@indigoai-us/hq-cli 5.8.6 → 5.10.0

package/dist/run/discover-schemas.js

@@ -0,0 +1,64 @@
+
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="17c9937b-a219-5b2d-a120-0acbf96f945a")}catch(e){}}();
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+const SLUG_RE = /^# @hqCompany\("([^"]+)"\)/m;
+function parseSlug(filePath) {
+    try {
+        const content = fs.readFileSync(filePath, 'utf8');
+        const m = SLUG_RE.exec(content);
+        return m ? m[1] : null;
+    }
+    catch {
+        return null;
+    }
+}
+export function discoverSchemas(cwd) {
+    const schemaPaths = [];
+    const envLocalPaths = [];
+    let dir = path.resolve(cwd);
+    while (true) {
+        const schemaPath = path.join(dir, '.env.schema');
+        if (fs.existsSync(schemaPath)) {
+            schemaPaths.push(schemaPath);
+            const localPath = path.join(dir, '.env.local');
+            if (fs.existsSync(localPath)) {
+                envLocalPaths.push(localPath);
+            }
+        }
+        const isGitRoot = fs.existsSync(path.join(dir, '.git'));
+        if (isGitRoot)
+            break;
+        const parent = path.dirname(dir);
+        if (parent === dir)
+            break; // filesystem root
+        dir = parent;
+    }
+    // cwd-closest is pushed last during walk-up, so reversing puts it last.
+    // (During walk-up cwd is checked first → pushed first → reversed → ends up last.)
+    schemaPaths.reverse();
+    envLocalPaths.reverse();
+    let companySlug = null;
+    let companySlugPath = null;
+    let conflict = null;
+    for (const schemaPath of schemaPaths) {
+        const slug = parseSlug(schemaPath);
+        if (slug == null)
+            continue;
+        if (companySlug == null) {
+            companySlug = slug;
+            companySlugPath = schemaPath;
+        }
+        else if (companySlug !== slug) {
+            conflict = {
+                paths: [companySlugPath, schemaPath],
+                slugs: [companySlug, slug],
+            };
+            companySlug = null;
+            break;
+        }
+    }
+    return { schemaPaths, envLocalPaths, companySlug, conflict };
+}
+//# sourceMappingURL=discover-schemas.js.map
+//# debugId=17c9937b-a219-5b2d-a120-0acbf96f945a

package/dist/run/hq-plugin.d.ts

@@ -0,0 +1,26 @@
+export interface InstallHqPluginOpts {
+    companyOverride?: string;
+    resolveCompanyUid: (slug: string) => Promise<string>;
+    fetchBatch: (uid: string, names: string[]) => Promise<{
+        secrets: Array<{
+            name: string;
+            value: string;
+        }>;
+        errors: Array<{
+            name: string;
+            code: string;
+            message?: string;
+        }>;
+    }>;
+}
+export interface PluginState {
+    schemaCompanySlug: string | null;
+    uid: string | null;
+    errorsByName: Map<string, {
+        code: string;
+        message?: string;
+    }>;
+}
+export declare function installHqPlugin(graph: any, opts: InstallHqPluginOpts): PluginState;
+export declare function prewarmHqSecrets(graph: any, opts: InstallHqPluginOpts, state: PluginState): Promise<void>;
+//# sourceMappingURL=hq-plugin.d.ts.map

