@indigoai-us/hq-cli 5.8.6 → 5.10.0

package/CHANGELOG.md

@@ -0,0 +1,44 @@
+# Changelog
+
+## [5.10.0] — 2026-05-04
+
+### Added
+
+- **`hq cloud demote company <slug>` subcommand** — inverse of
+  `hq cloud provision company`. Converts a cloud-backed company back to local-only
+  after its entity has been soft-tombstoned in hq-console (Settings → Delete company).
+  Removes `companies/<slug>/.hq/config.json`, flips `cloud: true → false` in
+  `companies/<slug>/company.yaml`, and strips `cloud_uid` + `bucket_name` from
+  `companies/manifest.yaml`. Default safety check verifies the cloud entity is
+  `deleted=true`; `--force` skips the check (used by AppBar HQ Sync's Path A after
+  it has already verified). All side-effects atomic + idempotent. Exit codes mirror
+  `cloud provision` (0 ok, 1 vault HTTP, 2 validation).
+
+## [5.9.0] — 2026-05-04
+
+### Added
+
+- **`hq run` command** — schema-driven dev workflow. Place a `.env.schema` file in
+  your repo (annotated with `# @hqCompany("your-slug")` and `VARNAME=hq()` resolvers),
+  then run `hq run -- npm run dev` to inject all declared secrets into the child
+  process's environment without ever printing them to stdout/stderr. Discovers schemas
+  by walking up from cwd to the repo root; merges multiple schemas; respects sibling
+  `.env.local` files for local overrides. Supports `--check` for a dry-run summary,
+  `--company` to override the slug, and `--schema` to pin an explicit schema path.
+
+- **Batch secrets endpoint** — `POST /secrets/{companyUid}/load` on the vault API
+  reduces N parallel single-secret fetches to chunked `ssm:GetParameters` calls
+  (up to 10 names per batch), cutting `hq run` latency for schemas with many vars.
+  Responses include both `secrets` (allowed) and `errors` (denied/not-found) per name.
+  Each revealed secret is audit-logged individually (same trail as `hq secrets get`).
+
+- **`varlock` dependency** (`1.0.0`, exact pin) — used as an internal library to
+  parse `.env.schema` files and drive the resolver graph. The `hq()` resolver is
+  implemented as a varlock plugin registered at runtime; varlock is not exposed as a
+  public API surface.
+
+### Changed
+
+- **Node minimum raised to `>=22.0.0`** — required by `varlock@1.0.0` (ESM-only,
+  `node>=22`). The previous minimum was unset; this makes the requirement explicit
+  in `engines.node`.

