@indigoai-us/hq-cloud 5.1.0 → 5.1.8

package/dist/ignore.d.ts

@@ -1,6 +1,17 @@
 /**
- * Ignore file parser for .hqsyncignore
- * Uses gitignore-compatible syntax
+ * Ignore-file parser for cloud sync.
+ *
+ * Three layers, evaluated in order (later patterns override earlier ones):
+ *   1. Built-in defaults — things that should *never* sync (VCS, node_modules,
+ *      build artifacts, caches, env files). Cover the common stacks so that a
+ *      first-time sync over a random project folder doesn't try to push
+ *      `target/`, `node_modules/`, or `.next/` to S3.
+ *   2. Repo `.gitignore` at hqRoot — reuses the user's existing exclusions so
+ *      we don't re-list every build directory ourselves. Root-level only; we
+ *      do not recurse like real git.
+ *   3. `.hqignore` (preferred) or `.hqsyncignore` (legacy name) at hqRoot —
+ *      sync-specific overrides. Use `!pattern` to re-include something an
+ *      earlier layer excluded.
  */
 export declare function createIgnoreFilter(hqRoot: string): (filePath: string) => boolean;
 /**

package/dist/ignore.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ignore.d.ts","sourceRoot":"","sources":["../src/ignore.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAwBH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAkBhF;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,MAAM,EAChB,QAAQ,SAAmB,GAC1B,OAAO,CAOT"}
+{"version":3,"file":"ignore.d.ts","sourceRoot":"","sources":["../src/ignore.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAyEH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAsBhF;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,MAAM,EAChB,QAAQ,SAAmB,GAC1B,OAAO,CAOT"}

package/dist/ignore.js

@@ -1,37 +1,94 @@
 /**
- * Ignore file parser for .hqsyncignore
- * Uses gitignore-compatible syntax
+ * Ignore-file parser for cloud sync.
+ *
+ * Three layers, evaluated in order (later patterns override earlier ones):
+ *   1. Built-in defaults — things that should *never* sync (VCS, node_modules,
+ *      build artifacts, caches, env files). Cover the common stacks so that a
+ *      first-time sync over a random project folder doesn't try to push
+ *      `target/`, `node_modules/`, or `.next/` to S3.
+ *   2. Repo `.gitignore` at hqRoot — reuses the user's existing exclusions so
+ *      we don't re-list every build directory ourselves. Root-level only; we
+ *      do not recurse like real git.
+ *   3. `.hqignore` (preferred) or `.hqsyncignore` (legacy name) at hqRoot —
+ *      sync-specific overrides. Use `!pattern` to re-include something an
+ *      earlier layer excluded.
  */
 import * as fs from "fs";
 import * as path from "path";
 import ignore from "ignore";
-// Default patterns that should never sync
+// Patterns that must never sync regardless of project type.
+// Grouped by ecosystem so new stacks are easy to add.
 const DEFAULT_IGNORES = [
+    // VCS + OS
     ".git/",
     ".git",
-    "node_modules/",
-    "dist/",
     ".DS_Store",
     "Thumbs.db",
+    // Node / JS
+    "node_modules/",
+    "dist/",
+    "build/",
+    ".next/",
+    ".nuxt/",
+    ".svelte-kit/",
+    ".turbo/",
+    ".parcel-cache/",
+    ".vite/",
+    "coverage/",
+    // Rust / Tauri
+    "target/",
+    // Python
+    "__pycache__/",
+    "*.pyc",
+    ".pytest_cache/",
+    ".mypy_cache/",
+    ".ruff_cache/",
+    ".venv/",
+    "venv/",
+    // Go / JVM / other
+    "vendor/",
+    "out/",
+    "*.class",
+    // Generic caches / temp
+    ".cache/",
+    "tmp/",
+    ".tmp/",
+    // HQ sync internal state (never round-trip these)
     "*.pid",
     ".hq-sync.pid",
     ".hq-sync-journal.json",
     ".hq-sync-state.json",
     "modules.lock",
+    // HQ repos directory (managed separately, not synced)
     "repos/",
+    // Secrets / env
     ".env",
     ".env.*",
 ];
+function readIgnoreFile(filePath) {
+    if (!fs.existsSync(filePath))
+        return null;
+    try {
+        return fs.readFileSync(filePath, "utf-8");
+    }
+    catch {
+        return null;
+    }
+}
 export function createIgnoreFilter(hqRoot) {
     const ig = ignore();
-    // Add defaults
+    // Layer 1: baseline defaults
     ig.add(DEFAULT_IGNORES);
-    // Read .hqsyncignore if it exists
-    const ignorePath = path.join(hqRoot, ".hqsyncignore");
-    if (fs.existsSync(ignorePath)) {
-        const content = fs.readFileSync(ignorePath, "utf-8");
-        ig.add(content);
-    }
+    // Layer 2: repo's .gitignore (common case — covers most build dirs already)
+    const gitignore = readIgnoreFile(path.join(hqRoot, ".gitignore"));
+    if (gitignore)
+        ig.add(gitignore);
+    // Layer 3: sync-specific overrides. .hqignore is the documented name;
+    // .hqsyncignore is the legacy name we still honor.
+    const hqignore = readIgnoreFile(path.join(hqRoot, ".hqignore")) ??
+        readIgnoreFile(path.join(hqRoot, ".hqsyncignore"));
+    if (hqignore)
+        ig.add(hqignore);
     return (filePath) => {
         const relative = path.relative(hqRoot, filePath);
         if (!relative || relative.startsWith(".."))

