@indigoai-us/hq-cli 5.5.2 → 5.5.4

package/dist/commands/secrets.js

@@ -1,12 +1,25 @@
+
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="70f0907f-bfcb-5d2e-958a-8813d3bbaf96")}catch(e){}}();
 import chalk from "chalk";
 import * as readline from "node:readline";
 import { spawn } from "node:child_process";
 import { ensureCognitoToken, DEFAULT_VAULT_API_URL, } from "../utils/cognito-session.js";
 import { readCache, writeCache, removeCacheEntry, clearAllCache, } from "../utils/secrets-cache.js";
+import { SECRET_NAME_PATTERN, GROUP_ID_PATTERN } from "./_patterns.js";
 function shellSingleQuote(value) {
     return "'" + value.replace(/'/g, "'\\''") + "'";
 }
-async function vaultApiFetch(opts) {
+// API Gateway v2 URL-decodes `%2F` before route matching, so a full-name
+// `encodeURIComponent` would collapse structural `/` separators into a single
+// segment the `/name/{proxy+}` route can't match.
+function buildSecretNamePath(companyUid, name) {
+    const encodedName = name
+        .split("/")
+        .map(encodeURIComponent)
+        .join("/");
+    return `/secrets/${encodeURIComponent(companyUid)}/name/${encodedName}`;
+}
+export async function vaultApiFetch(opts) {
     const url = new URL(opts.path, DEFAULT_VAULT_API_URL);
     if (opts.query) {
         for (const [k, v] of Object.entries(opts.query)) {
@@ -53,7 +66,7 @@ async function resolveCompanyFromMemberships(token) {
     const uids = active.map((m) => m.companyUid).join(", ");
     throw new Error(`Multiple companies found (${uids}). Use --company <slug> to specify which one.`);
 }
-async function getCompanyUid(token, companySlug) {
+export async function getCompanyUid(token, companySlug) {
     if (companySlug) {
         return resolveCompanyUid(token, companySlug);
     }
@@ -160,8 +173,8 @@ export function registerSecretsCommand(program) {
         .option("--from-stdin", "Read secret value from piped stdin")
         .action(async (name, opts) => {
         try {
-            if (!/^[A-Z][A-Z0-9_]*$/.test(name)) {
-                console.error(chalk.red(`Invalid secret name '${name}': must match ^[A-Z][A-Z0-9_]*$ (e.g. MY_API_KEY)`));
+            if (!SECRET_NAME_PATTERN.test(name)) {
+                console.error(chalk.red(`Invalid secret name '${name}': must match ^[A-Z][A-Z0-9_]*(/[A-Z][A-Z0-9_]+)*$ (e.g. MY_API_KEY or DEV/MY_KEY)`));
                 process.exit(1);
             }
             let value;
@@ -224,7 +237,7 @@ export function registerSecretsCommand(program) {
             }
             const res = await vaultApiFetch({
                 token,
-                path: `/secrets/${encodeURIComponent(companyUid)}/${encodeURIComponent(name)}`,
+                path: buildSecretNamePath(companyUid, name),
                 query: Object.keys(query).length > 0 ? query : undefined,
             });
             if (!res.ok) {
@@ -255,15 +268,32 @@ export function registerSecretsCommand(program) {
     });
     secrets
         .command("list")
-        .description("List all secrets for the company")
-        .action(async () => {
+        .description("List all secrets for the company (including nested path-based names)")
+        .option("--prefix <path>", "Filter by path prefix (e.g. DEV or DEV/SUB); omit or pass empty string for all secrets")
+        .action(async (opts) => {
         try {
+            // MUST match SECRET_PREFIX_PATTERN in hq-pro/src/vault-service/handlers/secrets.ts
+            let normalizedPrefix;
+            if (opts.prefix) {
+                const normalized = opts.prefix.replace(/^\/+|\/+$/g, "");
+                if (normalized.length === 0 ||
+                    !SECRET_NAME_PATTERN.test(normalized)) {
+                    console.error(chalk.red(`Invalid prefix '${opts.prefix}': must match ^[A-Z][A-Z0-9_]*(/[A-Z][A-Z0-9_]+)*$ (e.g. DEV or DEV/SUB)`));
+                    process.exit(1);
+                }
+                normalizedPrefix = normalized;
+            }
             const token = await ensureCognitoToken();
             const companySlug = secrets.opts().company;
             const companyUid = await getCompanyUid(token, companySlug);