package/dist/commands/cloud-demote.d.ts

@@ -0,0 +1,90 @@
+/**
+ * `hq cloud demote company <slug>` — convert a cloud-backed company back to
+ * local-only after hq-pro has soft-tombstoned its entity (Settings → Delete
+ * company in hq-console).
+ *
+ * Inverse of `hq cloud provision company <slug>`. Both commands live here in
+ * hq-cli so the file-touching contract (manifest patch + per-folder config
+ * write + company.yaml mutation) is single-sourced. AppBar HQ Sync's Path A
+ * shells out to this command on the `deleted=true` branch instead of
+ * re-implementing the file mutations in Rust.
+ *
+ * Side-effects (all atomic + idempotent):
+ *   1. Remove `companies/<slug>/.hq/config.json`.
+ *   2. Flip `cloud: true → false` in `companies/<slug>/company.yaml`. Without
+ *      this flip the next `provisionCompany` would re-mint a fresh cloud
+ *      company — exactly what the user just deleted.
+ *   3. Strip `cloud_uid` + `bucket_name` from `companies/manifest.yaml`'s
+ *      `companies.<slug>` entry. The slug entry + other fields stay.
+ *
+ * Safety check (default on): `findCompanyBySlug` MUST return an entity with
+ * `deleted: true`. A live entity, or no entity at all, refuses with code 2.
+ * `--force` skips the network call (AppBar passes it because Path A just
+ * checked).
+ *
+ * Exit codes (mirrors cloud-provision):
+ *   0 — success or idempotent no-op.
+ *   1 — vault HTTP failure during the safety check.
+ *   2 — validation (bad slug, missing dir/manifest, cloud not deleted).
+ */
+import { Command } from "commander";
+import { type VaultClient } from "./cloud-provision.js";
+/** Final stdout JSON shape. AppBar parses this. */
+export interface DemoteResult {
+    ok: boolean;
+    company_slug: string;
+    /** True if `.hq/config.json` was actually deleted (false if absent). */
+    config_removed: boolean;
+    /** True if `company.yaml`'s `cloud` was changed (true→false or absent→false). */
+    yaml_flipped: boolean;
+    /** True if manifest had `cloud_uid` / `bucket_name` to strip. */
+    manifest_stripped: boolean;
+    /**
+     * `true` when the cloud entity verified as `deleted=true`. `null` when
+     * `--force` was used and the verify was skipped. (`false` is unreachable —
+     * a non-deleted entity throws code 2 before reaching the result.)
+     */
+    cloud_was_deleted: boolean | null;
+}
+export interface DemoteCompanyOptions {
+    slug: string;
+    hqRoot: string;
+    vaultApiUrl: string;
+    /** Skip the `findCompanyBySlug` safety check. AppBar uses this. */
+    force?: boolean;
+    /** Injected vault HTTP client (override for tests). */
+    vaultClient?: VaultClient;
+    /** Injected access-token resolver (override for tests). */
+    resolveAccessToken?: () => Promise<string>;
+}
+/**
+ * Flip `cloud: true → false` in `companies/<slug>/company.yaml`. All other
+ * keys + ordering preserved (js-yaml round-trip). Atomic (tmp + rename).
+ *
+ * Returns true if the file was changed, false if no-op (file missing, or
+ * `cloud` was already `false`).
+ *
+ * NOTE: js-yaml doesn't preserve comments, but this matches what
+ * `patchManifest` already does — accepted trade-off.
+ */
+export declare function flipCompanyYamlCloudOff(hqRoot: string, slug: string): boolean;
+/**
+ * Remove `cloud_uid` + `bucket_name` from `companies.<slug>` in
+ * `companies/manifest.yaml`. The slug entry is preserved (other fields like
+ * `name`/`status`/`path` stay). Atomic (tmp + rename).
+ *
+ * Returns true if the file was changed, false if no-op (manifest missing,
+ * slug missing, or both fields already absent).
+ */
+export declare function stripManifestCloudForSlug(hqRoot: string, slug: string): boolean;
+/**
+ * Run the full demote flow. Returns a `DemoteResult` on success; throws
+ * `ProvisionError` (codes 1 or 2) on any failure.
+ */
+export declare function demoteCompany(options: DemoteCompanyOptions): Promise<DemoteResult>;
+/**
+ * Register `demote company <slug>` under the `cloud` command group. Wired in
+ * `src/index.ts` alongside `registerCloudProvisionCommands(cloudCmd)`.
+ */
+export declare function registerCloudDemoteCommands(program: Command): void;
+//# sourceMappingURL=cloud-demote.d.ts.map