package/dist/ignore.js.map

@@ -1 +1 @@
-{"version":3,"file":"ignore.js","sourceRoot":"","sources":["../src/ignore.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,MAAM,MAAM,QAAQ,CAAC;AAE5B,0CAA0C;AAC1C,MAAM,eAAe,GAAG;IACtB,OAAO;IACP,MAAM;IACN,eAAe;IACf,OAAO;IACP,WAAW;IACX,WAAW;IACX,OAAO;IACP,cAAc;IACd,uBAAuB;IACvB,qBAAqB;IACrB,cAAc;IACd,QAAQ;IACR,MAAM;IACN,QAAQ;CACT,CAAC;AAEF,MAAM,UAAU,kBAAkB,CAAC,MAAc;IAC/C,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC;IAEpB,eAAe;IACf,EAAE,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IAExB,kCAAkC;IAClC,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IACtD,IAAI,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC9B,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QACrD,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAClB,CAAC;IAED,OAAO,CAAC,QAAgB,EAAW,EAAE;QACnC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QACjD,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC,CAAC,kBAAkB;QAC3E,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC/B,CAAC,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iBAAiB,CAC/B,QAAgB,EAChB,QAAQ,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI;IAE3B,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACnC,OAAO,IAAI,CAAC,IAAI,IAAI,QAAQ,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}
+{"version":3,"file":"ignore.js","sourceRoot":"","sources":["../src/ignore.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,MAAM,MAAM,QAAQ,CAAC;AAE5B,4DAA4D;AAC5D,sDAAsD;AACtD,MAAM,eAAe,GAAG;IACtB,WAAW;IACX,OAAO;IACP,MAAM;IACN,WAAW;IACX,WAAW;IAEX,YAAY;IACZ,eAAe;IACf,OAAO;IACP,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,cAAc;IACd,SAAS;IACT,gBAAgB;IAChB,QAAQ;IACR,WAAW;IAEX,eAAe;IACf,SAAS;IAET,SAAS;IACT,cAAc;IACd,OAAO;IACP,gBAAgB;IAChB,cAAc;IACd,cAAc;IACd,QAAQ;IACR,OAAO;IAEP,mBAAmB;IACnB,SAAS;IACT,MAAM;IACN,SAAS;IAET,wBAAwB;IACxB,SAAS;IACT,MAAM;IACN,OAAO;IAEP,kDAAkD;IAClD,OAAO;IACP,cAAc;IACd,uBAAuB;IACvB,qBAAqB;IACrB,cAAc;IAEd,sDAAsD;IACtD,QAAQ;IAER,gBAAgB;IAChB,MAAM;IACN,QAAQ;CACT,CAAC;AAEF,SAAS,cAAc,CAAC,QAAgB;IACtC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1C,IAAI,CAAC;QACH,OAAO,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,MAAc;IAC/C,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC;IAEpB,6BAA6B;IAC7B,EAAE,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IAExB,4EAA4E;IAC5E,MAAM,SAAS,GAAG,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC;IAClE,IAAI,SAAS;QAAE,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IAEjC,sEAAsE;IACtE,mDAAmD;IACnD,MAAM,QAAQ,GACZ,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QAC9C,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC,CAAC;IACrD,IAAI,QAAQ;QAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAE/B,OAAO,CAAC,QAAgB,EAAW,EAAE;QACnC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QACjD,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC,CAAC,kBAAkB;QAC3E,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC/B,CAAC,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iBAAiB,CAC/B,QAAgB,EAChB,QAAQ,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI;IAE3B,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACnC,OAAO,IAAI,CAAC,IAAI,IAAI,QAAQ,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/dist/index.d.ts

