff926e4b

package/dist/commands/auth.js

@@ -13,6 +13,8 @@
  * session is kept fresh by `hq auth refresh` / `hq-auth-refresh` and consumed
  * by the deploy + sync skills.
  */
+
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="a4a30b14-55b3-5206-9148-48aff1a8cdd4")}catch(e){}}();
 import chalk from "chalk";
 import { browserLogin, clearCachedTokens, loadCachedTokens, isExpiring, CognitoAuthError, } from "@indigoai-us/hq-cloud";
 import { DEFAULT_COGNITO, refreshCachedSession, } from "../utils/cognito-session.js";
@@ -107,4 +109,5 @@ export function registerAuthCommands(program) {
             : chalk.green(`${label}HQ session valid (expiresAt=${cached.expiresAt})`));
     });
 }
-//# sourceMappingURL=auth.js.map
+//# sourceMappingURL=auth.js.map
+//# debugId=a4a30b14-55b3-5206-9148-48aff1a8cdd4

package/dist/commands/cloud.js

@@ -12,6 +12,8 @@
  *   hq sync pull              — pull all permitted files from the vault
  *   hq sync status            — show local journal summary
  */
+
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="a3524c87-f874-56f4-92b3-9c33467b4f95")}catch(e){}}();
 import chalk from "chalk";
 import * as fs from "fs";
 import * as path from "path";
@@ -135,4 +137,5 @@ function formatBytes(bytes) {
     const value = bytes / Math.pow(1024, exponent);
     return `${value.toFixed(value >= 100 || exponent === 0 ? 0 : 1)} ${units[exponent]}`;
 }
-//# sourceMappingURL=cloud.js.map
+//# sourceMappingURL=cloud.js.map
+//# debugId=a3524c87-f874-56f4-92b3-9c33467b4f95

package/dist/commands/groups.d.ts

@@ -0,0 +1,3 @@
+import { Command } from "commander";
+export declare function registerGroupsCommand(program: Command): void;
+//# sourceMappingURL=groups.d.ts.map

