@indigoai-us/hq-cli 5.8.6 → 5.9.0

package/CHANGELOG.md

@@ -0,0 +1,30 @@
+# Changelog
+
+## [5.9.0] — 2026-05-04
+
+### Added
+
+- **`hq run` command** — schema-driven dev workflow. Place a `.env.schema` file in
+  your repo (annotated with `# @hqCompany("your-slug")` and `VARNAME=hq()` resolvers),
+  then run `hq run -- npm run dev` to inject all declared secrets into the child
+  process's environment without ever printing them to stdout/stderr. Discovers schemas
+  by walking up from cwd to the repo root; merges multiple schemas; respects sibling
+  `.env.local` files for local overrides. Supports `--check` for a dry-run summary,
+  `--company` to override the slug, and `--schema` to pin an explicit schema path.
+
+- **Batch secrets endpoint** — `POST /secrets/{companyUid}/load` on the vault API
+  reduces N parallel single-secret fetches to chunked `ssm:GetParameters` calls
+  (up to 10 names per batch), cutting `hq run` latency for schemas with many vars.
+  Responses include both `secrets` (allowed) and `errors` (denied/not-found) per name.
+  Each revealed secret is audit-logged individually (same trail as `hq secrets get`).
+
+- **`varlock` dependency** (`1.0.0`, exact pin) — used as an internal library to
+  parse `.env.schema` files and drive the resolver graph. The `hq()` resolver is
+  implemented as a varlock plugin registered at runtime; varlock is not exposed as a
+  public API surface.
+
+### Changed
+
+- **Node minimum raised to `>=22.0.0`** — required by `varlock@1.0.0` (ESM-only,
+  `node>=22`). The previous minimum was unset; this makes the requirement explicit
+  in `engines.node`.

package/dist/commands/run.d.ts

@@ -0,0 +1,3 @@
+import { Command } from 'commander';
+export declare function registerRunCommand(program: Command): void;
+//# sourceMappingURL=run.d.ts.map