@@ -1,33 +1,29 @@
 /**
  * @indigoai-us/hq-cloud — public API
- * Used by @indigoai-us/hq-cli to manage cloud sync
+ *
+ * VLT-5: Entity-aware sync engine. Operations resolve their target bucket
+ * and credentials from the vault-service entity registry + STS vending.
  */
-import type { SyncStatus, PushResult, PullResult } from "./types.js";
-export type { SyncStatus, PushResult, PullResult } from "./types.js";
-export { browserLogin, refreshTokens, getValidAccessToken, loadCachedTokens, saveCachedTokens, clearCachedTokens, isExpiring, CognitoAuthError, } from "./cognito-auth.js";
+export { resolveEntityContext, refreshEntityContext, clearContextCache, isExpiringSoon, } from "./context.js";
+export { uploadFile, downloadFile, listRemoteFiles, deleteRemoteFile, headRemoteFile, } from "./s3.js";
+export type { RemoteFile } from "./s3.js";
+export { readJournal, writeJournal, hashFile, updateEntry, getEntry, removeEntry, getJournalPath, } from "./journal.js";
+export { createIgnoreFilter, isWithinSizeLimit, } from "./ignore.js";
+export { browserLogin, refreshTokens, loadCachedTokens, saveCachedTokens, clearCachedTokens, isExpiring, getValidAccessToken, CognitoAuthError, } from "./cognito-auth.js";
 export type { CognitoAuthConfig, CognitoTokens } from "./cognito-auth.js";
-/**
- * Initialize cloud sync — authenticate and provision bucket
- */
-export declare function initSync(hqRoot: string): Promise<void>;
-/**
- * Start the background sync daemon
- */
-export declare function startDaemon(hqRoot: string): Promise<void>;
-/**
- * Stop the background sync daemon
- */
-export declare function stopDaemon(hqRoot: string): Promise<void>;
-/**
- * Get current sync status
- */
-export declare function getStatus(hqRoot: string): Promise<SyncStatus>;
-/**
- * Force push all local files to S3
- */
-export declare function pushAll(hqRoot: string): Promise<PushResult>;
-/**
- * Force pull all remote files to local
- */
-export declare function pullAll(hqRoot: string): Promise<PullResult>;
+export { VaultClient } from "./vault-client.js";
+export { VaultClientError, VaultAuthError, VaultPermissionDeniedError, VaultNotFoundError, VaultConflictError, } from "./vault-client.js";
+export type { MembershipRole, MembershipStatus, Membership, CreateInviteInput, CreateInviteResult, AcceptInviteResult, UpdateRoleInput, EntityInfo, CreateEntityInput, CreateEntityResult, } from "./vault-client.js";
+export type { TaskAction, TaskScope, VendChildInput, VendChildResult, StsChildCredentials, } from "./vault-client.js";
+export { share, sync } from "./cli/index.js";
+export type { ShareOptions, ShareResult, SyncOptions, SyncResult, SyncProgressEvent } from "./cli/index.js";
+export { resolveConflict, showDiff } from "./cli/index.js";
+export type { ConflictStrategy, ConflictInfo, ConflictResolution } from "./cli/index.js";
+export { invite, listInvites, revokeInvite } from "./cli/index.js";
+export type { InviteOptions, InviteResult, InviteListOptions, InviteRevokeOptions } from "./cli/index.js";
+export { accept, parseToken } from "./cli/index.js";
+export type { AcceptOptions, AcceptResult } from "./cli/index.js";
+export { promote } from "./cli/index.js";
+export type { PromoteOptions, PromoteResult } from "./cli/index.js";
+export type { EntityContext, VaultCredentials, VaultServiceConfig, SyncConfig, Credentials, JournalEntry, SyncJournal, SyncStatus, PushResult, PullResult, DaemonState, } from "./types.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAaH,OAAO,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAErE,YAAY,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAIrE,OAAO,EACL,YAAY,EACZ,aAAa,EACb,mBAAmB,EACnB,gBAAgB,EAChB,gBAAgB,EAChB,iBAAiB,EACjB,UAAU,EACV,gBAAgB,GACjB,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAE1E;;GAEG;AACH,wBAAsB,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAa5D;AAED;;GAEG;AACH,wBAAsB,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAK/D;AAED;;GAEG;AACH,wBAAsB,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE9D;AAED;;GAEG;AACH,wBAAsB,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAiBnE;AAED;;GAEG;AACH,wBAAsB,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CA4BjE;AAED;;GAEG;AACH,wBAAsB,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAyBjE"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,iBAAiB,EACjB,cAAc,GACf,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,UAAU,EACV,YAAY,EACZ,eAAe,EACf,gBAAgB,EAChB,cAAc,GACf,MAAM,SAAS,CAAC;AAEjB,YAAY,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAE1C,OAAO,EACL,WAAW,EACX,YAAY,EACZ,QAAQ,EACR,WAAW,EACX,QAAQ,EACR,WAAW,EACX,cAAc,GACf,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,kBAAkB,EAClB,iBAAiB,GAClB,MAAM,aAAa,CAAC;AAGrB,OAAO,EACL,YAAY,EACZ,aAAa,EACb,gBAAgB,EAChB,gBAAgB,EAChB,iBAAiB,EACjB,UAAU,EACV,mBAAmB,EACnB,gBAAgB,GACjB,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAG1E,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EACL,gBAAgB,EAChB,cAAc,EACd,0BAA0B,EAC1B,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EACV,cAAc,EACd,gBAAgB,EAChB,UAAU,EACV,iBAAiB,EACjB,kBAAkB,EAClB,kBAAkB,EAClB,eAAe,EACf,UAAU,EACV,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,mBAAmB,CAAC;AAG3B,YAAY,EACV,UAAU,EACV,SAAS,EACT,cAAc,EACd,eAAe,EACf,mBAAmB,GACpB,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAC;AAC7C,YAAY,EAAE,YAAY,EAAE,WAAW,EAAE,WAAW,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAC5G,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC3D,YAAY,EAAE,gBAAgB,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAGzF,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AACnE,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAC1G,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AACpD,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAClE,OAAO,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AACzC,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAEpE,YAAY,EACV,aAAa,EACb,gBAAgB,EAChB,kBAAkB,EAClB,UAAU,EACV,WAAW,EACX,YAAY,EACZ,WAAW,EACX,UAAU,EACV,UAAU,EACV,UAAU,EACV,WAAW,GACZ,MAAM,YAAY,CAAC"}

