@indigoai-us/hq-cli 5.61.0 → 5.62.0

package/dist/commands/db-sql.js

@@ -0,0 +1,81 @@
+/**
+ * hq db sql — run SQL against the company local vault DB (US-004).
+ *
+ * Default is read-only. Prefer `hq db migrate` for schema changes.
+ * Never prints remote connection strings.
+ */
+
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="0de705fa-ba79-5f19-9797-2a68dd79f24d")}catch(e){}}();
+import chalk from "chalk";
+import fs from "node:fs";
+import { runRemoteSql } from "../lib/db/remote-sql.js";
+import { formatSqlResult, runLocalSql } from "../lib/db/sql.js";
+function readSqlArg(sqlArgs, stdinFlag) {
+    if (stdinFlag || sqlArgs.length === 0) {
+        if (process.stdin.isTTY && sqlArgs.length === 0) {
+            throw new Error("SQL required: pass as arguments after -- or pipe via stdin");
+        }
+        return fs.readFileSync(0, "utf8");
+    }
+    return sqlArgs.join(" ");
+}
+export function registerDbSqlCommand(db) {
+    db.command("sql")
+        .description("Run SQL against the company vault DB (local default; --remote for secrets-injected remote; read-only by default)")
+        .requiredOption("--company <slug>", "Company slug (tenant scope; required)")
+        .option("--write", "Allow write/DDL statements (discouraged for ad-hoc DDL)", false)
+        .option("--remote", "Use remote tier via vault-bound credentials (not auto-replicated with local)", false)
+        .option("--db-path <path>", "Dangerous: open a non-canonical DB path (denied unless --allow-cross-company-path)")
+        .option("--allow-cross-company-path", "Dangerous: permit --db-path outside this company's canonical local DB", false)
+        .option("--format <fmt>", "Output format: jsonl | table", "jsonl")
+        .option("--home <path>", "Override home for local DB root (tests)")
+        .option("--stdin", "Read SQL from stdin", false)
+        .argument("[sql...]", "SQL statement (or use --stdin / pipe)")
+        .action(async (sqlParts, opts) => {
+        try {
+            const company = String(opts.company ?? "").trim();
+            if (!company) {
+                console.error(chalk.red("Error: --company is required"));
+                process.exitCode = 1;
+                return;
+            }
+            const sql = readSqlArg(sqlParts, !!opts.stdin).trim();
+            const format = opts.format === "table" ? "table" : "jsonl";
+            if (opts.remote) {
+                // Local and remote are not auto-replicated (v1 limitation).
+                const remoteResult = await runRemoteSql({
+                    company,
+                    sql,
+                    getConnectionConfig: async () => {
+                        throw new Error("no remote binding");
+                    },
+                });
+                console.log(formatSqlResult({
+                    columns: remoteResult.rows[0]
+                        ? Object.keys(remoteResult.rows[0])
+                        : [],
+                    rows: remoteResult.rows,
+                    changes: 0,
+                    readonly: true,
+                }, format));
+                return;
+            }
+            const result = runLocalSql({
+                company,
+                sql,
+                write: !!opts.write,
+                dbPathOverride: opts.dbPath,
+                allowCrossCompanyPath: !!opts.allowCrossCompanyPath,
+                format,
+                ...(opts.home ? { home: opts.home } : {}),
+            });
+            console.log(formatSqlResult(result, format));
+        }
+        catch (error) {
+            console.error(chalk.red("Error:"), error instanceof Error ? error.message : "Unknown error");
+            process.exitCode = 1;
+        }
+    });
+}
+//# sourceMappingURL=db-sql.js.map
+//# debugId=0de705fa-ba79-5f19-9797-2a68dd79f24d

package/dist/commands/db-status.d.ts

@@ -0,0 +1,7 @@
+/**
+ * hq db status — ensure local vault DB exists and report health.
+ * Optionally reports remote tier when control plane returns a binding (US-009).
+ */
+import { Command } from "commander";
+export declare function registerDbStatusCommand(db: Command): void;
+//# sourceMappingURL=db-status.d.ts.map