package/dist/commands/run.js

@@ -0,0 +1,119 @@
+
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="a1b39bbf-1f26-59e7-af70-6ecf01f2ce7e")}catch(e){}}();
+import { spawn } from 'node:child_process';
+import * as path from 'node:path';
+import * as fs from 'node:fs';
+import { internal } from 'varlock';
+import { ensureCognitoToken } from '../utils/cognito-session.js';
+import { vaultApiFetch, getCompanyUid } from '../utils/vault-api.js';
+import { discoverSchemas } from '../run/discover-schemas.js';
+import { installHqPlugin, prewarmHqSecrets } from '../run/hq-plugin.js';
+export function registerRunCommand(program) {
+    program
+        .command('run')
+        .description('Load secrets from .env.schema and run a command with them injected')
+        .option('--company <slug>', 'Company slug (overrides @hqCompany in schema)')
+        .option('--schema <path>', 'Explicit schema path (skips walk-up discovery)')
+        .option('--check', 'Resolve schema and validate vars without executing the command')
+        .allowUnknownOption(true)
+        .action(async (opts) => {
+        try {
+            const dashIndex = process.argv.indexOf('--');
+            const childArgs = dashIndex !== -1 ? process.argv.slice(dashIndex + 1) : [];
+            if (!opts.check && childArgs.length === 0) {
+                throw new Error('no command specified. Usage: hq run [options] -- <command> [args...]');
+            }
+            let schemaPaths;
+            let envLocalPaths;
+            let schemaCompanySlug;
+            if (opts.schema) {
+                const schemaAbs = path.resolve(opts.schema);
+                schemaPaths = [schemaAbs];
+                const localPath = path.join(path.dirname(schemaAbs), '.env.local');
+                envLocalPaths = fs.existsSync(localPath) ? [localPath] : [];
+                const content = fs.readFileSync(schemaAbs, 'utf8');
+                const m = /^# @hqCompany\("([^"]+)"\)/m.exec(content);
+                schemaCompanySlug = m ? m[1] : null;
+            }
+            else {
+                const discovered = discoverSchemas(process.cwd());
+                if (discovered.conflict) {
+                    throw new Error(`conflicting @hqCompany slugs: "${discovered.conflict.slugs[0]}" in ${discovered.conflict.paths[0]} vs "${discovered.conflict.slugs[1]}" in ${discovered.conflict.paths[1]}. Use --company <slug> to override.`);
+                }
+                if (discovered.schemaPaths.length === 0) {
+                    throw new Error('no .env.schema found. Create one or use --schema <path>.');
+                }
+                schemaPaths = discovered.schemaPaths;
+                envLocalPaths = discovered.envLocalPaths;
+                schemaCompanySlug = discovered.companySlug;
+            }
+            const slug = opts.company ?? schemaCompanySlug;
+            if (!slug) {
+                throw new Error('company slug not set. Add # @hqCompany("slug") to your .env.schema or pass --company <slug>.');
+            }
+            const token = await ensureCognitoToken();
+            const uid = await getCompanyUid(token, slug);
+            const fetchBatch = async (companyUid, names) => {
+                const res = await vaultApiFetch({
+                    token,
+                    path: `/secrets/${encodeURIComponent(companyUid)}/load`,
+                    method: 'POST',
+                    body: { names },
+                });
+                if (!res.ok) {
+                    const body = await res.json().catch(() => ({}));
+                    throw new Error(`Failed to batch-load secrets: ${body.error ?? res.statusText}`);
+                }
+                return res.json();
+            };
+            const pluginOpts = {
+                companyOverride: opts.company,
+                resolveCompanyUid: async () => uid,
+                fetchBatch,
+            };
+            // LAST entry = highest precedence; .env.local files trail .env.schema files so any .env.local beats any schema regardless of depth.
+            const paths = [...schemaPaths, ...envLocalPaths];
+            let state;
+            const graph = await internal.loadEnvGraph({
+                entryFilePaths: paths,
+                afterInit: async (g) => { state = installHqPlugin(g, pluginOpts); },
+            });
+            await prewarmHqSecrets(graph, pluginOpts, state);
+            await graph.resolveEnvValues();
+            const schemaErrors = Object.entries(graph.configSchema)
+                .filter(([, item]) => item.errors?.length > 0);
+            if (schemaErrors.length > 0) {
+                const msgs = schemaErrors.flatMap(([k, item]) => item.errors.map((e) => `  ${k}: ${e.message ?? String(e)}`));
+                process.stderr.write(`Error: failed to resolve env vars:\n${msgs.join('\n')}\n`);
+                process.exit(1);
+            }
+            const resolvedEnv = graph.getResolvedEnvObject();
+            const varCount = Object.keys(resolvedEnv).length;
+            process.stderr.write(`Loaded ${varCount} env vars from .env.schema (company: ${slug})\n`);
+            if (opts.check) {
+                process.exit(0);
+            }
+            const [childCmd, ...restArgs] = childArgs;
+            const child = spawn(childCmd, restArgs, {
+                stdio: 'inherit',
+                env: { ...process.env, ...resolvedEnv },
+            });
+            child.on('error', (err) => {
+                process.stderr.write(`Error: failed to start command '${childCmd}': ${err.message}\n`);
+                process.exit(1);
+            });
+            child.on('close', (code, signal) => {
+                if (signal) {
+                    process.kill(process.pid, signal);
+                }
+                process.exit(code ?? 1);
+            });
+        }
+        catch (err) {
+            process.stderr.write(`Error: ${err instanceof Error ? err.message : String(err)}\n`);
+            process.exit(1);
+        }
+    });
+}
+//# sourceMappingURL=run.js.map
+//# debugId=a1b39bbf-1f26-59e7-af70-6ecf01f2ce7e