package/dist/commands/groups.js

@@ -0,0 +1,344 @@
+
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="e84b2c37-90d0-559c-ace0-2b08fb69eec5")}catch(e){}}();
+import chalk from "chalk";
+import { ensureCognitoToken } from "../utils/cognito-session.js";
+import { vaultApiFetch, getCompanyUid } from "./secrets.js";
+import { GROUP_ID_PATTERN } from "./_patterns.js";
+const EMAIL_PATTERN = /^[^\s]+@[^\s]+$/;
+const PERSON_UID_PATTERN = /^prs_[A-Za-z0-9_-]+$/;
+function detectPrincipalType(principal) {
+    if (EMAIL_PATTERN.test(principal)) {
+        // Server normalizes email again; we normalize here so local validation /
+        // cache keys agree with the server-side canonicalization.
+        return { granteeType: "email", granteeId: principal.trim().toLowerCase() };
+    }
+    if (PERSON_UID_PATTERN.test(principal)) {
+        return { granteeType: "person", granteeId: principal };
+    }
+    return null;
+}
+function shortDate(iso) {
+    return iso.slice(0, 10);
+}
+export function registerGroupsCommand(program) {
+    const groups = program
+        .command("groups")
+        .description("Manage groups in HQ vault")
+        .option("--company <slug>", "Company slug (resolves to companyUid)");
+    groups
+        .command("create <groupId>")
+        .description("Create a new group")
+        .requiredOption("--name <name>", "Human-readable group name")
+        .option("--description <desc>", "Optional description")
+        .action(async (groupId, opts) => {
+        try {
+            if (!GROUP_ID_PATTERN.test(groupId)) {
+                console.error(chalk.red(`Invalid group id '${groupId}': must match grp_<alphanumeric>`));
+                process.exit(1);
+            }
+            const token = await ensureCognitoToken();
+            const companySlug = groups.opts().company;
+            const companyUid = await getCompanyUid(token, companySlug);
+            const body = { groupId, name: opts.name };
+            if (opts.description)
+                body.description = opts.description;
+            const res = await vaultApiFetch({
+                token,
+                path: `/secrets/${encodeURIComponent(companyUid)}/groups`,
+                method: "POST",
+                body,
+            });
+            if (!res.ok) {
+                const err = await res.json().catch(() => ({}));
+                if (res.status === 401) {
+                    console.error(chalk.red("Not authenticated — please run `hq login`"));
+                }
+                else if (res.status === 403) {
+                    console.error(chalk.red("Not authorized — owner or admin role required"));
+                }
+                else if (res.status === 409) {
+                    console.error(chalk.red(`Group already exists: ${groupId}`));
+                }
+                else if (res.status >= 500) {
+                    console.error(chalk.red(`Server error: ${err.error ?? res.statusText}`));
+                }
+                else {
+                    console.error(chalk.red(err.message ?? err.error ?? "Invalid request"));
+                }
+                process.exit(1);
+            }
+            console.log(chalk.green(`Group '${groupId}' (${opts.name}) created`));
+        }
+        catch (err) {
+            console.error(chalk.red("Error:"), err instanceof Error ? err.message : String(err));
+            process.exit(1);
+        }
+    });
+    groups
+        .command("delete <groupId>")
+        .description("Delete a group")
+        .action(async (groupId) => {
+        try {
+            if (!GROUP_ID_PATTERN.test(groupId)) {
+                console.error(chalk.red(`Invalid group id '${groupId}': must match grp_<alphanumeric>`));
+                process.exit(1);
+            }
+            const token = await ensureCognitoToken();
+            const companySlug = groups.opts().company;
+            const companyUid = await getCompanyUid(token, companySlug);
+            const res = await vaultApiFetch({
+                token,
+                path: `/secrets/${encodeURIComponent(companyUid)}/groups`,
+                method: "DELETE",
+                query: { groupId },
+            });
+            if (!res.ok) {
+                const err = await res.json().catch(() => ({}));
+                if (res.status === 401) {
+                    console.error(chalk.red("Not authenticated — please run `hq login`"));
+                }
+                else if (res.status === 403) {
+                    console.error(chalk.red("Not authorized — owner or admin role required"));
+                }
+                else if (res.status === 404) {
+                    console.error(chalk.red(`Group not found: ${groupId}`));
+                }
+                else if (res.status >= 500) {
+                    console.error(chalk.red(`Server error: ${err.error ?? res.statusText}`));
+                }
+                else {
+                    console.error(chalk.red(err.message ?? err.error ?? "Invalid request"));
+                }
+                process.exit(1);
+            }
+            console.log(chalk.green(`Group '${groupId}' deleted`));
+        }
+        catch (err) {
+            console.error(chalk.red("Error:"), err instanceof Error ? err.message : String(err));
+            process.exit(1);
+        }
+    });
+    groups
+        .command("add <groupId> <principal>")
+        .description("Add a person to a group (principal: email or personUid)")
+        .action(async (groupId, principal) => {
+        try {
+            if (!GROUP_ID_PATTERN.test(groupId)) {
+                console.error(chalk.red(`Invalid group id '${groupId}': must match grp_<alphanumeric>`));
+                process.exit(1);
+            }
+            const detected = detectPrincipalType(principal);
+            if (!detected) {
+                console.error(chalk.red(`Invalid principal '${principal}': must be an email address or a personUid matching prs_<alphanumeric>`));
+                process.exit(1);
+            }
+            const token = await ensureCognitoToken();
+            const companySlug = groups.opts().company;
+            const companyUid = await getCompanyUid(token, companySlug);
+            const res = await vaultApiFetch({
+                token,
+                path: `/secrets/${encodeURIComponent(companyUid)}/groups/members`,
+                method: "POST",
+                body: { groupId, granteeType: detected.granteeType, granteeId: detected.granteeId },
+            });
+            if (!res.ok) {
+                const err = await res.json().catch(() => ({}));
+                if (res.status === 401) {
+                    console.error(chalk.red("Not authenticated — please run `hq login`"));
+                }
+                else if (res.status === 403) {
+                    console.error(chalk.red("Not authorized — owner/admin role or group creator required"));
+                }
+                else if (res.status === 404) {
+                    // Server provides a helpful message (email not found vs group not found)
+                    console.error(chalk.red(err.error ?? `Not found`));
+                }
+                else if (res.status >= 500) {
+                    console.error(chalk.red(`Server error: ${err.error ?? res.statusText}`));
+                }
+                else {
+                    console.error(chalk.red(err.message ?? err.error ?? "Invalid request"));
+                }
+                process.exit(1);
+            }
+            console.log(chalk.green(`Added ${principal} to group '${groupId}'`));
+        }
+        catch (err) {
+            console.error(chalk.red("Error:"), err instanceof Error ? err.message : String(err));