+            const query = {};
+            if (normalizedPrefix) {
+                query.prefix = normalizedPrefix;
+            }
             const res = await vaultApiFetch({
                 token,
                 path: `/secrets/${encodeURIComponent(companyUid)}`,
+                query: Object.keys(query).length > 0 ? query : undefined,
             });
             if (!res.ok) {
                 const body = await res.json().catch(() => ({}));
@@ -276,11 +306,24 @@ export function registerSecretsCommand(program) {
                 return;
             }
             const nameWidth = Math.max(4, ...data.secrets.map((s) => s.name.length));
-            const header = `${"NAME".padEnd(nameWidth)}  LAST MODIFIED`;
-            console.log(chalk.bold(header));
-            for (const s of data.secrets) {
-                const modified = s.lastModifiedDate ?? "-";
-                console.log(`${s.name.padEnd(nameWidth)}  ${modified}`);
+            const hasPermission = data.secrets.some((s) => s.permission !== undefined);
+            if (hasPermission) {
+                const accessWidth = Math.max(6, ...data.secrets.map((s) => (s.permission ?? "-").length));
+                const header = `${"NAME".padEnd(nameWidth)}  ${"ACCESS".padEnd(accessWidth)}  LAST MODIFIED`;
+                console.log(chalk.bold(header));
+                for (const s of data.secrets) {
+                    const access = s.permission ?? "-";
+                    const modified = s.lastModifiedDate ?? "-";
+                    console.log(`${s.name.padEnd(nameWidth)}  ${access.padEnd(accessWidth)}  ${modified}`);
+                }
+            }
+            else {
+                const header = `${"NAME".padEnd(nameWidth)}  LAST MODIFIED`;
+                console.log(chalk.bold(header));
+                for (const s of data.secrets) {
+                    const modified = s.lastModifiedDate ?? "-";
+                    console.log(`${s.name.padEnd(nameWidth)}  ${modified}`);
+                }
             }
         }
         catch (err) {
@@ -294,8 +337,8 @@ export function registerSecretsCommand(program) {
         .option("--force", "Skip confirmation prompt")
         .action(async (name, opts) => {
         try {
-            if (!/^[A-Z][A-Z0-9_]*$/.test(name)) {
-                console.error(chalk.red(`Invalid secret name '${name}': must match ^[A-Z][A-Z0-9_]*$ (e.g. MY_API_KEY)`));
+            if (!SECRET_NAME_PATTERN.test(name)) {
+                console.error(chalk.red(`Invalid secret name '${name}': must match ^[A-Z][A-Z0-9_]*(/[A-Z][A-Z0-9_]+)*$ (e.g. MY_API_KEY or DEV/MY_KEY)`));
                 process.exit(1);
             }
             if (!opts.force) {
@@ -310,7 +353,7 @@ export function registerSecretsCommand(program) {
             const companyUid = await getCompanyUid(token, companySlug);
             const res = await vaultApiFetch({
                 token,
-                path: `/secrets/${encodeURIComponent(companyUid)}/${encodeURIComponent(name)}`,
+                path: buildSecretNamePath(companyUid, name),
                 method: "DELETE",
             });
             if (!res.ok) {
@@ -352,8 +395,8 @@ export function registerSecretsCommand(program) {
                 process.exit(1);
             }
             for (const key of keys) {
-                if (!/^[A-Z][A-Z0-9_]*$/.test(key)) {
-                    console.error(chalk.red(`Invalid secret name '${key}': must match ^[A-Z][A-Z0-9_]*$`));
+                if (!SECRET_NAME_PATTERN.test(key)) {
+                    console.error(chalk.red(`Invalid secret name '${key}': must match ^[A-Z][A-Z0-9_]*(/[A-Z][A-Z0-9_]+)*$`));
                     process.exit(1);
                 }
             }
@@ -367,7 +410,7 @@ export function registerSecretsCommand(program) {
                 }
                 const res = await vaultApiFetch({
                     token,
-                    path: `/secrets/${encodeURIComponent(companyUid)}/${encodeURIComponent(key)}`,
+                    path: buildSecretNamePath(companyUid, key),
                     query: { reveal: "true" },