package/dist/commands/secrets.d.ts

@@ -1,12 +1,6 @@
 import { Command } from "commander";
-export interface VaultApiOptions {
-    token: string;
-    path: string;
-    method?: string;
-    body?: Record<string, unknown>;
-    query?: Record<string, string>;
-}
-export declare function vaultApiFetch(opts: VaultApiOptions): Promise<Response>;
-export declare function getCompanyUid(token: string, companySlug: string | undefined): Promise<string>;
+import { vaultApiFetch, getCompanyUid } from "../utils/vault-api.js";
+export type { VaultApiOptions } from "../utils/vault-api.js";
+export { vaultApiFetch, getCompanyUid };
 export declare function registerSecretsCommand(program: Command): void;
 //# sourceMappingURL=secrets.d.ts.map

package/dist/commands/secrets.js

@@ -1,11 +1,13 @@
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="70f0907f-bfcb-5d2e-958a-8813d3bbaf96")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="0239c476-98b8-53c0-9458-1c82dc0d26a9")}catch(e){}}();
 import chalk from "chalk";
 import * as readline from "node:readline";
 import { spawn } from "node:child_process";
-import { ensureCognitoToken, DEFAULT_VAULT_API_URL, } from "../utils/cognito-session.js";
+import { ensureCognitoToken } from "../utils/cognito-session.js";
 import { readCache, writeCache, removeCacheEntry, clearAllCache, } from "../utils/secrets-cache.js";
 import { SECRET_NAME_PATTERN, GROUP_ID_PATTERN } from "./_patterns.js";
+import { vaultApiFetch, getCompanyUid } from "../utils/vault-api.js";
+export { vaultApiFetch, getCompanyUid };
 function shellSingleQuote(value) {
     return "'" + value.replace(/'/g, "'\\''") + "'";
 }
@@ -19,59 +21,6 @@ function buildSecretNamePath(companyUid, name) {
         .join("/");
     return `/secrets/${encodeURIComponent(companyUid)}/name/${encodedName}`;
 }
-export async function vaultApiFetch(opts) {
-    const url = new URL(opts.path, DEFAULT_VAULT_API_URL);
-    if (opts.query) {
-        for (const [k, v] of Object.entries(opts.query)) {
-            url.searchParams.set(k, v);
-        }
-    }
-    return fetch(url.toString(), {
-        method: opts.method ?? "GET",
-        headers: {
-            Authorization: `Bearer ${opts.token}`,
-            "Content-Type": "application/json",
-        },
-        body: opts.body ? JSON.stringify(opts.body) : undefined,
-    });
-}
-async function resolveCompanyUid(token, slug) {
-    const res = await vaultApiFetch({
-        token,
-        path: `/entity/by-slug/company/${encodeURIComponent(slug)}`,
-    });
-    if (!res.ok) {
-        const body = await res.json().catch(() => ({}));
-        throw new Error(`Failed to resolve company slug '${slug}': ${body.error ?? res.statusText}`);
-    }
-    const data = (await res.json());
-    return data.entity.uid;
-}
-async function resolveCompanyFromMemberships(token) {
-    const res = await vaultApiFetch({
-        token,
-        path: "/membership/me",
-    });
-    if (!res.ok) {
-        throw new Error("Failed to fetch memberships — run `hq login` and try again");
-    }
-    const data = (await res.json());
-    const active = data.memberships.filter((m) => m.status === "active");
-    if (active.length === 0) {
-        throw new Error("No active company memberships found. Use --company <slug> to specify.");
-    }
-    if (active.length === 1) {
-        return active[0].companyUid;
-    }
-    const uids = active.map((m) => m.companyUid).join(", ");
-    throw new Error(`Multiple companies found (${uids}). Use --company <slug> to specify which one.`);
-}
-export async function getCompanyUid(token, companySlug) {
-    if (companySlug) {
-        return resolveCompanyUid(token, companySlug);
-    }
-    return resolveCompanyFromMemberships(token);
-}
 function parseDuration(input) {
     const match = input.match(/^(\d+)(m|h|d)$/);
     if (!match)
@@ -756,4 +705,4 @@ export function registerSecretsCommand(program) {
     });
 }
 //# sourceMappingURL=secrets.js.map
-//# debugId=70f0907f-bfcb-5d2e-958a-8813d3bbaf96
+//# debugId=0239c476-98b8-53c0-9458-1c82dc0d26a9