package/dist/commands/db-status.js

@@ -0,0 +1,70 @@
+/**
+ * hq db status — ensure local vault DB exists and report health.
+ * Optionally reports remote tier when control plane returns a binding (US-009).
+ */
+
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="8b820218-b1e5-57a2-8acd-d8e749a0d83f")}catch(e){}}();
+import chalk from "chalk";
+import { ControlPlaneDbClient } from "../lib/db/control-plane.js";
+import { ensureAndStatusLocalDb, formatLocalDbStatus, } from "../lib/db/local.js";
+export function registerDbStatusCommand(db) {
+    db.command("status")
+        .description("Show local (and remote when bound) vault DB status; auto-creates local SQLite if missing")
+        .requiredOption("--company <slug>", "Company slug (tenant scope; required)")
+        .option("--home <path>", "Override home directory for local DB root (tests / advanced only)")
+        .option("--remote", "Also query control plane for remote tier status (requires auth)", false)
+        .option("--company-uid <uid>", "Company uid for remote status (with --remote)")
+        .action(async (opts) => {
+        try {
+            const company = String(opts.company ?? "").trim();
+            if (!company) {
+                console.error(chalk.red("Error: --company is required"));
+                process.exitCode = 1;
+                return;
+            }
+            const status = ensureAndStatusLocalDb(company, opts.home ? { home: opts.home } : undefined);
+            // Never print remote connection material.
+            console.log(formatLocalDbStatus(status));
+            if (opts.remote) {
+                const companyUid = opts.companyUid || `cmp_${company}`;
+                const baseUrl = process.env.HQ_API_BASE_URL ||
+                    process.env.HQ_CLOUD_API_URL ||
+                    "https://hqapi.getindigo.ai";
+                try {
+                    const client = new ControlPlaneDbClient({
+                        baseUrl,
+                        getAccessToken: async () => {
+                            if (process.env.HQ_DB_MOCK_CONTROL_PLANE === "1") {
+                                return "mock-token";
+                            }
+                            throw new Error("auth required for remote status");
+                        },
+                    });
+                    const remote = await client.status(companyUid);
+                    if (!remote.remote) {
+                        console.log("remote: (none)");
+                    }
+                    else {
+                        console.log(`remote: ${remote.remote.status}`);
+                        console.log(`remoteEngine: ${remote.remote.engineId}`);
+                        console.log(`remoteRegion: ${remote.remote.region}`);
+                        console.log(`remoteResourceArn: ${remote.remote.resourceArn}`);
+                    }
+                }
+                catch (e) {
+                    const msg = e instanceof Error ? e.message : "remote status failed";
+                    console.log(`remote: error (${msg})`);
+                }
+            }
+            if (!status.healthy) {
+                process.exitCode = 1;
+            }
+        }
+        catch (error) {
+            console.error(chalk.red("Error:"), error instanceof Error ? error.message : "Unknown error");
+            process.exitCode = 1;
+        }
+    });
+}
+//# sourceMappingURL=db-status.js.map
+//# debugId=8b820218-b1e5-57a2-8acd-d8e749a0d83f

package/dist/commands/db.d.ts

@@ -0,0 +1,9 @@
+/**
+ * hq db — vault database commands (local + remote tiers).
+ */
+import { Command } from "commander";
+/**
+ * Register the `hq db` command group and its subcommands.
+ */
+export declare function registerDbCommand(program: Command): void;
+//# sourceMappingURL=db.d.ts.map

package/dist/commands/db.js

@@ -0,0 +1,23 @@
+/**
+ * hq db — vault database commands (local + remote tiers).
+ */
+
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="c5202241-a9a4-52bf-81b7-e95dc255d08f")}catch(e){}}();
+import { registerDbMigrateCommand } from "./db-migrate.js";
+import { registerDbProvisionCommand } from "./db-provision.js";
+import { registerDbSqlCommand } from "./db-sql.js";
+import { registerDbStatusCommand } from "./db-status.js";
+/**
+ * Register the `hq db` command group and its subcommands.
+ */
+export function registerDbCommand(program) {
+    const db = program
+        .command("db")
+        .description("Vault databases — local SQLite per company and HQ-managed remote Postgres-class DBs");
+    registerDbStatusCommand(db);
+    registerDbSqlCommand(db);
+    registerDbMigrateCommand(db);
+    registerDbProvisionCommand(db);
+}
+//# sourceMappingURL=db.js.map
+//# debugId=c5202241-a9a4-52bf-81b7-e95dc255d08f