                 });
                 if (!res.ok) {
@@ -422,8 +465,8 @@ export function registerSecretsCommand(program) {
                 process.exit(1);
             }
             for (const key of keys) {
-                if (!/^[A-Z][A-Z0-9_]*$/.test(key)) {
-                    console.error(chalk.red(`Invalid secret name '${key}': must match ^[A-Z][A-Z0-9_]*$`));
+                if (!SECRET_NAME_PATTERN.test(key)) {
+                    console.error(chalk.red(`Invalid secret name '${key}': must match ^[A-Z][A-Z0-9_]*(/[A-Z][A-Z0-9_]+)*$`));
                     process.exit(1);
                 }
             }
@@ -437,7 +480,7 @@ export function registerSecretsCommand(program) {
                 }
                 const res = await vaultApiFetch({
                     token,
-                    path: `/secrets/${encodeURIComponent(companyUid)}/${encodeURIComponent(key)}`,
+                    path: buildSecretNamePath(companyUid, key),
                     query: { reveal: "true" },
                 });
                 if (!res.ok) {
@@ -467,8 +510,8 @@ export function registerSecretsCommand(program) {
         .option("--expires <duration>", "Token expiry duration (e.g. 24h, 2d, 30m)", "24h")
         .action(async (name, opts) => {
         try {
-            if (!/^[A-Z][A-Z0-9_]*$/.test(name)) {
-                console.error(chalk.red(`Invalid secret name '${name}': must match ^[A-Z][A-Z0-9_]*$ (e.g. MY_API_KEY)`));
+            if (!SECRET_NAME_PATTERN.test(name)) {
+                console.error(chalk.red(`Invalid secret name '${name}': must match ^[A-Z][A-Z0-9_]*(/[A-Z][A-Z0-9_]+)*$ (e.g. MY_API_KEY or DEV/MY_KEY)`));
                 process.exit(1);
             }
             const expiresInMs = parseDuration(opts.expires);
@@ -486,9 +529,10 @@ export function registerSecretsCommand(program) {
             const companyUid = await getCompanyUid(token, companySlug);
             const res = await vaultApiFetch({
                 token,
-                path: `/secrets/${encodeURIComponent(companyUid)}/${encodeURIComponent(name)}/generate-token`,
+                path: buildSecretNamePath(companyUid, name),
                 method: "POST",
                 body: { expiresInMs },
+                query: { action: "generate-token" },
             });
             if (!res.ok) {
                 const body = await res.json().catch(() => ({}));
@@ -507,6 +551,199 @@ export function registerSecretsCommand(program) {
             process.exit(1);
         }
     });
+    secrets
+        .command("share <path>")
+        .description("Share a secret with a person or group")
+        .requiredOption("--with <principal>", "Email address or group id to share with")
+        .requiredOption("--permission <level>", "Permission level: read | write | admin")
+        .action(async (path, opts) => {
+        try {
+            if (!SECRET_NAME_PATTERN.test(path)) {
+                console.error(chalk.red(`Invalid secret path '${path}': must match ^[A-Z][A-Z0-9_]*(/[A-Z][A-Z0-9_]+)*$ (e.g. MY_KEY or PROD/DB_PASSWORD)`));
+                process.exit(1);
+            }
+            if (!["read", "write", "admin"].includes(opts.permission)) {
+                console.error(chalk.red(`Invalid permission '${opts.permission}': must be one of read, write, admin`));
+                process.exit(1);
+            }
+            const isEmail = /^[^\s]+@[^\s]+$/.test(opts.with);
+            if (!isEmail && !GROUP_ID_PATTERN.test(opts.with)) {
+                console.error(chalk.red(`Invalid principal '${opts.with}': must be an email address or a group id matching grp_<alphanumeric>`));
+                process.exit(1);
+            }
+            const granteeType = isEmail ? "email" : "group";
+            const granteeId = opts.with;
+            const token = await ensureCognitoToken();
+            const companySlug = secrets.opts().company;
+            const companyUid = await getCompanyUid(token, companySlug);
+            const res = await vaultApiFetch({
+                token,
+                path: `/secrets/${encodeURIComponent(companyUid)}/acl/grant`,
+                method: "POST",
+                body: { path, granteeType, granteeId, permission: opts.permission },
+            });
+            if (!res.ok) {
+                const body = await res.json().catch(() => ({}));
+                if (res.status === 401) {
+                    console.error(chalk.red("Not authenticated — please run `hq login`"));
+                }
+                else if (res.status === 403) {
+                    console.error(chalk.red("Not authorized to share this secret"));
+                }
+                else if (res.status === 404) {
+                    console.error(chalk.red("ACL record not found for this path — has the secret been created?"));
+                }
+                else if (res.status === 409) {
+                    console.error(chalk.red("Concurrent modification — please retry"));
+                }
+                else if (res.status >= 500) {
+                    console.error(chalk.red(`Server error: ${body.error ?? res.statusText}`));
+                }
+                else {
+                    console.error(chalk.red(body.message ?? body.error ?? "Invalid request"));
+                }
+                process.exit(1);
+            }
+            console.log(chalk.green(`Shared '${path}' with ${opts.with} (${opts.permission})`));
+        }
+        catch (err) {
+            console.error(chalk.red("Error:"), err instanceof Error ? err.message : String(err));
+            process.exit(1);
+        }
+    });
+    secrets
+        .command("unshare <path>")
+        .description("Remove a grant from a secret")
+        .requiredOption("--from <principal>", "Email address or group id to remove")
+        .action(async (path, opts) => {
+        try {
+            if (!SECRET_NAME_PATTERN.test(path)) {
+                console.error(chalk.red(`Invalid secret path '${path}': must match ^[A-Z][A-Z0-9_]*(/[A-Z][A-Z0-9_]+)*$ (e.g. MY_KEY or PROD/DB_PASSWORD)`));
+                process.exit(1);
+            }
+            const isEmailFrom = /^[^\s]+@[^\s]+$/.test(opts.from);
+            if (!isEmailFrom && !GROUP_ID_PATTERN.test(opts.from)) {
+                console.error(chalk.red(`Invalid principal '${opts.from}': must be an email address or a group id matching grp_<alphanumeric>`));
+                process.exit(1);
+            }
+            const granteeType = isEmailFrom ? "email" : "group";
+            const granteeId = opts.from;
+            const token = await ensureCognitoToken();
+            const companySlug = secrets.opts().company;
+            const companyUid = await getCompanyUid(token, companySlug);
+            const res = await vaultApiFetch({
+                token,
+                path: `/secrets/${encodeURIComponent(companyUid)}/acl/revoke`,
+                method: "POST",
+                body: { path, granteeType, granteeId },
+            });
+            if (!res.ok) {
+                const body = await res.json().catch(() => ({}));
+                if (res.status === 401) {
+                    console.error(chalk.red("Not authenticated — please run `hq login`"));
+                }
+                else if (res.status === 403) {
+                    console.error(chalk.red("Not authorized to modify this secret's ACL"));
+                }
+                else if (res.status === 404) {
+                    console.log(chalk.green(`Grant already absent for '${path}' / ${opts.from}`));
+                    return;
+                }
+                else if (res.status >= 500) {
+                    console.error(chalk.red(`Server error: ${body.error ?? res.statusText}`));
+                }
+                else {
+                    console.error(chalk.red(body.message ?? body.error ?? "Invalid request"));
+                }
+                process.exit(1);
+            }
+            console.log(chalk.green(`Removed grant for ${opts.from} on '${path}'`));
+        }
+        catch (err) {
+            console.error(chalk.red("Error:"), err instanceof Error ? err.message : String(err));
+            process.exit(1);