package/dist/index.js

@@ -3,7 +3,7 @@
  * HQ CLI - Module management, package management, and cloud sync for HQ
  */
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="79222b07-0f20-582f-962f-6bc13b8c1c88")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="ad8b9496-9cb2-5e12-ae08-5b29ef77c209")}catch(e){}}();
 import { Command } from "commander";
 import { initSentry, Sentry } from "./sentry.js";
 import { registerAddCommand } from "./commands/add.js";
@@ -23,6 +23,7 @@ import { registerPackageListCommand } from "./commands/pkg-list.js";
 import { registerTeamSyncCommand } from "./commands/team-sync.js";
 import { registerAuthCommands } from "./commands/auth.js";
 import { registerSecretsCommand } from "./commands/secrets.js";
+import { registerRunCommand } from "./commands/run.js";
 import { registerGroupsCommand } from "./commands/groups.js";
 import { registerFilesCommand } from "./commands/files.js";
 initSentry();
@@ -72,6 +73,8 @@ registerWhoamiCommand(program);
 registerAuthCommands(program);
 // Secrets management (subcommand group — hq secrets set|get|list|delete|exec|generate-link|cache)
 registerSecretsCommand(program);
+// Schema-driven dev runner — hq run [options] -- <cmd>
+registerRunCommand(program);
 // Groups management (subcommand group — hq groups create|delete|add|remove|list|members)
 registerGroupsCommand(program);
 // Files ACL management (subcommand group — hq files share|unshare|acl)
@@ -91,4 +94,4 @@ registerOnboardCommand(program);
     }
 })();
 //# sourceMappingURL=index.js.map
-//# debugId=79222b07-0f20-582f-962f-6bc13b8c1c88
+//# debugId=ad8b9496-9cb2-5e12-ae08-5b29ef77c209

package/dist/run/discover-schemas.d.ts

@@ -0,0 +1,12 @@
+export interface SchemaConflict {
+    paths: [string, string];
+    slugs: [string, string];
+}
+export interface DiscoverSchemasResult {
+    schemaPaths: string[];
+    envLocalPaths: string[];
+    companySlug: string | null;
+    conflict: SchemaConflict | null;
+}
+export declare function discoverSchemas(cwd: string): DiscoverSchemasResult;
+//# sourceMappingURL=discover-schemas.d.ts.map

package/dist/run/discover-schemas.js

@@ -0,0 +1,64 @@
+
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="17c9937b-a219-5b2d-a120-0acbf96f945a")}catch(e){}}();
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+const SLUG_RE = /^# @hqCompany\("([^"]+)"\)/m;
+function parseSlug(filePath) {
+    try {
+        const content = fs.readFileSync(filePath, 'utf8');
+        const m = SLUG_RE.exec(content);
+        return m ? m[1] : null;
+    }
+    catch {
+        return null;
+    }
+}
+export function discoverSchemas(cwd) {
+    const schemaPaths = [];
+    const envLocalPaths = [];
+    let dir = path.resolve(cwd);
+    while (true) {
+        const schemaPath = path.join(dir, '.env.schema');
+        if (fs.existsSync(schemaPath)) {
+            schemaPaths.push(schemaPath);
+            const localPath = path.join(dir, '.env.local');
+            if (fs.existsSync(localPath)) {
+                envLocalPaths.push(localPath);
+            }
+        }
+        const isGitRoot = fs.existsSync(path.join(dir, '.git'));
+        if (isGitRoot)
+            break;
+        const parent = path.dirname(dir);
+        if (parent === dir)
+            break; // filesystem root
+        dir = parent;
+    }
+    // cwd-closest is pushed last during walk-up, so reversing puts it last.
+    // (During walk-up cwd is checked first → pushed first → reversed → ends up last.)
+    schemaPaths.reverse();
+    envLocalPaths.reverse();
+    let companySlug = null;
+    let companySlugPath = null;
+    let conflict = null;
+    for (const schemaPath of schemaPaths) {
+        const slug = parseSlug(schemaPath);
+        if (slug == null)
+            continue;
+        if (companySlug == null) {
+            companySlug = slug;
+            companySlugPath = schemaPath;
+        }
+        else if (companySlug !== slug) {
+            conflict = {
+                paths: [companySlugPath, schemaPath],
+                slugs: [companySlug, slug],
+            };
+            companySlug = null;
+            break;
+        }
+    }
+    return { schemaPaths, envLocalPaths, companySlug, conflict };
+}
+//# sourceMappingURL=discover-schemas.js.map
+//# debugId=17c9937b-a219-5b2d-a120-0acbf96f945a

