@indigoai-us/hq-cli 5.82.0 → 5.83.0

package/CHANGELOG.md

@@ -2,6 +2,17 @@
 
 ## [Unreleased]
 
+## [5.83.0]
+
+### Added
+
+- Checkpoint Stop-gate eligibility now also accepts outpost machine
+  identities whose `custom:delegatedEmail` claim carries an eligible
+  domain (default `getindigo.ai`, plus `HQ_CHECKPOINT_GATE_DOMAINS`),
+  so outposts provisioned by eligible users enforce the gate; other
+  orgs' outposts remain ineligible. Output/verdict stay `1`/`0` with
+  no claim values ever printed. (#291)
+
 ## [5.82.0]
 
 ### Added

package/dist/commands/core-checkpoint.js

@@ -318,17 +318,21 @@ function gateEligibility() {
         const tokens = JSON.parse(fs.readFileSync(tokenPath, "utf8"));
         if (typeof tokens.idToken !== "string")
             return false;
-        const email = peekIdToken(tokens.idToken).email;
-        if (typeof email !== "string")
-            return false;
-        const domain = email.split("@").at(-1)?.toLowerCase();
-        if (!domain)
-            return false;
+        const claims = peekIdToken(tokens.idToken);
+        const candidateEmails = [claims.email, claims["custom:delegatedEmail"]];
         const configured = (process.env.HQ_CHECKPOINT_GATE_DOMAINS ?? "")
             .split(",")
             .map((candidate) => candidate.trim().toLowerCase())
             .filter(Boolean);
-        return domain === "getindigo.ai" || configured.includes(domain);
+        const hasEligibleDomain = (candidate) => {
+            if (typeof candidate !== "string")
+                return false;
+            const domain = candidate.split("@").at(-1)?.toLowerCase();
+            if (!domain)
+                return false;
+            return domain === "getindigo.ai" || configured.includes(domain);
+        };
+        return candidateEmails.some(hasEligibleDomain);
     }
     catch {
         return false;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.82.0",
+  "version": "5.83.0",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {