@indigoai-us/hq-cli 5.50.0 → 5.50.2

package/dist/commands/pack-install.d.ts

@@ -34,6 +34,7 @@
  * from each pack's package.yaml; rationale lives in the layout-fix PR.)
  */
 import { type KeyObject } from 'node:crypto';
+import { type SecretResolver } from './mcp-registration.js';
 import type { PackManifest } from '../types.js';
 export type Transport = 'npm' | 'git' | 'local' | 'marketplace';
 /** Prefix that routes a source through the HQ marketplace transport (US-006). */
@@ -237,7 +238,39 @@ export declare function computeArtifactHash(tarballBytes: Uint8Array): string;
  * full strings rather than prefixes.
  */
 export declare function verifyArtifact(input: VerifyArtifactInput): void;
+/**
+ * Parse + shape-validate one pack's per-server MCP manifest (`mcp/{item}.json`),
+ * mirroring the bash `validate_mcp_manifest` arm. EXPORTED so the acceptance
+ * test (and US-006's registration engine) can call it directly.
+ *
+ * Throws an `Error` (whose message names the pack-relative payload path, e.g.
+ * `mcp/foo.json`) when the file does not parse as JSON or violates a transport
+ * rule:
+ *   - `type` required, one of `http|stdio|sse`;
+ *   - no unknown top-level keys (allowed: {@link MCP_ALLOWED_KEYS});
+ *   - http/sse: `url` required + `^https?://`; `command`/`args`/`env` forbidden;
+ *   - stdio: non-empty `command` required; `url`/`headers` forbidden;
+ *   - `headers`/`env` (if present) are objects of string values;
+ *   - NO inline literal `Bearer ` secret — such a value MUST carry a
+ *     `${secret:NAME}` reference, never a literal token.
+ *
+ * @param payloadDir the pack payload root (holds `mcp/{item}.json`)
+ * @param item       the bare server name declared under `contributes.mcp`
+ */
+export declare function validateMcpManifest(payloadDir: string, item: string): void;
 export declare function validateManifest(payloadDir: string, hqVersion: string | null): PackManifest;
+/**
+ * Enforce a pack's `requires.packs`: every named dependency MUST already be
+ * installed (and satisfy its optional semver RANGE) before we write anything.
+ *
+ * Installed packs are discovered by FILESYSTEM PRESENCE via `listInstalledPacks`
+ * — deliberately NOT `modules.yaml`, which `installPack` no longer writes under
+ * the v12+ layout (a modules.yaml-based check would silently ignore every modern
+ * pack). Throws on the first unmet dependency so the install aborts with NO
+ * partial state (it is called before installToPackages). No-op when
+ * `requires.packs` is absent/empty, keeping legacy packs unaffected.
+ */
+export declare function assertPackDependencies(hqRoot: string, pkg: PackManifest): void;
 /**
  * Derive the safe, auto-generated "get started" line for a freshly installed
  * pack from its `initialization.entrypoint` ONLY. PHASE 1 deliberately ignores
@@ -252,6 +285,40 @@ export declare function validateManifest(payloadDir: string, hqVersion: string |
  * the caller prints nothing extra).
  */
 export declare function getStartedLine(initialization?: PackManifest['initialization']): string | null;
+/**
+ * Render one declared MCP server's prompt line, redacting every header/env value.
+ * EXPORTED so the acceptance/redaction self-test can assert no secret/Bearer
+ * substring ever appears in the rendered output.
+ */
+export declare function renderMcpServerLine(payloadDir: string, item: string): string;
+/**
+ * Install-time MCP trust prompt. EXPORTED so the acceptance test can drive the
+ * gate / bypass / non-TTY branches directly (capture stdout, assert no secret
+ * substring leaks, assert deny returns false). See {@link confirmHooks} for the
+ * voice/shape this mirrors.
+ */
+export declare function confirmMcp(pkg: PackManifest, payloadDir: string, allowMcp: boolean): Promise<boolean>;
+/**
+ * Build the install-time {@link SecretResolver} bound to the HQ vault's local
+ * secrets-cache (`~/.hq/secrets-cache/<scope>/<NAME>`, AES-256-GCM, 0600, TTL'd).
+ *
+ * Active-company resolution at install time is INDIRECT by design: `hq install`
+ * has no `--company` flag and runs OFFLINE (no token), so we cannot resolve a
+ * single active company UID the way `hq run` / `hq secrets` do (via
+ * `getEntityUid` over the network). Instead we probe EVERY cached scope
+ * (`cmp_*`/`prs_*` — whichever has minted secrets locally) for the requested
+ * name and return the first hit. This naturally resolves to whichever company
+ * context just provisioned the secret (e.g. the one `/connect-shopify` minted
+ * `VYG_API_KEY` under), without guessing, and works whether the vault scoped the
+ * key under a company or person entity.
+ *
+ * On MISS across all scopes (no cache, expired TTL, or key never minted) it
+ * returns `null` — which is exactly what {@link registerMcpServers}'s
+ * unresolvable-secret path keys off to defer that server gracefully. With no
+ * cached scopes at all (`listSecretCacheScopes()` → `[]`) it simply returns
+ * `null` for every name, the desired graceful-deferral behavior.
+ */
+export declare function makeInstallSecretResolver(): SecretResolver;
 /**
  * Install the fetched payload to `<hqRoot>/core/packages/<pkg.name>/` (HQ
  * v12+ layout). The HQ template (`hq-core` / `hq-core-staging`) ships
@@ -308,6 +375,13 @@ export declare function runScanPackages(hqRoot: string, opts?: {
 }): void;
 export interface InstallPackOptions {
     allowHooks?: boolean;
+    /**
+     * US-010 install-time MCP trust prompt bypass (CI/ambient-trust). Mirrors
+     * `allowHooks`: when set, `confirmMcp` skips the prompt and prints a yellow
+     * notice. Absent/false → the operator is prompted (or, in a non-TTY shell,
+     * the install is refused with a "re-run with --allow-mcp" hint).
+     */
+    allowMcp?: boolean;
     followBranch?: boolean;
     /**
      * Route this function's human output to stderr (and silence scan-packages