package/dist/run/hq-plugin.d.ts

@@ -0,0 +1,26 @@
+export interface InstallHqPluginOpts {
+    companyOverride?: string;
+    resolveCompanyUid: (slug: string) => Promise<string>;
+    fetchBatch: (uid: string, names: string[]) => Promise<{
+        secrets: Array<{
+            name: string;
+            value: string;
+        }>;
+        errors: Array<{
+            name: string;
+            code: string;
+            message?: string;
+        }>;
+    }>;
+}
+export interface PluginState {
+    schemaCompanySlug: string | null;
+    uid: string | null;
+    errorsByName: Map<string, {
+        code: string;
+        message?: string;
+    }>;
+}
+export declare function installHqPlugin(graph: any, opts: InstallHqPluginOpts): PluginState;
+export declare function prewarmHqSecrets(graph: any, opts: InstallHqPluginOpts, state: PluginState): Promise<void>;
+//# sourceMappingURL=hq-plugin.d.ts.map

package/dist/run/hq-plugin.js

@@ -0,0 +1,144 @@
+
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="01fee323-1f63-5411-bfc9-ff49e241f712")}catch(e){}}();
+import { ResolutionError } from 'varlock/plugin-lib';
+import { readCache, writeCache } from '../utils/secrets-cache.js';
+export function installHqPlugin(graph /* EnvGraph */, opts) {
+    const pluginState = {
+        schemaCompanySlug: null,
+        uid: null,
+        errorsByName: new Map(),
+    };
+    // varlock@1.0.0's plugin-lib.js omits the Resolver export (d.ts/JS mismatch);
+    // extract it at runtime from any already-registered built-in resolver's prototype.
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    let RuntimeResolver;
+    try {
+        const fns = graph.registeredResolverFunctions;
+        const first = Object.values(fns)[0];
+        if (first == null)
+            throw new Error('registeredResolverFunctions is empty');
+        const proto = Object.getPrototypeOf(first);
+        if (proto == null || typeof proto.prototype?.process !== 'function') {
+            throw new Error('prototype has no process method');
+        }
+        RuntimeResolver = proto;
+    }
+    catch (e) {
+        throw new Error('varlock Resolver base class extraction failed — the varlock@1.0.0 d.ts/JS mismatch ' +
+            'may have been resolved; switch to `import { Resolver } from "varlock/plugin-lib"`. ' +
+            `Underlying: ${e instanceof Error ? e.message : String(e)}`);
+    }
+    // HqResolver is declared INSIDE installHqPlugin so its static def.resolve
+    // closes over `pluginState`. Module-scope declaration is forbidden — resolve()
+    // would hit `ReferenceError: pluginState is not defined`.
+    class HqResolver extends RuntimeResolver {
+        static def = {
+            name: 'hq',
+            impliesSensitive: true,
+            argsSchema: { type: 'array', arrayMaxLength: 1 },
+            resolve: async function () {
+                // Cache-only read. `pluginState` is captured by this inner-class closure;
+                // `prewarmHqSecrets(graph, opts, state)` populates `state.uid` and
+                // `state.errorsByName` before `graph.resolveEnvValues()` calls us.
+                const explicit = this.arrArgs?.[0]?.staticValue;
+                const secretName = (typeof explicit === 'string' && explicit) ? explicit : this._ownerKey;
+                if (!secretName) {
+                    throw new ResolutionError('hq() resolver could not determine secret name (missing owner key)');
+                }
+                const err = pluginState.errorsByName.get(secretName);
+                if (err) {
+                    if (err.code === 'forbidden') {
+                        throw new ResolutionError(`No read permission for secret "${secretName}" — ask an admin to share it via \`hq secrets share ${secretName} --with <you> --permission read\``);
+                    }
+                    if (err.code === 'not_found') {
+                        throw new ResolutionError(`Secret "${secretName}" does not exist in company`);
+                    }