+            process.exit(1);
+        }
+    });
+    groups
+        .command("remove <groupId> <principal>")
+        .description("Remove a person from a group (principal: email or personUid)")
+        .action(async (groupId, principal) => {
+        try {
+            if (!GROUP_ID_PATTERN.test(groupId)) {
+                console.error(chalk.red(`Invalid group id '${groupId}': must match grp_<alphanumeric>`));
+                process.exit(1);
+            }
+            const detected = detectPrincipalType(principal);
+            if (!detected) {
+                console.error(chalk.red(`Invalid principal '${principal}': must be an email address or a personUid matching prs_<alphanumeric>`));
+                process.exit(1);
+            }
+            const token = await ensureCognitoToken();
+            const companySlug = groups.opts().company;
+            const companyUid = await getCompanyUid(token, companySlug);
+            const res = await vaultApiFetch({
+                token,
+                path: `/secrets/${encodeURIComponent(companyUid)}/groups/members`,
+                method: "DELETE",
+                query: {
+                    groupId,
+                    granteeType: detected.granteeType,
+                    granteeId: detected.granteeId,
+                },
+            });
+            if (!res.ok) {
+                const err = await res.json().catch(() => ({}));
+                if (res.status === 401) {
+                    console.error(chalk.red("Not authenticated — please run `hq login`"));
+                }
+                else if (res.status === 403) {
+                    console.error(chalk.red("Not authorized — owner/admin role or group creator required"));
+                }
+                else if (res.status === 404) {
+                    console.error(chalk.red(err.error ?? `Not found`));
+                }
+                else if (res.status >= 500) {
+                    console.error(chalk.red(`Server error: ${err.error ?? res.statusText}`));
+                }
+                else {
+                    console.error(chalk.red(err.message ?? err.error ?? "Invalid request"));
+                }
+                process.exit(1);
+            }
+            console.log(chalk.green(`Removed ${principal} from group '${groupId}'`));
+        }
+        catch (err) {
+            console.error(chalk.red("Error:"), err instanceof Error ? err.message : String(err));
+            process.exit(1);
+        }
+    });
+    groups
+        .command("list")
+        .description("List all groups in the company")
+        .action(async () => {
+        try {
+            const token = await ensureCognitoToken();
+            const companySlug = groups.opts().company;
+            const companyUid = await getCompanyUid(token, companySlug);
+            const res = await vaultApiFetch({
+                token,
+                path: `/secrets/${encodeURIComponent(companyUid)}/groups`,
+            });
+            if (!res.ok) {
+                const err = await res.json().catch(() => ({}));
+                if (res.status === 401) {
+                    console.error(chalk.red("Not authenticated — please run `hq login`"));
+                }
+                else if (res.status === 403) {
+                    console.error(chalk.red("Not authorized to list groups"));
+                }
+                else if (res.status >= 500) {
+                    console.error(chalk.red(`Server error: ${err.error ?? res.statusText}`));
+                }
+                else {
+                    console.error(chalk.red(err.message ?? err.error ?? "Invalid request"));
+                }
+                process.exit(1);
+            }
+            const data = await res.json();
+            if (data.groups.length === 0) {
+                console.log(chalk.gray("No groups in this company yet."));
+                return;
+            }
+            const idW = Math.max(8, ...data.groups.map((g) => g.groupId.length));
+            const nameW = Math.max(4, ...data.groups.map((g) => g.name.length));
+            const descW = Math.max(11, ...data.groups.map((g) => (g.description ?? "").length));
+            console.log(chalk.bold([
+                "GROUP_ID".padEnd(idW),
+                "NAME".padEnd(nameW),
+                "DESCRIPTION".padEnd(descW),
+                "CREATED_AT",
+            ].join("  ")));
+            for (const g of data.groups) {
+                console.log([
+                    g.groupId.padEnd(idW),
+                    g.name.padEnd(nameW),
+                    (g.description ?? "").padEnd(descW),
+                    shortDate(g.createdAt),
+                ].join("  "));
+            }
+        }
+        catch (err) {
+            console.error(chalk.red("Error:"), err instanceof Error ? err.message : String(err));
+            process.exit(1);
+        }
+    });
+    groups
+        .command("members <groupId>")
+        .description("List members of a group")
+        .action(async (groupId) => {
+        try {
+            if (!GROUP_ID_PATTERN.test(groupId)) {
+                console.error(chalk.red(`Invalid group id '${groupId}': must match grp_<alphanumeric>`));
+                process.exit(1);
+            }
+            const token = await ensureCognitoToken();
+            const companySlug = groups.opts().company;
+            const companyUid = await getCompanyUid(token, companySlug);
+            const res = await vaultApiFetch({
+                token,
+                path: `/secrets/${encodeURIComponent(companyUid)}/groups/members`,
+                query: { groupId },
+            });
+            if (!res.ok) {
+                const err = await res.json().catch(() => ({}));
+                if (res.status === 401) {
+                    console.error(chalk.red("Not authenticated — please run `hq login`"));
+                }
+                else if (res.status === 403) {
+                    console.error(chalk.red("Not authorized to view group members"));
+                }
+                else if (res.status === 404) {
+                    console.error(chalk.red(`Group not found: ${groupId}`));
+                }
+                else if (res.status >= 500) {
+                    console.error(chalk.red(`Server error: ${err.error ?? res.statusText}`));
+                }
+                else {
+                    console.error(chalk.red(err.message ?? err.error ?? "Invalid request"));
+                }
+                process.exit(1);
+            }
+            const data = await res.json();
+            console.log(`Members of '${groupId}':`);
+            if (data.members.length === 0) {
+                console.log(chalk.gray("No members yet — use 'hq groups add' to add."));
+                return;
+            }
+            const uidW = Math.max(10, ...data.members.map((m) => m.personUid.length));
+            const byW = Math.max(8, ...data.members.map((m) => m.addedBy.length));
+            console.log(chalk.bold([
+                "PERSON_UID".padEnd(uidW),
+                "ADDED_BY".padEnd(byW),
+                "ADDED_AT",
+            ].join("  ")));
+            for (const m of data.members) {
+                console.log([
+                    m.personUid.padEnd(uidW),
+                    m.addedBy.padEnd(byW),
+                    shortDate(m.addedAt),
+                ].join("  "));
+            }
+        }
+        catch (err) {
+            console.error(chalk.red("Error:"), err instanceof Error ? err.message : String(err));
+            process.exit(1);
+        }
+    });
+}
+//# sourceMappingURL=groups.js.map
+//# debugId=e84b2c37-90d0-559c-ace0-2b08fb69eec5