package/dist/run/hq-plugin.js

@@ -0,0 +1,144 @@
+
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="01fee323-1f63-5411-bfc9-ff49e241f712")}catch(e){}}();
+import { ResolutionError } from 'varlock/plugin-lib';
+import { readCache, writeCache } from '../utils/secrets-cache.js';
+export function installHqPlugin(graph /* EnvGraph */, opts) {
+    const pluginState = {
+        schemaCompanySlug: null,
+        uid: null,
+        errorsByName: new Map(),
+    };
+    // varlock@1.0.0's plugin-lib.js omits the Resolver export (d.ts/JS mismatch);
+    // extract it at runtime from any already-registered built-in resolver's prototype.
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    let RuntimeResolver;
+    try {
+        const fns = graph.registeredResolverFunctions;
+        const first = Object.values(fns)[0];
+        if (first == null)
+            throw new Error('registeredResolverFunctions is empty');
+        const proto = Object.getPrototypeOf(first);
+        if (proto == null || typeof proto.prototype?.process !== 'function') {
+            throw new Error('prototype has no process method');
+        }
+        RuntimeResolver = proto;
+    }
+    catch (e) {
+        throw new Error('varlock Resolver base class extraction failed — the varlock@1.0.0 d.ts/JS mismatch ' +
+            'may have been resolved; switch to `import { Resolver } from "varlock/plugin-lib"`. ' +
+            `Underlying: ${e instanceof Error ? e.message : String(e)}`);
+    }
+    // HqResolver is declared INSIDE installHqPlugin so its static def.resolve
+    // closes over `pluginState`. Module-scope declaration is forbidden — resolve()
+    // would hit `ReferenceError: pluginState is not defined`.
+    class HqResolver extends RuntimeResolver {
+        static def = {
+            name: 'hq',
+            impliesSensitive: true,
+            argsSchema: { type: 'array', arrayMaxLength: 1 },
+            resolve: async function () {
+                // Cache-only read. `pluginState` is captured by this inner-class closure;
+                // `prewarmHqSecrets(graph, opts, state)` populates `state.uid` and
+                // `state.errorsByName` before `graph.resolveEnvValues()` calls us.
+                const explicit = this.arrArgs?.[0]?.staticValue;
+                const secretName = (typeof explicit === 'string' && explicit) ? explicit : this._ownerKey;
+                if (!secretName) {
+                    throw new ResolutionError('hq() resolver could not determine secret name (missing owner key)');
+                }
+                const err = pluginState.errorsByName.get(secretName);
+                if (err) {
+                    if (err.code === 'forbidden') {
+                        throw new ResolutionError(`No read permission for secret "${secretName}" — ask an admin to share it via \`hq secrets share ${secretName} --with <you> --permission read\``);
+                    }
+                    if (err.code === 'not_found') {
+                        throw new ResolutionError(`Secret "${secretName}" does not exist in company`);
+                    }
+                    throw new ResolutionError(`Failed to load secret "${secretName}": ${err.message ?? err.code}`);
+                }
+                // Sentinel-check style throughout: `readCache` returns `string | null`
+                // (verified at `hq/packages/hq-cli/src/utils/secrets-cache.ts:45`); `pluginState.uid`
+                // is `string | null` per `PluginState`. Use `== null` (covers null AND undefined defensively)
+                // for both — do not mix in truthy checks like `if (!x)`, which would silently swallow a
+                // legitimate empty-string value if the contract ever loosened.
+                if (pluginState.uid == null) {
+                    throw new ResolutionError('Internal error: prewarmHqSecrets was not called before resolveEnvValues');
+                }
+                const cached = readCache(pluginState.uid, secretName); // string | null
+                if (cached == null) {
+                    throw new ResolutionError(`Internal error: pre-warm did not populate cache for "${secretName}"`);
+                }
+                return cached;
+            },
+        };
+        // Captured during process(parent); used by resolve() to fall back to the var key.
+        _ownerKey;
+        process(parent) {
+            super.process(parent);
+            if (parent != null && typeof parent.key === 'string') {
+                this._ownerKey = parent.key;
+            }
+        }
+    }
+    // varlock@1.0.0's env-spec parser rejects dots in decorator names ([a-zA-Z0-9_] only),
+    // so `@hq.company` is not valid syntax. We register as `@hqCompany` (camelCase) instead.
+    // Schema files must use `# @hqCompany("slug")` followed by a blank line so the parser
+    // treats it as a file-level root decorator rather than an item decorator for the next var.
+    graph.registerRootDecorator({
+        name: 'hqCompany',
+        isFunction: true,
+        process: (decoratorValue) => {
+            const slug = decoratorValue.arrArgs?.[0]?.staticValue;
+            return typeof slug === 'string' ? slug : null;
+        },
+        execute: (slug) => {
+            if (slug)
+                pluginState.schemaCompanySlug = slug;
+        },
+    });
+    graph.registerResolver(HqResolver);
+    // Returned so `prewarmHqSecrets(graph, opts, state)` can read schemaCompanySlug
+    // and write `uid` + `errorsByName`. The state is held by the closure; the returned handle
+    // is purely for the prewarm helper.
+    return pluginState;
+}
+export async function prewarmHqSecrets(graph /* EnvGraph */, opts, state) {
+    const queue = [];
+    for (const [key, item] of Object.entries(graph.configSchema)) {
+        const resolver = item.valueResolver;
+        if (resolver?.def?.name === 'hq') {
+            const explicit = resolver.arrArgs?.[0]?.staticValue;
+            const secretName = (typeof explicit === 'string' && explicit) ? explicit : key;
+            queue.push({ key, secretName });
+        }
+    }
+    if (queue.length === 0) {
+        return;
+    }
+    let slug;
+    if (state.schemaCompanySlug) {
+        slug = state.schemaCompanySlug;
+    }
+    else if (opts.companyOverride) {
+        slug = opts.companyOverride;
+    }
+    else {
+        throw new Error('@hqCompany("...") not declared and --company not passed');
+    }
+    const uid = await opts.resolveCompanyUid(slug);
+    const uniqueNames = [...new Set(queue.map((q) => q.secretName))];
+    if (uniqueNames.length > 100) {
+        throw new Error(`hq run supports at most 100 hq() resolvers per schema; got ${uniqueNames.length}`);
+    }
+    const result = await opts.fetchBatch(uid, uniqueNames);
+    for (const s of result.secrets) {
+        writeCache(uid, s.name, s.value);
+    }
+    const errorsByName = new Map();
+    for (const e of result.errors) {
+        errorsByName.set(e.name, { code: e.code, message: e.message });
+    }
+    state.errorsByName = errorsByName;
+    state.uid = uid;
+}
+//# sourceMappingURL=hq-plugin.js.map
+//# debugId=01fee323-1f63-5411-bfc9-ff49e241f712

package/dist/utils/vault-api.d.ts

@@ -0,0 +1,10 @@
+export interface VaultApiOptions {
+    token: string;
+    path: string;
+    method?: string;
+    body?: Record<string, unknown>;
+    query?: Record<string, string>;
+}
+export declare function vaultApiFetch(opts: VaultApiOptions): Promise<Response>;
+export declare function getCompanyUid(token: string, companySlug: string | undefined): Promise<string>;
+//# sourceMappingURL=vault-api.d.ts.map

package/dist/utils/vault-api.js

@@ -0,0 +1,58 @@
+
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="4e482805-d129-5563-a77b-97b80410154b")}catch(e){}}();
+import { DEFAULT_VAULT_API_URL } from './cognito-session.js';
+export async function vaultApiFetch(opts) {
+    const url = new URL(opts.path, DEFAULT_VAULT_API_URL);
+    if (opts.query) {
+        for (const [k, v] of Object.entries(opts.query)) {
+            url.searchParams.set(k, v);
+        }
+    }
+    return fetch(url.toString(), {
+        method: opts.method ?? 'GET',
+        headers: {
+            Authorization: `Bearer ${opts.token}`,
+            'Content-Type': 'application/json',
+        },
+        body: opts.body ? JSON.stringify(opts.body) : undefined,
+    });
+}
+async function resolveCompanyUid(token, slug) {
+    const res = await vaultApiFetch({
+        token,
+        path: `/entity/by-slug/company/${encodeURIComponent(slug)}`,
+    });
+    if (!res.ok) {
+        const body = await res.json().catch(() => ({}));
+        throw new Error(`Failed to resolve company slug '${slug}': ${body.error ?? res.statusText}`);
+    }
+    const data = (await res.json());
+    return data.entity.uid;
+}
+async function resolveCompanyFromMemberships(token) {
+    const res = await vaultApiFetch({
+        token,
+        path: '/membership/me',
+    });
+    if (!res.ok) {
+        throw new Error("Failed to fetch memberships — run `hq login` and try again");
+    }
+    const data = (await res.json());
+    const active = data.memberships.filter((m) => m.status === 'active');
+    if (active.length === 0) {
+        throw new Error('No active company memberships found. Use --company <slug> to specify.');
+    }
+    if (active.length === 1) {
+        return active[0].companyUid;
+    }
+    const uids = active.map((m) => m.companyUid).join(', ');
+    throw new Error(`Multiple companies found (${uids}). Use --company <slug> to specify which one.`);
+}
+export async function getCompanyUid(token, companySlug) {
+    if (companySlug) {
+        return resolveCompanyUid(token, companySlug);
+    }
+    return resolveCompanyFromMemberships(token);
+}
+//# sourceMappingURL=vault-api.js.map
+//# debugId=4e482805-d129-5563-a77b-97b80410154b

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.8.6",
+  "version": "5.10.0",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {
@@ -21,7 +21,8 @@
     "commander": "^12.1.0",
     "js-yaml": "^4.1.0",
     "simple-git": "^3.27.0",
-    "semver": "^7.6.3"
+    "semver": "^7.6.3",
+    "varlock": "1.0.0"
   },
   "devDependencies": {
     "@types/js-yaml": "^4.0.9",
@@ -42,5 +43,8 @@
     "cloud"
   ],
   "license": "MIT",
-  "type": "module"
+  "type": "module",
+  "engines": {
+    "node": ">=22.0.0"
+  }
 }