@indigoai-us/hq-cli 5.8.5 → 5.9.0

package/CHANGELOG.md

@@ -0,0 +1,30 @@
+# Changelog
+
+## [5.9.0] — 2026-05-04
+
+### Added
+
+- **`hq run` command** — schema-driven dev workflow. Place a `.env.schema` file in
+  your repo (annotated with `# @hqCompany("your-slug")` and `VARNAME=hq()` resolvers),
+  then run `hq run -- npm run dev` to inject all declared secrets into the child
+  process's environment without ever printing them to stdout/stderr. Discovers schemas
+  by walking up from cwd to the repo root; merges multiple schemas; respects sibling
+  `.env.local` files for local overrides. Supports `--check` for a dry-run summary,
+  `--company` to override the slug, and `--schema` to pin an explicit schema path.
+
+- **Batch secrets endpoint** — `POST /secrets/{companyUid}/load` on the vault API
+  reduces N parallel single-secret fetches to chunked `ssm:GetParameters` calls
+  (up to 10 names per batch), cutting `hq run` latency for schemas with many vars.
+  Responses include both `secrets` (allowed) and `errors` (denied/not-found) per name.
+  Each revealed secret is audit-logged individually (same trail as `hq secrets get`).
+
+- **`varlock` dependency** (`1.0.0`, exact pin) — used as an internal library to
+  parse `.env.schema` files and drive the resolver graph. The `hq()` resolver is
+  implemented as a varlock plugin registered at runtime; varlock is not exposed as a
+  public API surface.
+
+### Changed
+
+- **Node minimum raised to `>=22.0.0`** — required by `varlock@1.0.0` (ESM-only,
+  `node>=22`). The previous minimum was unset; this makes the requirement explicit
+  in `engines.node`.