package/dist/commands/list.js

@@ -1,6 +1,8 @@
 /**
  * hq modules list command (US-005)
  */
+
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="0ed2bacf-8934-5b52-a841-1eaa2bbcd8b8")}catch(e){}}();
 import * as path from 'path';
 import { findHqRoot, readManifest, readLock, getModulesDir } from '../utils/manifest.js';
 import { isRepo, getCurrentCommit, isBehindRemote } from '../utils/git.js';
@@ -69,4 +71,5 @@ export function registerListCommand(program) {
         }
     });
 }
-//# sourceMappingURL=list.js.map
+//# sourceMappingURL=list.js.map
+//# debugId=0ed2bacf-8934-5b52-a841-1eaa2bbcd8b8

package/dist/commands/login.js

@@ -1,6 +1,8 @@
 /**
  * hq login — opens browser for Cognito auth via Google OAuth
  */
+
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="31735154-208b-5544-85a4-22f8f0fbe415")}catch(e){}}();
 import chalk from 'chalk';
 import { browserLogin, loadCachedTokens, isExpiring } from '@indigoai-us/hq-cloud';
 import { DEFAULT_COGNITO } from '../utils/cognito-session.js';
@@ -41,4 +43,5 @@ export function registerLoginCommand(program) {
         }
     });
 }
-//# sourceMappingURL=login.js.map
+//# sourceMappingURL=login.js.map
+//# debugId=31735154-208b-5544-85a4-22f8f0fbe415

package/dist/commands/logout.js

@@ -1,6 +1,8 @@
 /**
  * hq logout — clears cached Cognito session
  */
+
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="120038e8-9b88-59c3-821a-da21ccb1c365")}catch(e){}}();
 import chalk from 'chalk';
 import { clearCachedTokens, loadCachedTokens } from '@indigoai-us/hq-cloud';
 export function registerLogoutCommand(program) {
@@ -23,4 +25,5 @@ export function registerLogoutCommand(program) {
         }
     });
 }
-//# sourceMappingURL=logout.js.map
+//# sourceMappingURL=logout.js.map
+//# debugId=120038e8-9b88-59c3-821a-da21ccb1c365

package/dist/commands/onboard.js

@@ -18,6 +18,8 @@
  * If the cached token is missing or expired beyond the refresh window, the
  * browser-OAuth flow opens automatically.
  */
+
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="38856701-42d8-587b-9969-8da51ede7cd4")}catch(e){}}();
 import chalk from "chalk";
 import { runOnboardCli } from "@indigoai-us/hq-onboarding";
 import { DEFAULT_HQ_ROOT, ensureCognitoToken, buildVaultConfig, } from "../utils/cognito-session.js";
@@ -139,4 +141,5 @@ export function registerOnboardCommand(program) {
         }
     });
 }
-//# sourceMappingURL=onboard.js.map
+//# sourceMappingURL=onboard.js.map
+//# debugId=38856701-42d8-587b-9969-8da51ede7cd4