package/dist/commands/cloud-demote.js

@@ -0,0 +1,193 @@
+/**
+ * `hq cloud demote company <slug>` — convert a cloud-backed company back to
+ * local-only after hq-pro has soft-tombstoned its entity (Settings → Delete
+ * company in hq-console).
+ *
+ * Inverse of `hq cloud provision company <slug>`. Both commands live here in
+ * hq-cli so the file-touching contract (manifest patch + per-folder config
+ * write + company.yaml mutation) is single-sourced. AppBar HQ Sync's Path A
+ * shells out to this command on the `deleted=true` branch instead of
+ * re-implementing the file mutations in Rust.
+ *
+ * Side-effects (all atomic + idempotent):
+ *   1. Remove `companies/<slug>/.hq/config.json`.
+ *   2. Flip `cloud: true → false` in `companies/<slug>/company.yaml`. Without
+ *      this flip the next `provisionCompany` would re-mint a fresh cloud
+ *      company — exactly what the user just deleted.
+ *   3. Strip `cloud_uid` + `bucket_name` from `companies/manifest.yaml`'s
+ *      `companies.<slug>` entry. The slug entry + other fields stay.
+ *
+ * Safety check (default on): `findCompanyBySlug` MUST return an entity with
+ * `deleted: true`. A live entity, or no entity at all, refuses with code 2.
+ * `--force` skips the network call (AppBar passes it because Path A just
+ * checked).
+ *
+ * Exit codes (mirrors cloud-provision):
+ *   0 — success or idempotent no-op.
+ *   1 — vault HTTP failure during the safety check.
+ *   2 — validation (bad slug, missing dir/manifest, cloud not deleted).
+ */
+
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="6b5cd717-bba0-5dd4-a743-a070e8a62a6b")}catch(e){}}();
+import * as fs from "node:fs";
+import * as path from "node:path";
+import * as yaml from "js-yaml";
+import chalk from "chalk";
+import { ProvisionError, companyConfigPath, companyDirPath, createDefaultVaultClient, manifestPath, validateManifestAndDir, validateSlug, } from "./cloud-provision.js";
+import { DEFAULT_HQ_ROOT, DEFAULT_VAULT_API_URL, ensureCognitoToken, } from "../utils/cognito-session.js";
+// ── Helpers ──────────────────────────────────────────────────────────────────
+/**
+ * Flip `cloud: true → false` in `companies/<slug>/company.yaml`. All other
+ * keys + ordering preserved (js-yaml round-trip). Atomic (tmp + rename).
+ *
+ * Returns true if the file was changed, false if no-op (file missing, or
+ * `cloud` was already `false`).
+ *
+ * NOTE: js-yaml doesn't preserve comments, but this matches what
+ * `patchManifest` already does — accepted trade-off.
+ */
+export function flipCompanyYamlCloudOff(hqRoot, slug) {
+    const yPath = path.join(companyDirPath(hqRoot, slug), "company.yaml");
+    if (!fs.existsSync(yPath))
+        return false;
+    const raw = fs.readFileSync(yPath, "utf-8");
+    const parsed = yaml.load(raw) ?? {};
+    if (parsed.cloud === false)
+        return false;
+    parsed.cloud = false;
+    const dump = yaml.dump(parsed, { lineWidth: -1, noRefs: true });
+    const tmp = `${yPath}.tmp.${process.pid}`;
+    fs.writeFileSync(tmp, dump);
+    fs.renameSync(tmp, yPath);
+    return true;
+}
+/**
+ * Remove `cloud_uid` + `bucket_name` from `companies.<slug>` in
+ * `companies/manifest.yaml`. The slug entry is preserved (other fields like
+ * `name`/`status`/`path` stay). Atomic (tmp + rename).
+ *
+ * Returns true if the file was changed, false if no-op (manifest missing,
+ * slug missing, or both fields already absent).
+ */
+export function stripManifestCloudForSlug(hqRoot, slug) {
+    const mPath = manifestPath(hqRoot);
+    if (!fs.existsSync(mPath))
+        return false;
+    const raw = fs.readFileSync(mPath, "utf-8");
+    const parsed = yaml.load(raw) ?? {};
+    const companies = parsed.companies;
+    if (!companies || !(slug in companies))
+        return false;
+    const entry = companies[slug];
+    if (!entry || typeof entry !== "object")
+        return false;
+    const obj = entry;
+    const hadCloudUid = "cloud_uid" in obj;
+    const hadBucketName = "bucket_name" in obj;
+    if (!hadCloudUid && !hadBucketName)
+        return false;
+    delete obj.cloud_uid;
+    delete obj.bucket_name;
+    const dump = yaml.dump(parsed, { lineWidth: -1, noRefs: true });
+    const tmp = `${mPath}.tmp.${process.pid}`;
+    fs.writeFileSync(tmp, dump);
+    fs.renameSync(tmp, mPath);
+    return true;
+}
+// ── Orchestrator ─────────────────────────────────────────────────────────────
+/**