package/dist/commands/files.js

@@ -1,5 +1,5 @@
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="3d902660-a8aa-5671-ab69-21ffc0143c60")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="a754383e-f129-5052-a8d8-59ea590b4f3d")}catch(e){}}();
 import chalk from "chalk";
 import { ensureCognitoToken } from "../utils/cognito-session.js";
 import { vaultApiFetch, getCompanyUid } from "./secrets.js";
@@ -148,22 +148,36 @@ export function registerFilesCommand(program) {
             const token = await ensureCognitoToken();
             const companySlug = files.opts().company;
             const companyUid = await getCompanyUid(token, companySlug);
-            const res = await vaultApiFetch({
-                token,
-                path: `/files/${encodeURIComponent(companyUid)}/acl`,
-                query: { prefix: canonicalPrefix },
-            });
-            if (!res.ok) {
-                const body = await res.json().catch(() => ({}));
+            // Fetch the prefix's own ACL row (creator, open flag, effective
+            // permission) and the inherited/descendant tree in parallel so the
+            // user sees every grant that affects this prefix in one shot.
+            const [aclRes, treeRes] = await Promise.all([
+                vaultApiFetch({
+                    token,
+                    path: `/files/${encodeURIComponent(companyUid)}/acl`,
+                    query: { prefix: canonicalPrefix },
+                }),
+                vaultApiFetch({
+                    token,
+                    path: `/files/${encodeURIComponent(companyUid)}/acl/tree`,
+                    query: { prefix: canonicalPrefix },
+                }),
+            ]);
+            async function readErrorBody(res) {
+                return (await res.json().catch(() => ({})));
+            }
+            // Auth/server failures from either call are treated identically — bail
+            // out with a single message rather than printing a half-rendered view.
+            for (const res of [aclRes, treeRes]) {
+                if (res.ok || res.status === 404)
+                    continue;
+                const body = await readErrorBody(res);
                 if (res.status === 401) {
                     console.error(chalk.red("Not authenticated — please run `hq login`"));
                 }
                 else if (res.status === 403) {
                     console.error(chalk.red("Not authorized to view this file prefix's ACL"));
                 }
-                else if (res.status === 404) {
-                    console.error(chalk.red(`No ACL record exists for '${canonicalPrefix}'`));
-                }
                 else if (res.status >= 500) {
                     console.error(chalk.red(`Server error: ${body.error ?? res.statusText}`));
                 }
@@ -172,46 +186,78 @@ export function registerFilesCommand(program) {
                 }
                 process.exit(1);
             }
-            const data = await res.json();
-            const acl = data.acl;
-            const aclStatus = acl.open ? "open" : "restricted";
-            const aclPrefix = acl.path ?? acl.prefix ?? canonicalPrefix;
+            const acl = aclRes.ok ? (await aclRes.json()).acl : null;
+            const tree = treeRes.ok ? (await treeRes.json()) : null;
+            // No own row AND nothing inherited or granted below — original
+            // "no ACL record" exit path.
+            if (!acl && (!tree || (tree.inherited.length === 0 && tree.children.length === 0))) {
+                console.error(chalk.red(`No ACL record exists for '${canonicalPrefix}'`));
+                process.exit(1);
+            }
+            const aclPrefix = acl?.path ?? acl?.prefix ?? tree?.prefix ?? canonicalPrefix;
+            const aclStatus = acl?.open ? "open" : "restricted";
             console.log(chalk.green(`ACL for ${aclPrefix} (${aclStatus})`));
-            console.log(`Creator: ${acl.creatorUid}`);
-            if (acl.effectivePermission) {
-                console.log(`Your effective permission: ${acl.effectivePermission}`);
+            if (acl) {
+                console.log(`Creator: ${acl.creatorUid}`);
+                if (acl.effectivePermission) {
+                    console.log(`Your effective permission: ${acl.effectivePermission}`);
+                }
+            }
+            else {