package/dist/commands/integrations.d.ts

@@ -0,0 +1,78 @@
+/**
+ * `hq integrations` subcommand group — use company-connected apps (the
+ * integration factory's governed gateway) from any HQ-authenticated session.
+ *
+ * The console connects apps (e.g. Linear via OAuth sign-in); cloud agents get
+ * their tools natively through hq-pro's integration MCP gateway
+ * (POST /v1/integrations/mcp). This command gives LOCAL sessions (Claude
+ * Code / Codex chats, scripts) the same first-class path — no hand-crafted
+ * authenticated curl calls.
+ *
+ * Subcommands:
+ *   hq integrations list                     Connected apps for the company.
+ *   hq integrations tools --provider <p>     What the connected app can do.
+ *   hq integrations call <tool> --provider <p> --args '<json>'
+ *                                            Invoke one of the app's tools.
+ *   hq integrations approve|reject <queueId> --provider <p>
+ *                                            Decide a queued (approval-gated)
+ *                                            call; approve executes it.
+ *
+ * Governance: reads flow freely; calls that can change the app are subject to
+ * the connection's write policy (default: a person approves first). A queued
+ * outcome is surfaced clearly with the exact approve command to run.
+ *
+ * Auth: Cognito ID token via the shared session cache (`hq auth refresh`
+ * semantics); company resolves like every other command — `--company <slug>`
+ * or the caller's single active membership. Never hardcoded.
+ */
+import { Command } from "commander";
+interface AdminConnection {
+    id: string;
+    provider: string;
+    status: string;
+    writePolicy?: string;
+    installation?: {
+        displayName?: string;
+        domain?: string;
+        status?: string;
+    } | null;
+}
+interface GatewayMessage {
+    result?: unknown;
+    error?: {
+        code?: number;
+        message?: string;
+    };
+}
+export declare class IntegrationsCliError extends Error {
+    constructor(message: string);
+}
+/** "factory:linear" → "linear"; mirrors hq-pro's factoryToolPrefix. */
+export declare function toolPrefixForProvider(provider: string): string;
+export declare function fetchConnections(token: string, companyUid: string): Promise<AdminConnection[]>;
+/**
+ * Resolve one connection by `--connection acct_…` or `--provider linear`
+ * (matches `factory:<slug>` and bare provider ids, case-insensitive). Errors
+ * list what IS connected so the fix is one command away.
+ */
+export declare function selectConnection(connections: AdminConnection[], opts: {
+    connection?: string;
+    provider?: string;
+}): AdminConnection;
+export declare function callGateway(token: string, params: Record<string, unknown>): Promise<GatewayMessage>;
+/**
+ * Gateway results arrive MCP-style: `{ content: [{ type: "text", text }] }`
+ * where `text` is the provider's JSON. Unwrap to the inner payload; fall back
+ * to the raw result when the shape differs.
+ */
+export declare function unwrapGatewayResult(result: unknown): unknown;
+interface QueuedOutcome {
+    queuedForApproval: true;
+    queueId: string;
+    connectionId: string;
+    expiresAt?: string;
+}
+export declare function queuedOutcome(payload: unknown): QueuedOutcome | null;
+export declare function registerIntegrationsCommand(program: Command): void;
+export {};
+//# sourceMappingURL=integrations.d.ts.map