+ * Run the full demote flow. Returns a `DemoteResult` on success; throws
+ * `ProvisionError` (codes 1 or 2) on any failure.
+ */
+export async function demoteCompany(options) {
+    validateSlug(options.slug);
+    // Fails with code 2 if the manifest is missing/malformed, the slug is not
+    // present under `.companies`, or `companies/<slug>/` doesn't exist on disk.
+    // Without this, a `--force` demote against a missing or renamed slug would
+    // be a silent no-op (all helpers return false but we'd still report ok=true).
+    validateManifestAndDir(options.hqRoot, options.slug);
+    let cloudWasDeleted = null;
+    if (!options.force) {
+        const accessToken = options.resolveAccessToken
+            ? await options.resolveAccessToken()
+            : await ensureCognitoToken();
+        const client = options.vaultClient ??
+            createDefaultVaultClient(options.vaultApiUrl, accessToken);
+        let entity;
+        try {
+            entity = await client.findCompanyBySlug(options.slug);
+        }
+        catch (err) {
+            if (err instanceof ProvisionError)
+                throw err;
+            throw new ProvisionError(1, `Vault GET by-slug failed: ${err instanceof Error ? err.message : String(err)}`);
+        }
+        if (!entity) {
+            throw new ProvisionError(2, `Refusing to demote '${options.slug}': no cloud entity found. Pass --force to demote anyway.`);
+        }
+        // `deleted` is added by hq-pro and isn't in the static VaultEntity type.
+        const deleted = entity.deleted === true;
+        if (!deleted) {
+            throw new ProvisionError(2, `Refusing to demote '${options.slug}': cloud entity is not deleted (uid=${entity.uid}). Pass --force to demote anyway.`);
+        }
+        cloudWasDeleted = true;
+    }
+    const cPath = companyConfigPath(options.hqRoot, options.slug);
+    let configRemoved = false;
+    if (fs.existsSync(cPath)) {
+        fs.rmSync(cPath);
+        configRemoved = true;
+    }
+    const yamlFlipped = flipCompanyYamlCloudOff(options.hqRoot, options.slug);
+    const manifestStripped = stripManifestCloudForSlug(options.hqRoot, options.slug);
+    return {
+        ok: true,
+        company_slug: options.slug,
+        config_removed: configRemoved,
+        yaml_flipped: yamlFlipped,
+        manifest_stripped: manifestStripped,
+        cloud_was_deleted: cloudWasDeleted,
+    };
+}
+// ── Commander wiring ─────────────────────────────────────────────────────────
+/**
+ * Register `demote company <slug>` under the `cloud` command group. Wired in
+ * `src/index.ts` alongside `registerCloudProvisionCommands(cloudCmd)`.
+ */
+export function registerCloudDemoteCommands(program) {
+    const demoteCmd = program
+        .command("demote")
+        .description("Demote a cloud-backed entity back to local-only");
+    demoteCmd
+        .command("company")
+        .description("Demote a cloud-backed company to local-only after the cloud entity " +
+        "has been soft-tombstoned in hq-console. Removes .hq/config.json, " +
+        "flips company.yaml `cloud: false`, and strips the manifest cloud refs.")
+        .argument("<slug>", "Company slug")
+        .option("--hq-root <path>", `Local HQ tree root (default: ${DEFAULT_HQ_ROOT})`, DEFAULT_HQ_ROOT)
+        .option("--vault-api-url <url>", `Vault API URL (default: ${DEFAULT_VAULT_API_URL})`, DEFAULT_VAULT_API_URL)
+        .option("--force", "Skip the safety check that the cloud entity is actually deleted=true. " +
+        "AppBar HQ Sync passes this because its Path A just verified.")
+        .action(async (slug, options) => {
+        try {
+            const result = await demoteCompany({
+                slug,
+                hqRoot: options.hqRoot,
+                vaultApiUrl: options.vaultApiUrl,
+                force: options.force,
+            });
+            process.stdout.write(JSON.stringify(result) + "\n");
+            process.exit(0);
+        }
+        catch (err) {
+            if (err instanceof ProvisionError) {
+                process.stderr.write(chalk.red(`[hq cloud demote] ${err.message}\n`));
+                process.exit(err.code);
+            }
+            process.stderr.write(chalk.red(`[hq cloud demote] Unexpected error: ${err instanceof Error ? err.message : String(err)}\n`));
+            process.exit(1);
+        }
+    });
+}
+//# sourceMappingURL=cloud-demote.js.map
+//# debugId=6b5cd717-bba0-5dd4-a743-a070e8a62a6b