+                console.log(chalk.gray("No direct ACL row — access flows from the inherited/descendant grants below."));
+            }
+            function printEntryTable(rows, showSource) {
+                const TYPE_W = Math.max(4, ...rows.map((e) => e.granteeType.length));
+                const GRANTEE_W = Math.max(7, ...rows.map((e) => e.granteeId.length));
+                const PERM_W = Math.max(10, ...rows.map((e) => e.permission.length));
+                const BY_W = Math.max(10, ...rows.map((e) => e.grantedBy.length));
+                const SRC_W = showSource
+                    ? Math.max(6, ...rows.map((e) => (e.sourcePrefix ?? "").length))
+                    : 0;
+                const headerCols = [
+                    "TYPE".padEnd(TYPE_W),
+                    "GRANTEE".padEnd(GRANTEE_W),
+                    "PERMISSION".padEnd(PERM_W),
+                    "GRANTED_BY".padEnd(BY_W),
+                    "GRANTED_AT",
+                ];
+                if (showSource)
+                    headerCols.splice(4, 0, "SOURCE".padEnd(SRC_W));
+                console.log(chalk.bold(headerCols.join("  ")));
+                for (const e of rows) {
+                    const grantedAt = e.grantedAt.slice(0, 10);
+                    const cols = [
+                        e.granteeType.padEnd(TYPE_W),
+                        e.granteeId.padEnd(GRANTEE_W),
+                        e.permission.padEnd(PERM_W),
+                        e.grantedBy.padEnd(BY_W),
+                        grantedAt,
+                    ];
+                    if (showSource)
+                        cols.splice(4, 0, (e.sourcePrefix ?? "").padEnd(SRC_W));
+                    console.log(cols.join("  "));
+                }
             }
-            if (acl.entries.length === 0) {
-                if (acl.open) {
+            const directEntries = acl?.entries ?? tree?.direct ?? [];
+            if (directEntries.length === 0) {
+                if (acl?.open) {
                     console.log(chalk.gray("Open ACL — all active members have read access."));
                 }
-                else {
-                    console.log(chalk.gray("No explicit grants — only creator has access."));
-                }
-                return;
-            }
-            console.log("Entries:");
-            const TYPE_W = Math.max(4, ...acl.entries.map((e) => e.granteeType.length));
-            const GRANTEE_W = Math.max(7, ...acl.entries.map((e) => e.granteeId.length));
-            const PERM_W = Math.max(10, ...acl.entries.map((e) => e.permission.length));
-            const BY_W = Math.max(10, ...acl.entries.map((e) => e.grantedBy.length));
-            const tableHeader = [
-                "TYPE".padEnd(TYPE_W),
-                "GRANTEE".padEnd(GRANTEE_W),
-                "PERMISSION".padEnd(PERM_W),
-                "GRANTED_BY".padEnd(BY_W),
-                "GRANTED_AT",
-            ].join("  ");
-            console.log(chalk.bold(tableHeader));
-            for (const e of acl.entries) {
-                const grantedAt = e.grantedAt.slice(0, 10);
-                console.log([
-                    e.granteeType.padEnd(TYPE_W),
-                    e.granteeId.padEnd(GRANTEE_W),
-                    e.permission.padEnd(PERM_W),
-                    e.grantedBy.padEnd(BY_W),
-                    grantedAt,
-                ].join("  "));
+                else if (acl) {
+                    console.log(chalk.gray("No explicit grants on this prefix — only creator has access."));
+                }
+            }
+            else {
+                console.log("\nDirect entries (granted on this prefix):");
+                printEntryTable(directEntries, false);
+            }
+            if (tree && tree.inherited.length > 0) {
+                console.log("\nInherited (granted on an ancestor prefix):");
+                printEntryTable(tree.inherited, true);
+            }
+            if (tree && tree.children.length > 0) {
+                console.log("\nGranted on descendant prefixes (do not affect this prefix's access):");
+                printEntryTable(tree.children, true);
             }
         }
         catch (err) {
@@ -221,4 +267,4 @@ export function registerFilesCommand(program) {
     });
 }
 //# sourceMappingURL=files.js.map
-//# debugId=3d902660-a8aa-5671-ab69-21ffc0143c60
+//# debugId=a754383e-f129-5052-a8d8-59ea590b4f3d