+        }
+    });
+    secrets
+        .command("acl <path>")
+        .description("Show the ACL (access control list) for a secret path")
+        .action(async (path) => {
+        try {
+            if (!SECRET_NAME_PATTERN.test(path)) {
+                console.error(chalk.red(`Invalid secret path '${path}': must match ^[A-Z][A-Z0-9_]*(/[A-Z][A-Z0-9_]+)*$ (e.g. MY_KEY or PROD/DB_PASSWORD)`));
+                process.exit(1);
+            }
+            const token = await ensureCognitoToken();
+            const companySlug = secrets.opts().company;
+            const companyUid = await getCompanyUid(token, companySlug);
+            const secretPath = path;
+            const res = await vaultApiFetch({
+                token,
+                path: `/secrets/${encodeURIComponent(companyUid)}/acl`,
+                query: { path: secretPath },
+            });
+            if (!res.ok) {
+                const body = await res.json().catch(() => ({}));
+                if (res.status === 401) {
+                    console.error(chalk.red("Not authenticated — please run `hq login`"));
+                }
+                else if (res.status === 403) {
+                    console.error(chalk.red("Not authorized to view this secret's ACL"));
+                }
+                else if (res.status === 404) {
+                    console.error(chalk.red(`No ACL record exists for '${path}'`));
+                }
+                else if (res.status >= 500) {
+                    console.error(chalk.red(`Server error: ${body.error ?? res.statusText}`));
+                }
+                else {
+                    console.error(chalk.red(body.message ?? body.error ?? "Invalid request"));
+                }
+                process.exit(1);
+            }
+            const data = (await res.json());
+            const acl = data.acl;
+            const aclStatus = acl.open ? "open" : "restricted";
+            console.log(chalk.green(`ACL for ${acl.path} (${aclStatus})`));
+            console.log(`Creator: ${acl.creatorUid}`);
+            if (acl.entries.length === 0) {
+                if (acl.open) {
+                    console.log(chalk.gray("Open ACL — all active members have read access."));
+                }
+                else {
+                    console.log(chalk.gray("No explicit grants — only creator has access."));
+                }
+                return;
+            }
+            console.log("Entries:");
+            const TYPE_W = Math.max(4, ...acl.entries.map((e) => e.granteeType.length));
+            const GRANTEE_W = Math.max(7, ...acl.entries.map((e) => e.granteeId.length));
+            const PERM_W = Math.max(10, ...acl.entries.map((e) => e.permission.length));
+            const BY_W = Math.max(10, ...acl.entries.map((e) => e.grantedBy.length));
+            const tableHeader = [
+                "TYPE".padEnd(TYPE_W),
+                "GRANTEE".padEnd(GRANTEE_W),
+                "PERMISSION".padEnd(PERM_W),
+                "GRANTED_BY".padEnd(BY_W),
+                "GRANTED_AT",
+            ].join("  ");
+            console.log(chalk.bold(tableHeader));
+            for (const e of acl.entries) {
+                const grantedAt = e.grantedAt.slice(0, 10);
+                console.log([
+                    e.granteeType.padEnd(TYPE_W),
+                    e.granteeId.padEnd(GRANTEE_W),
+                    e.permission.padEnd(PERM_W),
+                    e.grantedBy.padEnd(BY_W),
+                    grantedAt,
+                ].join("  "));
+            }
+        }
+        catch (err) {
+            console.error(chalk.red("Error:"), err instanceof Error ? err.message : String(err));
+            process.exit(1);
+        }
+    });
     const cache = secrets
         .command("cache")
         .description("Manage the local secrets cache");
@@ -518,4 +755,5 @@ export function registerSecretsCommand(program) {
         console.log(chalk.green("Secrets cache cleared."));
     });
 }
-//# sourceMappingURL=secrets.js.map
+//# sourceMappingURL=secrets.js.map
+//# debugId=70f0907f-bfcb-5d2e-958a-8813d3bbaf96