package/dist/commands/run.d.ts

@@ -0,0 +1,3 @@
+import { Command } from 'commander';
+export declare function registerRunCommand(program: Command): void;
+//# sourceMappingURL=run.d.ts.map

package/dist/commands/run.js

@@ -0,0 +1,119 @@
+
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="a1b39bbf-1f26-59e7-af70-6ecf01f2ce7e")}catch(e){}}();
+import { spawn } from 'node:child_process';
+import * as path from 'node:path';
+import * as fs from 'node:fs';
+import { internal } from 'varlock';
+import { ensureCognitoToken } from '../utils/cognito-session.js';
+import { vaultApiFetch, getCompanyUid } from '../utils/vault-api.js';
+import { discoverSchemas } from '../run/discover-schemas.js';
+import { installHqPlugin, prewarmHqSecrets } from '../run/hq-plugin.js';
+export function registerRunCommand(program) {
+    program
+        .command('run')
+        .description('Load secrets from .env.schema and run a command with them injected')
+        .option('--company <slug>', 'Company slug (overrides @hqCompany in schema)')
+        .option('--schema <path>', 'Explicit schema path (skips walk-up discovery)')
+        .option('--check', 'Resolve schema and validate vars without executing the command')
+        .allowUnknownOption(true)
+        .action(async (opts) => {
+        try {
+            const dashIndex = process.argv.indexOf('--');
+            const childArgs = dashIndex !== -1 ? process.argv.slice(dashIndex + 1) : [];
+            if (!opts.check && childArgs.length === 0) {
+                throw new Error('no command specified. Usage: hq run [options] -- <command> [args...]');
+            }
+            let schemaPaths;
+            let envLocalPaths;
+            let schemaCompanySlug;
+            if (opts.schema) {
+                const schemaAbs = path.resolve(opts.schema);
+                schemaPaths = [schemaAbs];
+                const localPath = path.join(path.dirname(schemaAbs), '.env.local');
+                envLocalPaths = fs.existsSync(localPath) ? [localPath] : [];
+                const content = fs.readFileSync(schemaAbs, 'utf8');
+                const m = /^# @hqCompany\("([^"]+)"\)/m.exec(content);
+                schemaCompanySlug = m ? m[1] : null;
+            }
+            else {
+                const discovered = discoverSchemas(process.cwd());
+                if (discovered.conflict) {
+                    throw new Error(`conflicting @hqCompany slugs: "${discovered.conflict.slugs[0]}" in ${discovered.conflict.paths[0]} vs "${discovered.conflict.slugs[1]}" in ${discovered.conflict.paths[1]}. Use --company <slug> to override.`);
+                }
+                if (discovered.schemaPaths.length === 0) {
+                    throw new Error('no .env.schema found. Create one or use --schema <path>.');
+                }
+                schemaPaths = discovered.schemaPaths;
+                envLocalPaths = discovered.envLocalPaths;
+                schemaCompanySlug = discovered.companySlug;
+            }
+            const slug = opts.company ?? schemaCompanySlug;
+            if (!slug) {
+                throw new Error('company slug not set. Add # @hqCompany("slug") to your .env.schema or pass --company <slug>.');
+            }
+            const token = await ensureCognitoToken();
+            const uid = await getCompanyUid(token, slug);
+            const fetchBatch = async (companyUid, names) => {
+                const res = await vaultApiFetch({
+                    token,
+                    path: `/secrets/${encodeURIComponent(companyUid)}/load`,
+                    method: 'POST',
+                    body: { names },
+                });
+                if (!res.ok) {
+                    const body = await res.json().catch(() => ({}));
+                    throw new Error(`Failed to batch-load secrets: ${body.error ?? res.statusText}`);
+                }
+                return res.json();
+            };
+            const pluginOpts = {
+                companyOverride: opts.company,
+                resolveCompanyUid: async () => uid,
+                fetchBatch,
+            };
+            // LAST entry = highest precedence; .env.local files trail .env.schema files so any .env.local beats any schema regardless of depth.
+            const paths = [...schemaPaths, ...envLocalPaths];
+            let state;
+            const graph = await internal.loadEnvGraph({
+                entryFilePaths: paths,
+                afterInit: async (g) => { state = installHqPlugin(g, pluginOpts); },
+            });
+            await prewarmHqSecrets(graph, pluginOpts, state);
+            await graph.resolveEnvValues();
+            const schemaErrors = Object.entries(graph.configSchema)
+                .filter(([, item]) => item.errors?.length > 0);
+            if (schemaErrors.length > 0) {
+                const msgs = schemaErrors.flatMap(([k, item]) => item.errors.map((e) => `  ${k}: ${e.message ?? String(e)}`));
+                process.stderr.write(`Error: failed to resolve env vars:\n${msgs.join('\n')}\n`);
+                process.exit(1);
+            }
+            const resolvedEnv = graph.getResolvedEnvObject();
+            const varCount = Object.keys(resolvedEnv).length;
+            process.stderr.write(`Loaded ${varCount} env vars from .env.schema (company: ${slug})\n`);
+            if (opts.check) {
+                process.exit(0);
+            }
+            const [childCmd, ...restArgs] = childArgs;
+            const child = spawn(childCmd, restArgs, {
+                stdio: 'inherit',
+                env: { ...process.env, ...resolvedEnv },
+            });
+            child.on('error', (err) => {
+                process.stderr.write(`Error: failed to start command '${childCmd}': ${err.message}\n`);
+                process.exit(1);
+            });
+            child.on('close', (code, signal) => {
+                if (signal) {
+                    process.kill(process.pid, signal);
+                }
+                process.exit(code ?? 1);
+            });
+        }
+        catch (err) {
+            process.stderr.write(`Error: ${err instanceof Error ? err.message : String(err)}\n`);
+            process.exit(1);
+        }
+    });
+}
+//# sourceMappingURL=run.js.map
+//# debugId=a1b39bbf-1f26-59e7-af70-6ecf01f2ce7e