package/dist/commands/run.d.ts

@@ -0,0 +1,3 @@
+import { Command } from 'commander';
+export declare function registerRunCommand(program: Command): void;
+//# sourceMappingURL=run.d.ts.map

package/dist/commands/run.js

@@ -0,0 +1,119 @@
+
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="a1b39bbf-1f26-59e7-af70-6ecf01f2ce7e")}catch(e){}}();
+import { spawn } from 'node:child_process';
+import * as path from 'node:path';
+import * as fs from 'node:fs';
+import { internal } from 'varlock';
+import { ensureCognitoToken } from '../utils/cognito-session.js';
+import { vaultApiFetch, getCompanyUid } from '../utils/vault-api.js';
+import { discoverSchemas } from '../run/discover-schemas.js';
+import { installHqPlugin, prewarmHqSecrets } from '../run/hq-plugin.js';
+export function registerRunCommand(program) {
+    program
+        .command('run')
+        .description('Load secrets from .env.schema and run a command with them injected')
+        .option('--company <slug>', 'Company slug (overrides @hqCompany in schema)')
+        .option('--schema <path>', 'Explicit schema path (skips walk-up discovery)')
+        .option('--check', 'Resolve schema and validate vars without executing the command')
+        .allowUnknownOption(true)
+        .action(async (opts) => {
+        try {
+            const dashIndex = process.argv.indexOf('--');
+            const childArgs = dashIndex !== -1 ? process.argv.slice(dashIndex + 1) : [];
+            if (!opts.check && childArgs.length === 0) {
+                throw new Error('no command specified. Usage: hq run [options] -- <command> [args...]');
+            }
+            let schemaPaths;
+            let envLocalPaths;
+            let schemaCompanySlug;
+            if (opts.schema) {
+                const schemaAbs = path.resolve(opts.schema);
+                schemaPaths = [schemaAbs];
+                const localPath = path.join(path.dirname(schemaAbs), '.env.local');
+                envLocalPaths = fs.existsSync(localPath) ? [localPath] : [];
+                const content = fs.readFileSync(schemaAbs, 'utf8');
+                const m = /^# @hqCompany\("([^"]+)"\)/m.exec(content);
+                schemaCompanySlug = m ? m[1] : null;
+            }
+            else {
+                const discovered = discoverSchemas(process.cwd());
+                if (discovered.conflict) {
+                    throw new Error(`conflicting @hqCompany slugs: "${discovered.conflict.slugs[0]}" in ${discovered.conflict.paths[0]} vs "${discovered.conflict.slugs[1]}" in ${discovered.conflict.paths[1]}. Use --company <slug> to override.`);
+                }
+                if (discovered.schemaPaths.length === 0) {
+                    throw new Error('no .env.schema found. Create one or use --schema <path>.');
+                }
+                schemaPaths = discovered.schemaPaths;
+                envLocalPaths = discovered.envLocalPaths;
+                schemaCompanySlug = discovered.companySlug;
+            }
+            const slug = opts.company ?? schemaCompanySlug;
+            if (!slug) {
+                throw new Error('company slug not set. Add # @hqCompany("slug") to your .env.schema or pass --company <slug>.');
+            }
+            const token = await ensureCognitoToken();
+            const uid = await getCompanyUid(token, slug);
+            const fetchBatch = async (companyUid, names) => {
+                const res = await vaultApiFetch({
+                    token,
+                    path: `/secrets/${encodeURIComponent(companyUid)}/load`,
+                    method: 'POST',
+                    body: { names },
+                });
+                if (!res.ok) {
+                    const body = await res.json().catch(() => ({}));
+                    throw new Error(`Failed to batch-load secrets: ${body.error ?? res.statusText}`);
+                }
+                return res.json();
+            };
+            const pluginOpts = {
+                companyOverride: opts.company,
+                resolveCompanyUid: async () => uid,
+                fetchBatch,
+            };
+            // LAST entry = highest precedence; .env.local files trail .env.schema files so any .env.local beats any schema regardless of depth.
+            const paths = [...schemaPaths, ...envLocalPaths];
+            let state;
+            const graph = await internal.loadEnvGraph({
+                entryFilePaths: paths,
+                afterInit: async (g) => { state = installHqPlugin(g, pluginOpts); },
+            });
+            await prewarmHqSecrets(graph, pluginOpts, state);
+            await graph.resolveEnvValues();
+            const schemaErrors = Object.entries(graph.configSchema)
+                .filter(([, item]) => item.errors?.length > 0);
+            if (schemaErrors.length > 0) {
+                const msgs = schemaErrors.flatMap(([k, item]) => item.errors.map((e) => `  ${k}: ${e.message ?? String(e)}`));
+                process.stderr.write(`Error: failed to resolve env vars:\n${msgs.join('\n')}\n`);
+                process.exit(1);
+            }
+            const resolvedEnv = graph.getResolvedEnvObject();
+            const varCount = Object.keys(resolvedEnv).length;
+            process.stderr.write(`Loaded ${varCount} env vars from .env.schema (company: ${slug})\n`);
+            if (opts.check) {
+                process.exit(0);
+            }
+            const [childCmd, ...restArgs] = childArgs;
+            const child = spawn(childCmd, restArgs, {
+                stdio: 'inherit',
+                env: { ...process.env, ...resolvedEnv },
+            });
+            child.on('error', (err) => {
+                process.stderr.write(`Error: failed to start command '${childCmd}': ${err.message}\n`);
+                process.exit(1);
+            });
+            child.on('close', (code, signal) => {
+                if (signal) {
+                    process.kill(process.pid, signal);
+                }
+                process.exit(code ?? 1);
+            });
+        }
+        catch (err) {
+            process.stderr.write(`Error: ${err instanceof Error ? err.message : String(err)}\n`);
+            process.exit(1);
+        }
+    });
+}
+//# sourceMappingURL=run.js.map
+//# debugId=a1b39bbf-1f26-59e7-af70-6ecf01f2ce7e