package/dist/commands/integrations.js

@@ -0,0 +1,309 @@
+/**
+ * `hq integrations` subcommand group — use company-connected apps (the
+ * integration factory's governed gateway) from any HQ-authenticated session.
+ *
+ * The console connects apps (e.g. Linear via OAuth sign-in); cloud agents get
+ * their tools natively through hq-pro's integration MCP gateway
+ * (POST /v1/integrations/mcp). This command gives LOCAL sessions (Claude
+ * Code / Codex chats, scripts) the same first-class path — no hand-crafted
+ * authenticated curl calls.
+ *
+ * Subcommands:
+ *   hq integrations list                     Connected apps for the company.
+ *   hq integrations tools --provider <p>     What the connected app can do.
+ *   hq integrations call <tool> --provider <p> --args '<json>'
+ *                                            Invoke one of the app's tools.
+ *   hq integrations approve|reject <queueId> --provider <p>
+ *                                            Decide a queued (approval-gated)
+ *                                            call; approve executes it.
+ *
+ * Governance: reads flow freely; calls that can change the app are subject to
+ * the connection's write policy (default: a person approves first). A queued
+ * outcome is surfaced clearly with the exact approve command to run.
+ *
+ * Auth: Cognito ID token via the shared session cache (`hq auth refresh`
+ * semantics); company resolves like every other command — `--company <slug>`
+ * or the caller's single active membership. Never hardcoded.
+ */
+
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="a9b3ea5a-d7b5-5786-a961-af26b18eebaa")}catch(e){}}();
+import { randomUUID } from "node:crypto";
+import chalk from "chalk";
+import { ensureCognitoIdToken } from "../utils/cognito-session.js";
+import { getCompanyUid, vaultApiFetch } from "../utils/vault-api.js";
+export class IntegrationsCliError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "IntegrationsCliError";
+    }
+}
+/** "factory:linear" → "linear"; mirrors hq-pro's factoryToolPrefix. */
+export function toolPrefixForProvider(provider) {
+    return provider
+        .replace(/^factory:/, "")
+        .trim()
+        .toLowerCase()
+        .replace(/[^a-z0-9]+/g, ".");
+}
+export async function fetchConnections(token, companyUid) {
+    const res = await vaultApiFetch({
+        token,
+        path: "/v1/integrations/admin",
+        query: { companyUid },
+    });
+    if (!res.ok) {
+        const body = (await res.json().catch(() => ({})));
+        throw new IntegrationsCliError(body.error ?? `Failed to list integrations (HTTP ${res.status})`);
+    }
+    const data = (await res.json());
+    return data.connections ?? [];
+}
+/**
+ * Resolve one connection by `--connection acct_…` or `--provider linear`
+ * (matches `factory:<slug>` and bare provider ids, case-insensitive). Errors
+ * list what IS connected so the fix is one command away.
+ */
+export function selectConnection(connections, opts) {
+    const active = connections.filter((c) => c.status !== "revoked");
+    if (opts.connection) {
+        const match = connections.find((c) => c.id === opts.connection);
+        if (!match) {
+            throw new IntegrationsCliError(`No connection '${opts.connection}'. Run \`hq integrations list\` to see connected apps.`);
+        }
+        return match;
+    }
+    if (opts.provider) {
+        const want = opts.provider.trim().toLowerCase();
+        const match = active.find((c) => {
+            const bare = c.provider.replace(/^factory:/, "").toLowerCase();
+            return bare === want || c.provider.toLowerCase() === want;
+        });
+        if (!match) {
+            const available = active
+                .map((c) => c.provider.replace(/^factory:/, ""))
+                .join(", ");
+            throw new IntegrationsCliError(`No connected app matches '${opts.provider}'.` +
+                (available ? ` Connected: ${available}.` : " Nothing is connected yet — connect apps on the console Integrations page."));
+        }
+        return match;
+    }
+    if (active.length === 1)
+        return active[0];
+    if (active.length === 0) {
+        throw new IntegrationsCliError("No connected apps yet. Connect one on the console Integrations page, then retry.");
+    }
+    throw new IntegrationsCliError(`Multiple apps are connected — pick one with --provider:\n` +
+        active.map((c) => `  --provider ${c.provider.replace(/^factory:/, "")}`).join("\n"));
+}
+export async function callGateway(token, params) {
+    const res = await vaultApiFetch({