package/dist/commands/secrets.d.ts

@@ -1,12 +1,6 @@
 import { Command } from "commander";
-export interface VaultApiOptions {
-    token: string;
-    path: string;
-    method?: string;
-    body?: Record<string, unknown>;
-    query?: Record<string, string>;
-}
-export declare function vaultApiFetch(opts: VaultApiOptions): Promise<Response>;
-export declare function getCompanyUid(token: string, companySlug: string | undefined): Promise<string>;
+import { vaultApiFetch, getCompanyUid } from "../utils/vault-api.js";
+export type { VaultApiOptions } from "../utils/vault-api.js";
+export { vaultApiFetch, getCompanyUid };
 export declare function registerSecretsCommand(program: Command): void;
 //# sourceMappingURL=secrets.d.ts.map

package/dist/commands/secrets.js

@@ -1,11 +1,13 @@
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="70f0907f-bfcb-5d2e-958a-8813d3bbaf96")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="0239c476-98b8-53c0-9458-1c82dc0d26a9")}catch(e){}}();
 import chalk from "chalk";
 import * as readline from "node:readline";
 import { spawn } from "node:child_process";
-import { ensureCognitoToken, DEFAULT_VAULT_API_URL, } from "../utils/cognito-session.js";
+import { ensureCognitoToken } from "../utils/cognito-session.js";
 import { readCache, writeCache, removeCacheEntry, clearAllCache, } from "../utils/secrets-cache.js";
 import { SECRET_NAME_PATTERN, GROUP_ID_PATTERN } from "./_patterns.js";
+import { vaultApiFetch, getCompanyUid } from "../utils/vault-api.js";
+export { vaultApiFetch, getCompanyUid };
 function shellSingleQuote(value) {
     return "'" + value.replace(/'/g, "'\\''") + "'";
 }
@@ -19,59 +21,6 @@ function buildSecretNamePath(companyUid, name) {
         .join("/");
     return `/secrets/${encodeURIComponent(companyUid)}/name/${encodedName}`;
 }
-export async function vaultApiFetch(opts) {
-    const url = new URL(opts.path, DEFAULT_VAULT_API_URL);
-    if (opts.query) {
-        for (const [k, v] of Object.entries(opts.query)) {
-            url.searchParams.set(k, v);
-        }
-    }
-    return fetch(url.toString(), {
-        method: opts.method ?? "GET",
-        headers: {
-            Authorization: `Bearer ${opts.token}`,
-            "Content-Type": "application/json",
-        },
-        body: opts.body ? JSON.stringify(opts.body) : undefined,
-    });
-}
-async function resolveCompanyUid(token, slug) {
-    const res = await vaultApiFetch({
-        token,
-        path: `/entity/by-slug/company/${encodeURIComponent(slug)}`,
-    });
-    if (!res.ok) {
-        const body = await res.json().catch(() => ({}));
-        throw new Error(`Failed to resolve company slug '${slug}': ${body.error ?? res.statusText}`);
-    }
-    const data = (await res.json());
-    return data.entity.uid;
-}
-async function resolveCompanyFromMemberships(token) {
-    const res = await vaultApiFetch({
-        token,
-        path: "/membership/me",
-    });
-    if (!res.ok) {
-        throw new Error("Failed to fetch memberships — run `hq login` and try again");
-    }
-    const data = (await res.json());
-    const active = data.memberships.filter((m) => m.status === "active");
-    if (active.length === 0) {
-        throw new Error("No active company memberships found. Use --company <slug> to specify.");
-    }
-    if (active.length === 1) {
-        return active[0].companyUid;
-    }
-    const uids = active.map((m) => m.companyUid).join(", ");
-    throw new Error(`Multiple companies found (${uids}). Use --company <slug> to specify which one.`);
-}
-export async function getCompanyUid(token, companySlug) {
-    if (companySlug) {
-        return resolveCompanyUid(token, companySlug);
-    }
-    return resolveCompanyFromMemberships(token);
-}
 function parseDuration(input) {
     const match = input.match(/^(\d+)(m|h|d)$/);
     if (!match)
@@ -756,4 +705,4 @@ export function registerSecretsCommand(program) {
     });
 }
 //# sourceMappingURL=secrets.js.map
-//# debugId=70f0907f-bfcb-5d2e-958a-8813d3bbaf96
+//# debugId=0239c476-98b8-53c0-9458-1c82dc0d26a9