package/dist/commands/secrets.d.ts

@@ -1,12 +1,6 @@
 import { Command } from "commander";
-export interface VaultApiOptions {
-    token: string;
-    path: string;
-    method?: string;
-    body?: Record<string, unknown>;
-    query?: Record<string, string>;
-}
-export declare function vaultApiFetch(opts: VaultApiOptions): Promise<Response>;
-export declare function getCompanyUid(token: string, companySlug: string | undefined): Promise<string>;
+import { vaultApiFetch, getCompanyUid } from "../utils/vault-api.js";
+export type { VaultApiOptions } from "../utils/vault-api.js";
+export { vaultApiFetch, getCompanyUid };
 export declare function registerSecretsCommand(program: Command): void;
 //# sourceMappingURL=secrets.d.ts.map

package/dist/commands/secrets.js

@@ -1,11 +1,13 @@
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="70f0907f-bfcb-5d2e-958a-8813d3bbaf96")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="0239c476-98b8-53c0-9458-1c82dc0d26a9")}catch(e){}}();
 import chalk from "chalk";
 import * as readline from "node:readline";
 import { spawn } from "node:child_process";
-import { ensureCognitoToken, DEFAULT_VAULT_API_URL, } from "../utils/cognito-session.js";
+import { ensureCognitoToken } from "../utils/cognito-session.js";
 import { readCache, writeCache, removeCacheEntry, clearAllCache, } from "../utils/secrets-cache.js";
 import { SECRET_NAME_PATTERN, GROUP_ID_PATTERN } from "./_patterns.js";
+import { vaultApiFetch, getCompanyUid } from "../utils/vault-api.js";
+export { vaultApiFetch, getCompanyUid };
 function shellSingleQuote(value) {
     return "'" + value.replace(/'/g, "'\\''") + "'";
 }
@@ -19,59 +21,6 @@ function buildSecretNamePath(companyUid, name) {
         .join("/");
     return `/secrets/${encodeURIComponent(companyUid)}/name/${encodedName}`;
 }
-export async function vaultApiFetch(opts) {
-    const url = new URL(opts.path, DEFAULT_VAULT_API_URL);
-    if (opts.query) {
-        for (const [k, v] of Object.entries(opts.query)) {
-            url.searchParams.set(k, v);
-        }
-    }
-    return fetch(url.toString(), {
-        method: opts.method ?? "GET",
-        headers: {
-            Authorization: `Bearer ${opts.token}`,
-            "Content-Type": "application/json",
-        },
-        body: opts.body ? JSON.stringify(opts.body) : undefined,
-    });
-}
-async function resolveCompanyUid(token, slug) {
-    const res = await vaultApiFetch({
-        token,
-        path: `/entity/by-slug/company/${encodeURIComponent(slug)}`,
-    });
-    if (!res.ok) {
-        const body = await res.json().catch(() => ({}));
-        throw new Error(`Failed to resolve company slug '${slug}': ${body.error ?? res.statusText}`);
-    }
-    const data = (await res.json());
-    return data.entity.uid;
-}
-async function resolveCompanyFromMemberships(token) {
-    const res = await vaultApiFetch({
-        token,
-        path: "/membership/me",
-    });
-    if (!res.ok) {
-        throw new Error("Failed to fetch memberships — run `hq login` and try again");
-    }
-    const data = (await res.json());
-    const active = data.memberships.filter((m) => m.status === "active");
-    if (active.length === 0) {
-        throw new Error("No active company memberships found. Use --company <slug> to specify.");
-    }
-    if (active.length === 1) {
-        return active[0].companyUid;
-    }
-    const uids = active.map((m) => m.companyUid).join(", ");
-    throw new Error(`Multiple companies found (${uids}). Use --company <slug> to specify which one.`);
-}
-export async function getCompanyUid(token, companySlug) {
-    if (companySlug) {
-        return resolveCompanyUid(token, companySlug);
-    }
-    return resolveCompanyFromMemberships(token);
-}
 function parseDuration(input) {
     const match = input.match(/^(\d+)(m|h|d)$/);
     if (!match)
@@ -756,4 +705,4 @@ export function registerSecretsCommand(program) {
     });
 }
 //# sourceMappingURL=secrets.js.map
-//# debugId=70f0907f-bfcb-5d2e-958a-8813d3bbaf96
+//# debugId=0239c476-98b8-53c0-9458-1c82dc0d26a9

package/dist/index.js

@@ -3,7 +3,7 @@
  * HQ CLI - Module management, package management, and cloud sync for HQ
  */
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="79222b07-0f20-582f-962f-6bc13b8c1c88")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="ad8b9496-9cb2-5e12-ae08-5b29ef77c209")}catch(e){}}();
 import { Command } from "commander";
 import { initSentry, Sentry } from "./sentry.js";
 import { registerAddCommand } from "./commands/add.js";
@@ -23,6 +23,7 @@ import { registerPackageListCommand } from "./commands/pkg-list.js";
 import { registerTeamSyncCommand } from "./commands/team-sync.js";
 import { registerAuthCommands } from "./commands/auth.js";
 import { registerSecretsCommand } from "./commands/secrets.js";
+import { registerRunCommand } from "./commands/run.js";
 import { registerGroupsCommand } from "./commands/groups.js";
 import { registerFilesCommand } from "./commands/files.js";
 initSentry();
@@ -30,7 +31,7 @@ const program = new Command();
 program
     .name("hq")
     .description("HQ management CLI — modules, packages, and cloud sync")
-    .version("5.8.5");
+    .version("5.8.6");
 // Module management subcommand group
 const modulesCmd = program
     .command("modules")
@@ -72,6 +73,8 @@ registerWhoamiCommand(program);
 registerAuthCommands(program);
 // Secrets management (subcommand group — hq secrets set|get|list|delete|exec|generate-link|cache)
 registerSecretsCommand(program);
+// Schema-driven dev runner — hq run [options] -- <cmd>
+registerRunCommand(program);
 // Groups management (subcommand group — hq groups create|delete|add|remove|list|members)
 registerGroupsCommand(program);
 // Files ACL management (subcommand group — hq files share|unshare|acl)
@@ -91,4 +94,4 @@ registerOnboardCommand(program);
     }
 })();
 //# sourceMappingURL=index.js.map
-//# debugId=79222b07-0f20-582f-962f-6bc13b8c1c88
+//# debugId=ad8b9496-9cb2-5e12-ae08-5b29ef77c209