+        token,
+        path: "/v1/integrations/mcp",
+        method: "POST",
+        body: {
+            jsonrpc: "2.0",
+            id: `hq-cli-${randomUUID()}`,
+            method: "tools/call",
+            params,
+        },
+    });
+    const message = (await res.json().catch(() => null));
+    if (!res.ok || !message) {
+        throw new IntegrationsCliError(`Integration gateway request failed (HTTP ${res.status}).`);
+    }
+    if (message.error) {
+        throw new IntegrationsCliError(message.error.message ?? "Integration gateway returned an error.");
+    }
+    return message;
+}
+/**
+ * Gateway results arrive MCP-style: `{ content: [{ type: "text", text }] }`
+ * where `text` is the provider's JSON. Unwrap to the inner payload; fall back
+ * to the raw result when the shape differs.
+ */
+export function unwrapGatewayResult(result) {
+    if (result && typeof result === "object" && Array.isArray(result.content)) {
+        const content = result.content;
+        const text = content.find((c) => c.type === "text")?.text;
+        if (typeof text === "string") {
+            try {
+                return JSON.parse(text);
+            }
+            catch {
+                return text;
+            }
+        }
+    }
+    return result;
+}
+export function queuedOutcome(payload) {
+    if (payload &&
+        typeof payload === "object" &&
+        payload.queuedForApproval === true &&
+        typeof payload.queueId === "string") {
+        return payload;
+    }
+    return null;
+}
+function printJson(value) {
+    console.log(JSON.stringify(value, null, 2));
+}
+export function registerIntegrationsCommand(program) {
+    const integrations = program
+        .command("integrations")
+        .description("Use company-connected apps (Linear, Notion, …) through HQ's governed integration gateway");
+    integrations
+        .command("list")
+        .description("List the company's connected apps")
+        .option("--company <slug>", "Company slug (defaults to your single active company)")
+        .option("--json", "Machine-readable output")
+        .action(async (opts) => {
+        const token = await ensureCognitoIdToken();
+        const companyUid = await getCompanyUid(token, opts.company);
+        const connections = await fetchConnections(token, companyUid);
+        if (opts.json) {
+            printJson(connections);
+            return;
+        }
+        if (connections.length === 0) {
+            console.log("No apps connected yet. Connect one on the console Integrations page.");
+            return;
+        }
+        for (const c of connections) {
+            const name = c.installation?.displayName ?? c.provider.replace(/^factory:/, "");
+            const flags = [
+                c.status,
+                c.writePolicy ? `writes: ${c.writePolicy}` : null,
+                c.installation?.status === "needs_credentials" ? "needs sign-in" : null,
+            ]
+                .filter(Boolean)
+                .join(" · ");
+            console.log(`${chalk.bold(name)}  (${c.provider.replace(/^factory:/, "")})  ${chalk.dim(flags)}`);
+            console.log(chalk.dim(`  connection: ${c.id}`));
+        }
+    });
+    integrations
+        .command("tools")
+        .description("List what a connected app can do")
+        .option("--provider <slug>", "Connected app (e.g. linear)")
+        .option("--connection <id>", "Connection id (acct_…)")
+        .option("--company <slug>", "Company slug")
+        .option("--json", "Machine-readable output")
+        .action(async (opts) => {
+        const token = await ensureCognitoIdToken();
+        const companyUid = await getCompanyUid(token, opts.company);
+        const connection = selectConnection(await fetchConnections(token, companyUid), opts);
+        const prefix = toolPrefixForProvider(connection.provider);
+        const message = await callGateway(token, {
+            companyUid,
+            name: `${prefix}.mcp.tools.list`,
+            arguments: { companyUid, connectionId: connection.id },
+        });
+        const payload = unwrapGatewayResult(message.result);
+        if (opts.json) {
+            printJson(payload);
+            return;
+        }
+        const tools = payload?.tools ?? [];
+        if (tools.length === 0) {
+            console.log("The app reported no tools.");
+            return;
+        }
+        for (const tool of tools) {
+            const label = tool.title && tool.title !== tool.name ? `  ${chalk.dim(tool.title)}` : "";
+            console.log(`${chalk.bold(tool.name)}${label}`);