+                    throw new ResolutionError(`Failed to load secret "${secretName}": ${err.message ?? err.code}`);
+                }
+                // Sentinel-check style throughout: `readCache` returns `string | null`
+                // (verified at `hq/packages/hq-cli/src/utils/secrets-cache.ts:45`); `pluginState.uid`
+                // is `string | null` per `PluginState`. Use `== null` (covers null AND undefined defensively)
+                // for both — do not mix in truthy checks like `if (!x)`, which would silently swallow a
+                // legitimate empty-string value if the contract ever loosened.
+                if (pluginState.uid == null) {
+                    throw new ResolutionError('Internal error: prewarmHqSecrets was not called before resolveEnvValues');
+                }
+                const cached = readCache(pluginState.uid, secretName); // string | null
+                if (cached == null) {
+                    throw new ResolutionError(`Internal error: pre-warm did not populate cache for "${secretName}"`);
+                }
+                return cached;
+            },
+        };
+        // Captured during process(parent); used by resolve() to fall back to the var key.
+        _ownerKey;
+        process(parent) {
+            super.process(parent);
+            if (parent != null && typeof parent.key === 'string') {
+                this._ownerKey = parent.key;
+            }
+        }
+    }
+    // varlock@1.0.0's env-spec parser rejects dots in decorator names ([a-zA-Z0-9_] only),
+    // so `@hq.company` is not valid syntax. We register as `@hqCompany` (camelCase) instead.
+    // Schema files must use `# @hqCompany("slug")` followed by a blank line so the parser
+    // treats it as a file-level root decorator rather than an item decorator for the next var.
+    graph.registerRootDecorator({
+        name: 'hqCompany',
+        isFunction: true,
+        process: (decoratorValue) => {
+            const slug = decoratorValue.arrArgs?.[0]?.staticValue;
+            return typeof slug === 'string' ? slug : null;
+        },
+        execute: (slug) => {
+            if (slug)
+                pluginState.schemaCompanySlug = slug;
+        },
+    });
+    graph.registerResolver(HqResolver);
+    // Returned so `prewarmHqSecrets(graph, opts, state)` can read schemaCompanySlug
+    // and write `uid` + `errorsByName`. The state is held by the closure; the returned handle
+    // is purely for the prewarm helper.
+    return pluginState;
+}
+export async function prewarmHqSecrets(graph /* EnvGraph */, opts, state) {
+    const queue = [];
+    for (const [key, item] of Object.entries(graph.configSchema)) {
+        const resolver = item.valueResolver;
+        if (resolver?.def?.name === 'hq') {
+            const explicit = resolver.arrArgs?.[0]?.staticValue;
+            const secretName = (typeof explicit === 'string' && explicit) ? explicit : key;
+            queue.push({ key, secretName });
+        }
+    }
+    if (queue.length === 0) {
+        return;
+    }
+    let slug;
+    if (state.schemaCompanySlug) {
+        slug = state.schemaCompanySlug;
+    }
+    else if (opts.companyOverride) {
+        slug = opts.companyOverride;
+    }
+    else {
+        throw new Error('@hqCompany("...") not declared and --company not passed');
+    }
+    const uid = await opts.resolveCompanyUid(slug);
+    const uniqueNames = [...new Set(queue.map((q) => q.secretName))];
+    if (uniqueNames.length > 100) {
+        throw new Error(`hq run supports at most 100 hq() resolvers per schema; got ${uniqueNames.length}`);
+    }
+    const result = await opts.fetchBatch(uid, uniqueNames);
+    for (const s of result.secrets) {
+        writeCache(uid, s.name, s.value);
+    }
+    const errorsByName = new Map();
+    for (const e of result.errors) {
+        errorsByName.set(e.name, { code: e.code, message: e.message });
+    }
+    state.errorsByName = errorsByName;
+    state.uid = uid;
+}
+//# sourceMappingURL=hq-plugin.js.map
+//# debugId=01fee323-1f63-5411-bfc9-ff49e241f712