package/dist/run/discover-schemas.d.ts

@@ -0,0 +1,12 @@
+export interface SchemaConflict {
+    paths: [string, string];
+    slugs: [string, string];
+}
+export interface DiscoverSchemasResult {
+    schemaPaths: string[];
+    envLocalPaths: string[];
+    companySlug: string | null;
+    conflict: SchemaConflict | null;
+}
+export declare function discoverSchemas(cwd: string): DiscoverSchemasResult;
+//# sourceMappingURL=discover-schemas.d.ts.map

package/dist/run/discover-schemas.js

@@ -0,0 +1,64 @@
+
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="17c9937b-a219-5b2d-a120-0acbf96f945a")}catch(e){}}();
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+const SLUG_RE = /^# @hqCompany\("([^"]+)"\)/m;
+function parseSlug(filePath) {
+    try {
+        const content = fs.readFileSync(filePath, 'utf8');
+        const m = SLUG_RE.exec(content);
+        return m ? m[1] : null;
+    }
+    catch {
+        return null;
+    }
+}
+export function discoverSchemas(cwd) {
+    const schemaPaths = [];
+    const envLocalPaths = [];
+    let dir = path.resolve(cwd);
+    while (true) {
+        const schemaPath = path.join(dir, '.env.schema');
+        if (fs.existsSync(schemaPath)) {
+            schemaPaths.push(schemaPath);
+            const localPath = path.join(dir, '.env.local');
+            if (fs.existsSync(localPath)) {
+                envLocalPaths.push(localPath);
+            }
+        }
+        const isGitRoot = fs.existsSync(path.join(dir, '.git'));
+        if (isGitRoot)
+            break;
+        const parent = path.dirname(dir);
+        if (parent === dir)
+            break; // filesystem root
+        dir = parent;
+    }
+    // cwd-closest is pushed last during walk-up, so reversing puts it last.
+    // (During walk-up cwd is checked first → pushed first → reversed → ends up last.)
+    schemaPaths.reverse();
+    envLocalPaths.reverse();
+    let companySlug = null;
+    let companySlugPath = null;
+    let conflict = null;
+    for (const schemaPath of schemaPaths) {
+        const slug = parseSlug(schemaPath);
+        if (slug == null)
+            continue;
+        if (companySlug == null) {
+            companySlug = slug;
+            companySlugPath = schemaPath;
+        }
+        else if (companySlug !== slug) {
+            conflict = {
+                paths: [companySlugPath, schemaPath],
+                slugs: [companySlug, slug],
+            };
+            companySlug = null;
+            break;
+        }
+    }
+    return { schemaPaths, envLocalPaths, companySlug, conflict };
+}
+//# sourceMappingURL=discover-schemas.js.map
+//# debugId=17c9937b-a219-5b2d-a120-0acbf96f945a

package/dist/run/hq-plugin.d.ts

@@ -0,0 +1,26 @@
+export interface InstallHqPluginOpts {
+    companyOverride?: string;
+    resolveCompanyUid: (slug: string) => Promise<string>;
+    fetchBatch: (uid: string, names: string[]) => Promise<{
+        secrets: Array<{
+            name: string;
+            value: string;
+        }>;
+        errors: Array<{
+            name: string;
+            code: string;
+            message?: string;
+        }>;
+    }>;
+}
+export interface PluginState {
+    schemaCompanySlug: string | null;
+    uid: string | null;
+    errorsByName: Map<string, {
+        code: string;
+        message?: string;
+    }>;
+}
+export declare function installHqPlugin(graph: any, opts: InstallHqPluginOpts): PluginState;
+export declare function prewarmHqSecrets(graph: any, opts: InstallHqPluginOpts, state: PluginState): Promise<void>;
+//# sourceMappingURL=hq-plugin.d.ts.map