+        }
+        console.log(chalk.dim(`\n${tools.length} tools. Call one with: hq integrations call <tool> --provider ${connection.provider.replace(/^factory:/, "")} --args '<json>'`));
+    });
+    integrations
+        .command("call <tool>")
+        .description("Call one of a connected app's tools (approval-gated when it changes things)")
+        .option("--provider <slug>", "Connected app (e.g. linear)")
+        .option("--connection <id>", "Connection id (acct_…)")
+        .option("--company <slug>", "Company slug")
+        .option("--args <json>", "Tool arguments as JSON", "{}")
+        .option("--idempotency-key <key>", "Stable key so retries execute at most once (default: generated)")
+        .option("--json", "Machine-readable output")
+        .action(async (tool, opts) => {
+        let parsedArgs;
+        try {
+            const raw = JSON.parse(opts.args);
+            if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
+                throw new Error("not an object");
+            }
+            parsedArgs = raw;
+        }
+        catch {
+            throw new IntegrationsCliError(`--args must be a JSON object, e.g. --args '{"assignee":"me"}'`);
+        }
+        const token = await ensureCognitoIdToken();
+        const companyUid = await getCompanyUid(token, opts.company);
+        const connection = selectConnection(await fetchConnections(token, companyUid), opts);
+        const prefix = toolPrefixForProvider(connection.provider);
+        const idempotencyKey = opts.idempotencyKey ?? `hq-cli-${randomUUID()}`;
+        const message = await callGateway(token, {
+            companyUid,
+            name: `${prefix}.mcp.tools.call`,
+            arguments: {
+                companyUid,
+                connectionId: connection.id,
+                toolName: tool,
+                arguments: parsedArgs,
+                idempotencyKey,
+            },
+        });
+        const payload = unwrapGatewayResult(message.result);
+        const queued = queuedOutcome(payload);
+        if (queued) {
+            if (opts.json) {
+                printJson(payload);
+                return;
+            }
+            console.log(chalk.yellow("Queued for approval — this call can change the app, so a company owner decides first."));
+            console.log(`Approve with:\n  hq integrations approve ${queued.queueId} --provider ${connection.provider.replace(/^factory:/, "")}`);
+            if (queued.expiresAt) {
+                console.log(chalk.dim(`Expires ${queued.expiresAt}`));
+            }
+            return;
+        }
+        printJson(payload);
+    });
+    for (const decision of ["approve", "reject"]) {
+        integrations
+            .command(`${decision} <queueId>`)
+            .description(decision === "approve"
+            ? "Approve a queued call — it executes exactly once (owner only)"
+            : "Reject a queued call (owner only)")
+            .option("--provider <slug>", "Connected app (e.g. linear)")
+            .option("--connection <id>", "Connection id (acct_…)")
+            .option("--company <slug>", "Company slug")
+            .option("--json", "Machine-readable output")
+            .action(async (queueId, opts) => {
+            const token = await ensureCognitoIdToken();
+            const companyUid = await getCompanyUid(token, opts.company);
+            const connection = selectConnection(await fetchConnections(token, companyUid), opts);
+            const res = await vaultApiFetch({
+                token,
+                path: `/v1/integrations/confirm/${encodeURIComponent(queueId)}/${decision}`,
+                method: "POST",
+                body: { companyUid, connectionId: connection.id },
+            });
+            const body = (await res.json().catch(() => ({})));
+            if (!res.ok) {
+                throw new IntegrationsCliError(body.error ?? `${decision} failed (HTTP ${res.status})`);
+            }
+            if (opts.json) {
+                printJson(body);
+                return;
+            }
+            console.log(decision === "approve"
+                ? chalk.green(`Approved — the call ran (status: ${body.status ?? "resumed"}).`)
+                : chalk.yellow(`Rejected (status: ${body.status ?? "rejected"}).`));
+            if (decision === "approve" && body.result !== undefined) {
+                printJson(unwrapGatewayResult(body.result));
+            }
+        });
+    }
+}
+//# sourceMappingURL=integrations.js.map
+//# debugId=a9b3ea5a-d7b5-5786-a961-af26b18eebaa