package/dist/commands/sync.js

@@ -1,6 +1,8 @@
 /**
  * hq modules sync command (US-004)
  */
+
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="abaf6ba7-702e-53e3-9d38-21182f05e529")}catch(e){}}();
 import * as fs from 'fs';
 import * as path from 'path';
 import { findHqRoot, readManifest, readLock, writeLock, getModulesDir, } from '../utils/manifest.js';
@@ -109,4 +111,5 @@ export function registerSyncCommand(program) {
         }
     });
 }
-//# sourceMappingURL=sync.js.map
+//# sourceMappingURL=sync.js.map
+//# debugId=abaf6ba7-702e-53e3-9d38-21182f05e529

package/dist/commands/team-sync.js

@@ -9,6 +9,8 @@
  * 5. Report what changed (new, updated, removed files)
  * 6. Gracefully handle conflicts (warn, don't force overwrite)
  */
+
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="4c9a650e-05ed-5e33-b5de-b6d521ecdf4f")}catch(e){}}();
 import * as fs from 'fs';
 import * as path from 'path';
 import { execSync } from 'child_process';
@@ -419,4 +421,5 @@ export function registerTeamSyncCommand(program) {
         }
     });
 }
-//# sourceMappingURL=team-sync.js.map
+//# sourceMappingURL=team-sync.js.map
+//# debugId=4c9a650e-05ed-5e33-b5de-b6d521ecdf4f

package/dist/commands/update.js

@@ -2,6 +2,8 @@
  * hq modules update command (US-008)
  * Updates lock for specific module
  */
+
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="ed0bfb79-4403-57a0-85eb-766bc4110b67")}catch(e){}}();
 import * as path from 'path';
 import { findHqRoot, readManifest, readLock, writeLock, getModulesDir } from '../utils/manifest.js';
 import { fetchRepo, pullRepo, getCurrentCommit, isRepo } from '../utils/git.js';
@@ -57,4 +59,5 @@ export function registerUpdateCommand(program) {
         }
     });
 }
-//# sourceMappingURL=update.js.map
+//# sourceMappingURL=update.js.map
+//# debugId=ed0bfb79-4403-57a0-85eb-766bc4110b67

package/dist/commands/whoami.js

@@ -1,6 +1,8 @@
 /**
  * hq whoami — displays current user or 'not logged in'
  */
+
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="7d12196e-3212-5692-9383-5431e2b6a97f")}catch(e){}}();
 import chalk from 'chalk';
 import { loadCachedTokens, isExpiring } from '@indigoai-us/hq-cloud';
 function peekIdToken(idToken) {
@@ -42,4 +44,5 @@ export function registerWhoamiCommand(program) {
         }
     });
 }
-//# sourceMappingURL=whoami.js.map
+//# sourceMappingURL=whoami.js.map
+//# debugId=7d12196e-3212-5692-9383-5431e2b6a97f

package/dist/index.js

@@ -2,7 +2,10 @@
 /**
  * HQ CLI - Module management, package management, and cloud sync for HQ
  */
+
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="47414e28-81ab-5d6e-b37e-5988b2866f47")}catch(e){}}();
 import { Command } from "commander";
+import { initSentry, Sentry } from "./sentry.js";
 import { registerAddCommand } from "./commands/add.js";
 import { registerSyncCommand } from "./commands/sync.js";
 import { registerListCommand } from "./commands/list.js";
@@ -19,6 +22,8 @@ import { registerPackageListCommand } from "./commands/pkg-list.js";
 import { registerTeamSyncCommand } from "./commands/team-sync.js";
 import { registerAuthCommands } from "./commands/auth.js";
 import { registerSecretsCommand } from "./commands/secrets.js";
+import { registerGroupsCommand } from "./commands/groups.js";
+initSentry();
 const program = new Command();
 program
     .name("hq")
@@ -59,7 +64,21 @@ registerWhoamiCommand(program);
 registerAuthCommands(program);
 // Secrets management (subcommand group — hq secrets set|get|list|delete|exec|generate-link|cache)
 registerSecretsCommand(program);
+// Groups management (subcommand group — hq groups create|delete|add|remove|list|members)
+registerGroupsCommand(program);
 // Onboarding (top-level — Cognito + vault-service provisioning)
 registerOnboardCommand(program);
-program.parse();
-//# sourceMappingURL=index.js.map
+(async () => {
+    try {
+        await program.parseAsync();
+    }
+    catch (err) {
+        Sentry.captureException(err);
+        process.exitCode = 1;
+    }
+    finally {
+        await Sentry.flush(2000);
+    }
+})();
+//# sourceMappingURL=index.js.map
+//# debugId=47414e28-81ab-5d6e-b37e-5988b2866f47

package/dist/sentry-before-send.d.ts

@@ -0,0 +1,3 @@
+import type { ErrorEvent, EventHint } from "@sentry/node";
+export declare function beforeSend(event: ErrorEvent, _hint: EventHint): ErrorEvent | null;
+//# sourceMappingURL=sentry-before-send.d.ts.map