package/dist/index.js

@@ -3,7 +3,7 @@
  * HQ CLI - Module management, package management, and cloud sync for HQ
  */
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="79222b07-0f20-582f-962f-6bc13b8c1c88")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="ebc3116c-f836-550a-b5bb-4a74bce24abc")}catch(e){}}();
 import { Command } from "commander";
 import { initSentry, Sentry } from "./sentry.js";
 import { registerAddCommand } from "./commands/add.js";
@@ -12,6 +12,7 @@ import { registerListCommand } from "./commands/list.js";
 import { registerUpdateCommand } from "./commands/update.js";
 import { registerCloudCommands } from "./commands/cloud.js";
 import { registerCloudProvisionCommands } from "./commands/cloud-provision.js";
+import { registerCloudDemoteCommands } from "./commands/cloud-demote.js";
 import { registerLoginCommand } from "./commands/login.js";
 import { registerLogoutCommand } from "./commands/logout.js";
 import { registerWhoamiCommand } from "./commands/whoami.js";
@@ -23,6 +24,7 @@ import { registerPackageListCommand } from "./commands/pkg-list.js";
 import { registerTeamSyncCommand } from "./commands/team-sync.js";
 import { registerAuthCommands } from "./commands/auth.js";
 import { registerSecretsCommand } from "./commands/secrets.js";
+import { registerRunCommand } from "./commands/run.js";
 import { registerGroupsCommand } from "./commands/groups.js";
 import { registerFilesCommand } from "./commands/files.js";
 initSentry();
@@ -63,6 +65,7 @@ const cloudCmd = program
     .command("cloud")
     .description("Cloud commands — provision entities and manage cloud-backed companies");
 registerCloudProvisionCommands(cloudCmd);
+registerCloudDemoteCommands(cloudCmd);
 // Team commands (top-level)
 registerTeamSyncCommand(program);
 // Auth commands (top-level — Cognito OAuth)
@@ -72,6 +75,8 @@ registerWhoamiCommand(program);
 registerAuthCommands(program);
 // Secrets management (subcommand group — hq secrets set|get|list|delete|exec|generate-link|cache)
 registerSecretsCommand(program);
+// Schema-driven dev runner — hq run [options] -- <cmd>
+registerRunCommand(program);
 // Groups management (subcommand group — hq groups create|delete|add|remove|list|members)
 registerGroupsCommand(program);
 // Files ACL management (subcommand group — hq files share|unshare|acl)
@@ -91,4 +96,4 @@ registerOnboardCommand(program);
     }
 })();
 //# sourceMappingURL=index.js.map
-//# debugId=79222b07-0f20-582f-962f-6bc13b8c1c88
+//# debugId=ebc3116c-f836-550a-b5bb-4a74bce24abc

package/dist/run/discover-schemas.d.ts

@@ -0,0 +1,12 @@
+export interface SchemaConflict {
+    paths: [string, string];
+    slugs: [string, string];
+}
+export interface DiscoverSchemasResult {
+    schemaPaths: string[];
+    envLocalPaths: string[];
+    companySlug: string | null;
+    conflict: SchemaConflict | null;
+}
+export declare function discoverSchemas(cwd: string): DiscoverSchemasResult;
+//# sourceMappingURL=discover-schemas.d.ts.map