package/dist/commands/members.js

@@ -1,5 +1,5 @@
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="c844265d-9140-55ac-8fc7-c0b2a049a0af")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="e3c1d5a2-b7f4-5f0f-8603-000df9bcca33")}catch(e){}}();
 import chalk from "chalk";
 import { ensureCognitoToken } from "../utils/cognito-session.js";
 import { vaultApiFetch, getCompanyUid } from "../utils/vault-api.js";
@@ -427,8 +427,8 @@ export function registerMembersCommand(program) {
             console.log();
             console.log(chalk.bold("To complete the invite, do ONE of:"));
             console.log(`  1. Manually notify ${inviteeEmail ?? "the invitee"}: ask them to sign into HQ`);
-            console.log(`     at https://hq.getindigo.ai with that email address.`);
-            console.log(`  2. Or use the hq-console UI at https://hq.getindigo.ai to issue the`);
+            console.log(`     at https://hq.computer with that email address.`);
+            console.log(`  2. Or use the hq-console UI at https://hq.computer to issue the`);
             console.log(`     invite instead — the UI path triggers an automated email via Resend.`);
             if (result.emailSkipped !== true && result.emailSent === undefined) {
                 console.log();
@@ -564,4 +564,4 @@ export function registerMembersCommand(program) {
     });
 }
 //# sourceMappingURL=members.js.map
-//# debugId=c844265d-9140-55ac-8fc7-c0b2a049a0af
+//# debugId=e3c1d5a2-b7f4-5f0f-8603-000df9bcca33

package/dist/commands/outposts.d.ts

@@ -0,0 +1,60 @@
+/**
+ * `hq outposts` — manage your personal HQ Outposts (EC2 boxes) from the
+ * terminal instead of the web console. Targets the hq-pro `/outpost/*`
+ * control plane on `DEFAULT_VAULT_API_URL` via the shared `vaultApiFetch`
+ * helper — the same routes the console's outpost panel calls.
+ *
+ * Outposts are PERSONAL / caller-scoped: hq-pro keys every `/outpost/*` route
+ * on the caller's Cognito sub, so there is no `--company`. `--id <outpostId>`
+ * selects a specific box (passed as the `outpostId` query param); when omitted
+ * hq-pro targets the caller's primary slot.
+ *
+ * Subcommands:
+ *   hq outposts list                — every Outpost you own (row summaries)
+ *   hq outposts status [--id]       — live detail for one box
+ *   hq outposts codex-enable [--id] — enable / retry Codex on the box
+ *   hq outposts login [--id]        — request a fresh login URL
+ *   hq outposts destroy [--id] --yes — tear the box down (destructive; flag-guarded)
+ *
+ * NOTE: hq-pro exposes no rename or settings-mutation route for Outposts (the
+ * web console can't rename them either), so this CLI wraps only the lifecycle
+ * and status routes that exist. Renaming an Outpost is not a backend capability.
+ */
+import { Command } from "commander";
+/** A non-2xx from the `/outpost/*` control plane. Carries status + `step`. */
+export declare class OutpostHttpError extends Error {
+    status: number;
+    step?: string;
+    constructor(status: number, message: string, step?: string);
+}
+/** Row summary from `GET /outpost/list`. */
+export interface OutpostSummary {
+    outpostId: string;
+    state: string;
+    instanceName: string;
+    region: string;
+    agentRuntime: string;
+    platform: string;
+    createdAt: string;
+    [key: string]: unknown;
+}
+/**
+ * Authenticated JSON round-trip against the outpost control plane. Throws
+ * `OutpostHttpError` on any non-2xx (never swallows — hq-never-swallow-errors),
+ * decoding hq-pro's `{ error | message, step }` envelope for the reason. The
+ * `step` is preserved so callers can recognise the `destroy` route's
+ * `teardown-incomplete` 409 (which means "retry", not "failed").
+ */
+export declare function outpostRequest<T>(opts: {
+    token: string;
+    path: string;
+    method?: string;
+    query?: Record<string, string>;
+}): Promise<T>;
+export declare function listOutposts(token: string): Promise<OutpostSummary[]>;
+export declare function getOutpostStatus(token: string, outpostId?: string): Promise<Record<string, unknown>>;
+export declare function enableCodex(token: string, outpostId?: string): Promise<Record<string, unknown>>;
+export declare function regenerateLoginUrl(token: string, outpostId?: string): Promise<Record<string, unknown>>;
+export declare function destroyOutpost(token: string, outpostId?: string): Promise<Record<string, unknown>>;
+export declare function registerOutpostsCommand(program: Command): void;
+//# sourceMappingURL=outposts.d.ts.map