package/dist/commands/pack-install.js

@@ -30,6 +30,8 @@
  *   7. Append entry to modules.yaml with strategy: package
  *   8. Run scan-packages.sh to wire contributions into host paths
  */
+
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="9c0fc9f1-9a26-5a3f-a795-7254534316d5")}catch(e){}}();
 import * as fs from 'fs';
 import * as os from 'os';
 import * as path from 'path';
@@ -510,4 +512,5 @@ export async function installPack(source, opts = {}) {
         fs.rmSync(tmpDir, { recursive: true, force: true });
     }
 }
-//# sourceMappingURL=pack-install.js.map
+//# sourceMappingURL=pack-install.js.map
+//# debugId=9c0fc9f1-9a26-5a3f-a795-7254534316d5

package/dist/commands/pkg-install.js

@@ -12,6 +12,8 @@
  * 8. Update packages/registry.yaml
  * 9. Print next-step message
  */
+
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="874fe8a4-2348-5f03-8600-c545cac13fc9")}catch(e){}}();
 import * as fs from 'fs';
 import * as os from 'os';
 import * as path from 'path';
@@ -153,4 +155,5 @@ async function installPackage(slug, company) {
         }
     }
 }
-//# sourceMappingURL=pkg-install.js.map
+//# sourceMappingURL=pkg-install.js.map
+//# debugId=874fe8a4-2348-5f03-8600-c545cac13fc9

package/dist/commands/pkg-list.js

@@ -3,6 +3,8 @@
  *
  * Graceful offline: if registry is unreachable, show cached data with a note.
  */
+
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="ce4886ce-109a-5ace-b8d9-4e5bed61978a")}catch(e){}}();
 import chalk from 'chalk';
 import { findHqRoot } from '../utils/hq-root.js';
 import { readRegistry } from '../utils/registry.js';
@@ -67,4 +69,5 @@ async function listPackages() {
         console.log(chalk.yellow('Note: Could not reach registry — showing cached data only.'));
     }
 }
-//# sourceMappingURL=pkg-list.js.map
+//# sourceMappingURL=pkg-list.js.map
+//# debugId=ce4886ce-109a-5ace-b8d9-4e5bed61978a

package/dist/commands/pkg-remove.js

@@ -5,6 +5,8 @@
  * 2. Remove entry from packages/registry.yaml
  * 3. Print next-step message
  */
+
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="b54529d6-de12-595e-b1c7-ab50b9f22eb5")}catch(e){}}();
 import * as fs from 'fs';
 import * as path from 'path';
 import chalk from 'chalk';
@@ -50,4 +52,5 @@ async function removePackage(slug) {
     console.log(chalk.green(`\nRemoved ${slug}.`));
     console.log(chalk.cyan('Run /package-remove ' + slug + ' in Claude to clean up merged content.'));
 }
-//# sourceMappingURL=pkg-remove.js.map
+//# sourceMappingURL=pkg-remove.js.map
+//# debugId=b54529d6-de12-595e-b1c7-ab50b9f22eb5

package/dist/commands/pkg-update.js

@@ -4,6 +4,8 @@
  * If no slug: check all installed packages for updates.
  * If slug given: update only that package.
  */
+
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="3ef2968d-eb65-594b-a506-4314b70dd3dc")}catch(e){}}();
 import * as fs from 'fs';
 import * as os from 'os';
 import * as path from 'path';
@@ -121,4 +123,5 @@ async function updatePackages(slug) {
     }
     console.log(`\n${updatedCount} package(s) updated${updatedCount > 0 ? '.' : ' — everything is current.'}`);
 }
-//# sourceMappingURL=pkg-update.js.map
+//# sourceMappingURL=pkg-update.js.map
+//# debugId=3ef2968d-eb65-594b-a506-4314b70dd3dc

package/dist/commands/secrets.d.ts

@@ -1,3 +1,12 @@
 import { Command } from "commander";
+export interface VaultApiOptions {
+    token: string;
+    path: string;
+    method?: string;
+    body?: Record<string, unknown>;
+    query?: Record<string, string>;
+}
+export declare function vaultApiFetch(opts: VaultApiOptions): Promise<Response>;
+export declare function getCompanyUid(token: string, companySlug: string | undefined): Promise<string>;
 export declare function registerSecretsCommand(program: Command): void;
 //# sourceMappingURL=secrets.d.ts.map