package/dist/index.js

@@ -1,138 +1,23 @@
 /**
  * @indigoai-us/hq-cloud — public API
- * Used by @indigoai-us/hq-cli to manage cloud sync
+ *
+ * VLT-5: Entity-aware sync engine. Operations resolve their target bucket
+ * and credentials from the vault-service entity registry + STS vending.
  */
-import * as fs from "fs";
-import * as path from "path";
-import { authenticate, hasCredentials, readCredentials } from "./auth.js";
-import { startDaemon as _startDaemon, stopDaemon as _stopDaemon, isDaemonRunning, } from "./daemon.js";
-import { readJournal, writeJournal, hashFile, updateEntry } from "./journal.js";
-import { uploadFile, downloadFile, listRemoteFiles } from "./s3.js";
-import { createIgnoreFilter, isWithinSizeLimit } from "./ignore.js";
-// Cognito identity helpers — used by `hq auth refresh` and any consumer
-// that needs a valid HQ access token (deploy skill, onboarding, etc.).
-export { browserLogin, refreshTokens, getValidAccessToken, loadCachedTokens, saveCachedTokens, clearCachedTokens, isExpiring, CognitoAuthError, } from "./cognito-auth.js";
-/**
- * Initialize cloud sync — authenticate and provision bucket
- */
-export async function initSync(hqRoot) {
-    if (hasCredentials()) {
-        console.log("  Already authenticated. Use 'hq sync start' to begin syncing.");
-        return;
-    }
-    console.log("  Setting up IndigoAI cloud sync...");
-    const creds = await authenticate();
-    console.log(`  ✓ Authenticated as ${creds.userId}`);
-    console.log(`  ✓ Bucket: ${creds.bucket}`);
-    console.log(`  ✓ Region: ${creds.region}`);
-    console.log();
-    console.log("  Run 'hq sync start' to begin syncing.");
-}
-/**
- * Start the background sync daemon
- */
-export async function startDaemon(hqRoot) {
-    if (!hasCredentials()) {
-        throw new Error("Not authenticated. Run 'hq sync init' first.");
-    }
-    _startDaemon(hqRoot);
-}
-/**
- * Stop the background sync daemon
- */
-export async function stopDaemon(hqRoot) {
-    _stopDaemon(hqRoot);
-}
-/**
- * Get current sync status
- */
-export async function getStatus(hqRoot) {
-    const journal = readJournal(hqRoot);
-    const creds = readCredentials();
-    const running = isDaemonRunning(hqRoot);
-    const errors = [];
-    if (!creds) {
-        errors.push("Not authenticated — run 'hq sync init'");
-    }
-    return {
-        running,
-        lastSync: journal.lastSync || null,
-        fileCount: Object.keys(journal.files).length,
-        bucket: creds?.bucket || null,
-        errors,
-    };
-}
-/**
- * Force push all local files to S3
- */
-export async function pushAll(hqRoot) {
-    const shouldSync = createIgnoreFilter(hqRoot);
-    const journal = readJournal(hqRoot);
-    let filesUploaded = 0;
-    let bytesUploaded = 0;
-    const files = walkDir(hqRoot, hqRoot, shouldSync);
-    for (const { absolutePath, relativePath } of files) {
-        if (!isWithinSizeLimit(absolutePath))
-            continue;
-        try {
-            const hash = hashFile(absolutePath);
-            const stat = fs.statSync(absolutePath);
-            await uploadFile(absolutePath, relativePath);
-            updateEntry(journal, relativePath, hash, stat.size, "up");
-            filesUploaded++;
-            bytesUploaded += stat.size;
-        }
-        catch (err) {
-            console.error(`  Failed: ${relativePath} — ${err instanceof Error ? err.message : err}`);
-        }
-    }
-    writeJournal(hqRoot, journal);
-    return { filesUploaded, bytesUploaded };
-}
-/**
- * Force pull all remote files to local
- */
-export async function pullAll(hqRoot) {
-    const journal = readJournal(hqRoot);
-    let filesDownloaded = 0;
-    let bytesDownloaded = 0;
-    const remoteFiles = await listRemoteFiles();
-    for (const file of remoteFiles) {
-        try {
-            const localPath = path.join(hqRoot, file.relativePath);
-            await downloadFile(file.relativePath, localPath);
-            const hash = hashFile(localPath);
-            updateEntry(journal, file.relativePath, hash, file.size, "down");
-            filesDownloaded++;
-            bytesDownloaded += file.size;
-        }
-        catch (err) {
-            console.error(`  Failed: ${file.relativePath} — ${err instanceof Error ? err.message : err}`);
-        }
-    }
-    writeJournal(hqRoot, journal);
-    return { filesDownloaded, bytesDownloaded };
-}
-// Helper: recursively walk a directory
-function walkDir(dir, root, filter) {
-    const results = [];
-    if (!fs.existsSync(dir))
-        return results;
-    const entries = fs.readdirSync(dir, { withFileTypes: true });
-    for (const entry of entries) {
-        const absolutePath = path.join(dir, entry.name);
-        if (!filter(absolutePath))
-            continue;
-        if (entry.isDirectory()) {
-            results.push(...walkDir(absolutePath, root, filter));
-        }
-        else if (entry.isFile()) {
-            results.push({
-                absolutePath,
-                relativePath: path.relative(root, absolutePath),
-            });
-        }
-    }
-    return results;
-}
+export { resolveEntityContext, refreshEntityContext, clearContextCache, isExpiringSoon, } from "./context.js";
+export { uploadFile, downloadFile, listRemoteFiles, deleteRemoteFile, headRemoteFile, } from "./s3.js";
+export { readJournal, writeJournal, hashFile, updateEntry, getEntry, removeEntry, getJournalPath, } from "./journal.js";
+export { createIgnoreFilter, isWithinSizeLimit, } from "./ignore.js";
+// Cognito browser-OAuth (VLT-9)
+export { browserLogin, refreshTokens, loadCachedTokens, saveCachedTokens, clearCachedTokens, isExpiring, getValidAccessToken, CognitoAuthError, } from "./cognito-auth.js";
+// VaultClient SDK (VLT-7)
+export { VaultClient } from "./vault-client.js";
+export { VaultClientError, VaultAuthError, VaultPermissionDeniedError, VaultNotFoundError, VaultConflictError, } from "./vault-client.js";
+// CLI commands
+export { share, sync } from "./cli/index.js";
+export { resolveConflict, showDiff } from "./cli/index.js";
+// Membership CLI commands (VLT-7)
+export { invite, listInvites, revokeInvite } from "./cli/index.js";
+export { accept, parseToken } from "./cli/index.js";
+export { promote } from "./cli/index.js";
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAC1E,OAAO,EACL,WAAW,IAAI,YAAY,EAC3B,UAAU,IAAI,WAAW,EACzB,eAAe,GAChB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAChF,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AACpE,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAKpE,wEAAwE;AACxE,uEAAuE;AACvE,OAAO,EACL,YAAY,EACZ,aAAa,EACb,mBAAmB,EACnB,gBAAgB,EAChB,gBAAgB,EAChB,iBAAiB,EACjB,UAAU,EACV,gBAAgB,GACjB,MAAM,mBAAmB,CAAC;AAG3B;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,MAAc;IAC3C,IAAI,cAAc,EAAE,EAAE,CAAC;QACrB,OAAO,CAAC,GAAG,CAAC,gEAAgE,CAAC,CAAC;QAC9E,OAAO;IACT,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,qCAAqC,CAAC,CAAC;IACnD,MAAM,KAAK,GAAG,MAAM,YAAY,EAAE,CAAC;IACnC,OAAO,CAAC,GAAG,CAAC,wBAAwB,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IACpD,OAAO,CAAC,GAAG,CAAC,eAAe,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IAC3C,OAAO,CAAC,GAAG,CAAC,eAAe,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IAC3C,OAAO,CAAC,GAAG,EAAE,CAAC;IACd,OAAO,CAAC,GAAG,CAAC,yCAAyC,CAAC,CAAC;AACzD,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,MAAc;IAC9C,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,CAAC;IACD,YAAY,CAAC,MAAM,CAAC,CAAC;AACvB,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,MAAc;IAC7C,WAAW,CAAC,MAAM,CAAC,CAAC;AACtB,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,MAAc;IAC5C,MAAM,OAAO,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;IACpC,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC;IAChC,MAAM,OAAO,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;IACxC,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,CAAC,IAAI,CAAC,wCAAwC,CAAC,CAAC;IACxD,CAAC;IAED,OAAO;QACL,OAAO;QACP,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,IAAI;QAClC,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM;QAC5C,MAAM,EAAE,KAAK,EAAE,MAAM,IAAI,IAAI;QAC7B,MAAM;KACP,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,MAAc;IAC1C,MAAM,UAAU,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;IAC9C,MAAM,OAAO,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;IACpC,IAAI,aAAa,GAAG,CAAC,CAAC;IACtB,IAAI,aAAa,GAAG,CAAC,CAAC;IAEtB,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;IAElD,KAAK,MAAM,EAAE,YAAY,EAAE,YAAY,EAAE,IAAI,KAAK,EAAE,CAAC;QACnD,IAAI,CAAC,iBAAiB,CAAC,YAAY,CAAC;YAAE,SAAS;QAE/C,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,QAAQ,CAAC,YAAY,CAAC,CAAC;YACpC,MAAM,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;YAEvC,MAAM,UAAU,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC;YAC7C,WAAW,CAAC,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YAC1D,aAAa,EAAE,CAAC;YAChB,aAAa,IAAI,IAAI,CAAC,IAAI,CAAC;QAC7B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CACX,aAAa,YAAY,MAAM,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,CAC1E,CAAC;QACJ,CAAC;IACH,CAAC;IAED,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,CAAC;AAC1C,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,MAAc;IAC1C,MAAM,OAAO,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;IACpC,IAAI,eAAe,GAAG,CAAC,CAAC;IACxB,IAAI,eAAe,GAAG,CAAC,CAAC;IAExB,MAAM,WAAW,GAAG,MAAM,eAAe,EAAE,CAAC;IAE5C,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;QAC/B,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;YACvD,MAAM,YAAY,CAAC,IAAI,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;YAEjD,MAAM,IAAI,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC;YACjC,WAAW,CAAC,OAAO,EAAE,IAAI,CAAC,YAAY,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YACjE,eAAe,EAAE,CAAC;YAClB,eAAe,IAAI,IAAI,CAAC,IAAI,CAAC;QAC/B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CACX,aAAa,IAAI,CAAC,YAAY,MAAM,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,CAC/E,CAAC;QACJ,CAAC;IACH,CAAC;IAED,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,CAAC;AAC9C,CAAC;AAED,uCAAuC;AACvC,SAAS,OAAO,CACd,GAAW,EACX,IAAY,EACZ,MAA8B;IAE9B,MAAM,OAAO,GAAqD,EAAE,CAAC;IAErE,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,OAAO,CAAC;IAExC,MAAM,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7D,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAEhD,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC;YAAE,SAAS;QAEpC,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YACxB,OAAO,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,YAAY,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;QACvD,CAAC;aAAM,IAAI,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;YAC1B,OAAO,CAAC,IAAI,CAAC;gBACX,YAAY;gBACZ,YAAY,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;aAChD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,iBAAiB,EACjB,cAAc,GACf,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,UAAU,EACV,YAAY,EACZ,eAAe,EACf,gBAAgB,EAChB,cAAc,GACf,MAAM,SAAS,CAAC;AAIjB,OAAO,EACL,WAAW,EACX,YAAY,EACZ,QAAQ,EACR,WAAW,EACX,QAAQ,EACR,WAAW,EACX,cAAc,GACf,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,kBAAkB,EAClB,iBAAiB,GAClB,MAAM,aAAa,CAAC;AAErB,gCAAgC;AAChC,OAAO,EACL,YAAY,EACZ,aAAa,EACb,gBAAgB,EAChB,gBAAgB,EAChB,iBAAiB,EACjB,UAAU,EACV,mBAAmB,EACnB,gBAAgB,GACjB,MAAM,mBAAmB,CAAC;AAG3B,0BAA0B;AAC1B,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EACL,gBAAgB,EAChB,cAAc,EACd,0BAA0B,EAC1B,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,mBAAmB,CAAC;AAuB3B,eAAe;AACf,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAC;AAE7C,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAG3D,kCAAkC;AAClC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAEnE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAEpD,OAAO,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC"}

package/dist/journal.d.ts

@@ -1,10 +1,26 @@
 /**
- * Sync journal — tracks file state for conflict detection
+ * Sync journal — tracks per-file state (hash, size, last-synced direction) so
+ * sync/share can detect local edits that would be clobbered by a blind pull.
+ *
+ * ADR-0001 Phase 5: the journal is sharded by company slug and lives in
+ * `~/.hq/`, not inside the HQ content root. One monolithic journal per HQ
+ * install conflates state across companies and forces every runner to
+ * serialize through the same file — splitting it lets `hq-sync-runner
+ * --companies` fan out without contention, and a corrupted shard only affects
+ * one company.
+ *
+ * Path: `{stateDir}/sync-journal.{slug}.json`, where `stateDir` resolves to
+ * `HQ_STATE_DIR` (if set) or `~/.hq`.
  */
 import type { SyncJournal, JournalEntry } from "./types.js";
-export declare function getJournalPath(hqRoot: string): string;
-export declare function readJournal(hqRoot: string): SyncJournal;
-export declare function writeJournal(hqRoot: string, journal: SyncJournal): void;
+/**
+ * Where per-company journals are stored. Honors `HQ_STATE_DIR` for tests and
+ * non-standard installs; otherwise falls back to `~/.hq`.
+ */
+export declare function getStateDir(): string;
+export declare function getJournalPath(slug: string): string;
+export declare function readJournal(slug: string): SyncJournal;
+export declare function writeJournal(slug: string, journal: SyncJournal): void;
 export declare function hashFile(filePath: string): string;
 export declare function updateEntry(journal: SyncJournal, relativePath: string, hash: string, size: number, direction: "up" | "down"): void;
 export declare function getEntry(journal: SyncJournal, relativePath: string): JournalEntry | undefined;

package/dist/journal.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"journal.d.ts","sourceRoot":"","sources":["../src/journal.ts"],"names":[],"mappings":"AAAA;;GAEG;AAKH,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAI5D,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAErD;AAED,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,WAAW,CAOvD;AAED,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,GAAG,IAAI,CAGvE;AAED,wBAAgB,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAGjD;AAED,wBAAgB,WAAW,CACzB,OAAO,EAAE,WAAW,EACpB,YAAY,EAAE,MAAM,EACpB,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,IAAI,GAAG,MAAM,GACvB,IAAI,CAQN;AAED,wBAAgB,QAAQ,CACtB,OAAO,EAAE,WAAW,EACpB,YAAY,EAAE,MAAM,GACnB,YAAY,GAAG,SAAS,CAE1B;AAED,wBAAgB,WAAW,CACzB,OAAO,EAAE,WAAW,EACpB,YAAY,EAAE,MAAM,GACnB,IAAI,CAEN"}
+{"version":3,"file":"journal.d.ts","sourceRoot":"","sources":["../src/journal.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAMH,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAK5D;;;GAGG;AACH,wBAAgB,WAAW,IAAI,MAAM,CAEpC;AAmBD,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAKnD;AAED,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,WAAW,CAOrD;AAED,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,GAAG,IAAI,CAIrE;AAED,wBAAgB,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAGjD;AAED,wBAAgB,WAAW,CACzB,OAAO,EAAE,WAAW,EACpB,YAAY,EAAE,MAAM,EACpB,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,IAAI,GAAG,MAAM,GACvB,IAAI,CAQN;AAED,wBAAgB,QAAQ,CACtB,OAAO,EAAE,WAAW,EACpB,YAAY,EAAE,MAAM,GACnB,YAAY,GAAG,SAAS,CAE1B;AAED,wBAAgB,WAAW,CACzB,OAAO,EAAE,WAAW,EACpB,YAAY,EAAE,MAAM,GACnB,IAAI,CAEN"}

package/dist/journal.js

@@ -1,23 +1,60 @@
 /**
- * Sync journal — tracks file state for conflict detection
+ * Sync journal — tracks per-file state (hash, size, last-synced direction) so
+ * sync/share can detect local edits that would be clobbered by a blind pull.
+ *
+ * ADR-0001 Phase 5: the journal is sharded by company slug and lives in
+ * `~/.hq/`, not inside the HQ content root. One monolithic journal per HQ
+ * install conflates state across companies and forces every runner to
+ * serialize through the same file — splitting it lets `hq-sync-runner
+ * --companies` fan out without contention, and a corrupted shard only affects
+ * one company.
+ *
+ * Path: `{stateDir}/sync-journal.{slug}.json`, where `stateDir` resolves to
+ * `HQ_STATE_DIR` (if set) or `~/.hq`.
  */
 import * as fs from "fs";
+import * as os from "os";
 import * as path from "path";
 import * as crypto from "crypto";
-const JOURNAL_FILE = ".hq-sync-journal.json";
-export function getJournalPath(hqRoot) {
-    return path.join(hqRoot, JOURNAL_FILE);
+const JOURNAL_FILE_PREFIX = "sync-journal.";
+const JOURNAL_FILE_SUFFIX = ".json";
+/**
+ * Where per-company journals are stored. Honors `HQ_STATE_DIR` for tests and
+ * non-standard installs; otherwise falls back to `~/.hq`.
+ */
+export function getStateDir() {
+    return process.env.HQ_STATE_DIR ?? path.join(os.homedir(), ".hq");
+}
+/**
+ * Filename-safe form of a slug. Slugs from vault-service are already
+ * URL-safe, but this guards against paths, dots, or anything the filesystem
+ * might interpret. Empty-or-invalid slugs throw rather than silently writing
+ * to a shared "sync-journal..json" file.
+ */
+function sanitizeSlug(slug) {
+    if (!slug) {
+        throw new Error("journal: slug is required (empty or undefined)");
+    }
+    const cleaned = slug.replace(/[^a-zA-Z0-9_-]/g, "_");
+    if (!cleaned || /^[_-]+$/.test(cleaned)) {
+        throw new Error(`journal: slug "${slug}" sanitizes to an empty identifier`);
+    }
+    return cleaned;
+}
+export function getJournalPath(slug) {
+    return path.join(getStateDir(), `${JOURNAL_FILE_PREFIX}${sanitizeSlug(slug)}${JOURNAL_FILE_SUFFIX}`);
 }
-export function readJournal(hqRoot) {
-    const journalPath = getJournalPath(hqRoot);
+export function readJournal(slug) {
+    const journalPath = getJournalPath(slug);
     if (fs.existsSync(journalPath)) {
         const content = fs.readFileSync(journalPath, "utf-8");
         return JSON.parse(content);
     }
     return { version: "1", lastSync: "", files: {} };
 }
-export function writeJournal(hqRoot, journal) {
-    const journalPath = getJournalPath(hqRoot);
+export function writeJournal(slug, journal) {
+    const journalPath = getJournalPath(slug);
+    fs.mkdirSync(path.dirname(journalPath), { recursive: true });
     fs.writeFileSync(journalPath, JSON.stringify(journal, null, 2));
 }
 export function hashFile(filePath) {

package/dist/journal.js.map

@@ -1 +1 @@
-{"version":3,"file":"journal.js","sourceRoot":"","sources":["../src/journal.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,KAAK,MAAM,MAAM,QAAQ,CAAC;AAGjC,MAAM,YAAY,GAAG,uBAAuB,CAAC;AAE7C,MAAM,UAAU,cAAc,CAAC,MAAc;IAC3C,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;AACzC,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,MAAc;IACxC,MAAM,WAAW,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;IAC3C,IAAI,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QAC/B,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;QACtD,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAgB,CAAC;IAC5C,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;AACnD,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,MAAc,EAAE,OAAoB;IAC/D,MAAM,WAAW,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;IAC3C,EAAE,CAAC,aAAa,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;AAClE,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,QAAgB;IACvC,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;IAC1C,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACnE,CAAC;AAED,MAAM,UAAU,WAAW,CACzB,OAAoB,EACpB,YAAoB,EACpB,IAAY,EACZ,IAAY,EACZ,SAAwB;IAExB,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,GAAG;QAC5B,IAAI;QACJ,IAAI;QACJ,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QAClC,SAAS;KACV,CAAC;IACF,OAAO,CAAC,QAAQ,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;AAC9C,CAAC;AAED,MAAM,UAAU,QAAQ,CACtB,OAAoB,EACpB,YAAoB;IAEpB,OAAO,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;AACrC,CAAC;AAED,MAAM,UAAU,WAAW,CACzB,OAAoB,EACpB,YAAoB;IAEpB,OAAO,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;AACrC,CAAC"}
+{"version":3,"file":"journal.js","sourceRoot":"","sources":["../src/journal.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,KAAK,MAAM,MAAM,QAAQ,CAAC;AAGjC,MAAM,mBAAmB,GAAG,eAAe,CAAC;AAC5C,MAAM,mBAAmB,GAAG,OAAO,CAAC;AAEpC;;;GAGG;AACH,MAAM,UAAU,WAAW;IACzB,OAAO,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,KAAK,CAAC,CAAC;AACpE,CAAC;AAED;;;;;GAKG;AACH,SAAS,YAAY,CAAC,IAAY;IAChC,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,iBAAiB,EAAE,GAAG,CAAC,CAAC;IACrD,IAAI,CAAC,OAAO,IAAI,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,kBAAkB,IAAI,oCAAoC,CAAC,CAAC;IAC9E,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,OAAO,IAAI,CAAC,IAAI,CACd,WAAW,EAAE,EACb,GAAG,mBAAmB,GAAG,YAAY,CAAC,IAAI,CAAC,GAAG,mBAAmB,EAAE,CACpE,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,IAAY;IACtC,MAAM,WAAW,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IACzC,IAAI,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QAC/B,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;QACtD,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAgB,CAAC;IAC5C,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;AACnD,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,IAAY,EAAE,OAAoB;IAC7D,MAAM,WAAW,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IACzC,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7D,EAAE,CAAC,aAAa,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;AAClE,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,QAAgB;IACvC,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;IAC1C,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACnE,CAAC;AAED,MAAM,UAAU,WAAW,CACzB,OAAoB,EACpB,YAAoB,EACpB,IAAY,EACZ,IAAY,EACZ,SAAwB;IAExB,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,GAAG;QAC5B,IAAI;QACJ,IAAI;QACJ,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QAClC,SAAS;KACV,CAAC;IACF,OAAO,CAAC,QAAQ,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;AAC9C,CAAC;AAED,MAAM,UAAU,QAAQ,CACtB,OAAoB,EACpB,YAAoB;IAEpB,OAAO,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;AACrC,CAAC;AAED,MAAM,UAAU,WAAW,CACzB,OAAoB,EACpB,YAAoB;IAEpB,OAAO,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;AACrC,CAAC"}

package/dist/journal.test.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Unit tests for the sync journal (ADR-0001 Phase 5).
+ *
+ * Verifies per-company isolation, HQ_STATE_DIR override, and filename
+ * sanitization — all behaviors that the pre-Phase-5 monolithic journal
+ * didn't need.
+ */
+export {};
+//# sourceMappingURL=journal.test.d.ts.map

package/dist/journal.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"journal.test.d.ts","sourceRoot":"","sources":["../src/journal.test.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG"}