package/dist/utils/vault-api.d.ts

@@ -0,0 +1,10 @@
+export interface VaultApiOptions {
+    token: string;
+    path: string;
+    method?: string;
+    body?: Record<string, unknown>;
+    query?: Record<string, string>;
+}
+export declare function vaultApiFetch(opts: VaultApiOptions): Promise<Response>;
+export declare function getCompanyUid(token: string, companySlug: string | undefined): Promise<string>;
+//# sourceMappingURL=vault-api.d.ts.map

package/dist/utils/vault-api.js

@@ -0,0 +1,58 @@
+
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="4e482805-d129-5563-a77b-97b80410154b")}catch(e){}}();
+import { DEFAULT_VAULT_API_URL } from './cognito-session.js';
+export async function vaultApiFetch(opts) {
+    const url = new URL(opts.path, DEFAULT_VAULT_API_URL);
+    if (opts.query) {
+        for (const [k, v] of Object.entries(opts.query)) {
+            url.searchParams.set(k, v);
+        }
+    }
+    return fetch(url.toString(), {
+        method: opts.method ?? 'GET',
+        headers: {
+            Authorization: `Bearer ${opts.token}`,
+            'Content-Type': 'application/json',
+        },
+        body: opts.body ? JSON.stringify(opts.body) : undefined,
+    });
+}
+async function resolveCompanyUid(token, slug) {
+    const res = await vaultApiFetch({
+        token,
+        path: `/entity/by-slug/company/${encodeURIComponent(slug)}`,
+    });
+    if (!res.ok) {
+        const body = await res.json().catch(() => ({}));
+        throw new Error(`Failed to resolve company slug '${slug}': ${body.error ?? res.statusText}`);
+    }
+    const data = (await res.json());
+    return data.entity.uid;
+}
+async function resolveCompanyFromMemberships(token) {
+    const res = await vaultApiFetch({
+        token,
+        path: '/membership/me',
+    });
+    if (!res.ok) {
+        throw new Error("Failed to fetch memberships — run `hq login` and try again");
+    }
+    const data = (await res.json());
+    const active = data.memberships.filter((m) => m.status === 'active');
+    if (active.length === 0) {
+        throw new Error('No active company memberships found. Use --company <slug> to specify.');
+    }
+    if (active.length === 1) {
+        return active[0].companyUid;
+    }
+    const uids = active.map((m) => m.companyUid).join(', ');
+    throw new Error(`Multiple companies found (${uids}). Use --company <slug> to specify which one.`);
+}
+export async function getCompanyUid(token, companySlug) {
+    if (companySlug) {
+        return resolveCompanyUid(token, companySlug);
+    }
+    return resolveCompanyFromMemberships(token);
+}
+//# sourceMappingURL=vault-api.js.map
+//# debugId=4e482805-d129-5563-a77b-97b80410154b

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.8.6",
+  "version": "5.9.0",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {
@@ -21,7 +21,8 @@
     "commander": "^12.1.0",
     "js-yaml": "^4.1.0",
     "simple-git": "^3.27.0",
-    "semver": "^7.6.3"
+    "semver": "^7.6.3",
+    "varlock": "1.0.0"
   },
   "devDependencies": {
     "@types/js-yaml": "^4.0.9",
@@ -42,5 +43,8 @@
     "cloud"
   ],
   "license": "MIT",
-  "type": "module"
+  "type": "module",
+  "engines": {
+    "node": ">=22.0.0"
+  }
 }