@indigoai-us/hq-cloud 5.1.0

package/dist/cli/invite.test.js

@@ -0,0 +1,175 @@
+/**
+ * invite CLI command tests (VLT-7 US-002).
+ */
+import { describe, it, expect, vi, beforeEach, afterEach } from "vitest";
+import { invite, listInvites, revokeInvite } from "./invite.js";
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+function jsonResponse(status, body) {
+    return new Response(JSON.stringify(body), {
+        status,
+        headers: { "Content-Type": "application/json" },
+    });
+}
+const VAULT_CONFIG = {
+    apiUrl: "https://vault.test.example.com",
+    authToken: "test-token",
+};
+let fetchSpy;
+beforeEach(() => {
+    fetchSpy = vi.spyOn(globalThis, "fetch");
+});
+afterEach(() => {
+    vi.restoreAllMocks();
+});
+// ---------------------------------------------------------------------------
+// invite()
+// ---------------------------------------------------------------------------
+describe("invite", () => {
+    it("creates invite for email target and returns magic link", async () => {
+        // First call: entity.findBySlug to resolve company
+        fetchSpy
+            .mockResolvedValueOnce(jsonResponse(200, { entity: { uid: "cmp_abc", slug: "acme", type: "company", status: "active" } }))
+            // Second call: createInvite
+            .mockResolvedValueOnce(jsonResponse(200, {
+            membership: { membershipKey: "psn_1#cmp_abc", role: "member", status: "pending" },
+            inviteToken: "tok_secure123",
+        }));
+        const result = await invite({
+            target: "alice@example.com",
+            role: "member",
+            company: "acme",
+            vaultConfig: VAULT_CONFIG,
+            callerUid: "psn_admin",
+        });
+        expect(result.magicLink).toBe("hq://accept/tok_secure123");
+        expect(result.inviteToken).toBe("tok_secure123");
+        expect(result.membership.status).toBe("pending");
+    });
+    it("creates invite for person UID target", async () => {
+        // Company is already a UID — no entity lookup needed
+        fetchSpy.mockResolvedValueOnce(jsonResponse(200, {
+            membership: { membershipKey: "psn_bob#cmp_abc", role: "admin", status: "pending" },
+            inviteToken: "tok_456",
+        }));
+        const result = await invite({
+            target: "psn_bob",
+            role: "admin",
+            company: "cmp_abc",
+            vaultConfig: VAULT_CONFIG,
+            callerUid: "psn_admin",
+        });
+        expect(result.magicLink).toBe("hq://accept/tok_456");
+        // Should have called createInvite with personUid, not inviteeEmail
+        const body = JSON.parse(fetchSpy.mock.calls[0][1]?.body);
+        expect(body.personUid).toBe("psn_bob");
+        expect(body.inviteeEmail).toBeUndefined();
+    });
+    it("rejects --paths without --role guest", async () => {
+        await expect(invite({
+            target: "alice@example.com",
+            role: "member",
+            paths: "docs/",
+            company: "acme",
+            vaultConfig: VAULT_CONFIG,
+            callerUid: "psn_admin",
+        })).rejects.toThrow("--paths is only valid with --role guest");
+    });
+    it("allows --paths with --role guest", async () => {
+        fetchSpy
+            .mockResolvedValueOnce(jsonResponse(200, { entity: { uid: "cmp_abc", slug: "acme", type: "company", status: "active" } }))
+            .mockResolvedValueOnce(jsonResponse(200, {
+            membership: { membershipKey: "psn_1#cmp_abc", role: "guest", status: "pending", allowedPrefixes: ["docs/", "shared/"] },
+            inviteToken: "tok_guest",
+        }));
+        const result = await invite({
+            target: "alice@example.com",
+            role: "guest",
+            paths: "docs/, shared/",
+            company: "acme",
+            vaultConfig: VAULT_CONFIG,
+            callerUid: "psn_admin",
+        });
+        expect(result.membership.allowedPrefixes).toEqual(["docs/", "shared/"]);
+        // Verify allowedPrefixes sent to API
+        const body = JSON.parse(fetchSpy.mock.calls[1][1]?.body);
+        expect(body.allowedPrefixes).toEqual(["docs/", "shared/"]);
+    });
+    it("maps VaultPermissionDeniedError to human-readable message", async () => {
+        fetchSpy
+            .mockResolvedValueOnce(jsonResponse(200, { entity: { uid: "cmp_abc", slug: "acme", type: "company", status: "active" } }))
+            .mockResolvedValueOnce(jsonResponse(403, { message: "Admin required" }));
+        await expect(invite({
+            target: "alice@example.com",
+            company: "acme",
+            vaultConfig: VAULT_CONFIG,
+            callerUid: "psn_member",
+        })).rejects.toThrow("Permission denied — only admins and owners can invite members");
+    });
+    it("throws when no company specified", async () => {
+        await expect(invite({
+            target: "alice@example.com",
+            vaultConfig: VAULT_CONFIG,
+            callerUid: "psn_admin",
+        })).rejects.toThrow("No company specified");
+    });
+    it("maps VaultConflictError to human-readable message", async () => {
+        fetchSpy
+            .mockResolvedValueOnce(jsonResponse(200, { entity: { uid: "cmp_abc", slug: "acme", type: "company", status: "active" } }))
+            .mockResolvedValueOnce(jsonResponse(409, { message: "Already exists" }));
+        await expect(invite({
+            target: "alice@example.com",
+            company: "acme",
+            vaultConfig: VAULT_CONFIG,
+            callerUid: "psn_admin",
+        })).rejects.toThrow("already has a membership or pending invite");
+    });
+});
+// ---------------------------------------------------------------------------
+// listInvites()
+// ---------------------------------------------------------------------------
+describe("listInvites", () => {
+    it("returns pending invites for a company", async () => {
+        fetchSpy
+            .mockResolvedValueOnce(jsonResponse(200, { entity: { uid: "cmp_abc", slug: "acme", type: "company", status: "active" } }))
+            .mockResolvedValueOnce(jsonResponse(200, {
+            invites: [
+                { membershipKey: "psn_1#cmp_abc", status: "pending", role: "member" },
+                { membershipKey: "psn_2#cmp_abc", status: "pending", role: "guest" },
+            ],
+        }));
+        const invites = await listInvites({
+            company: "acme",
+            vaultConfig: VAULT_CONFIG,
+            callerUid: "psn_admin",
+        });
+        expect(invites).toHaveLength(2);
+    });
+});
+// ---------------------------------------------------------------------------
+// revokeInvite()
+// ---------------------------------------------------------------------------
+describe("revokeInvite", () => {
+    it("revokes a pending invite", async () => {
+        fetchSpy
+            .mockResolvedValueOnce(jsonResponse(200, { entity: { uid: "cmp_abc", slug: "acme", type: "company", status: "active" } }))
+            .mockResolvedValueOnce(new Response(null, { status: 204 }));
+        await expect(revokeInvite({
+            tokenOrKey: "psn_1#cmp_abc",
+            company: "acme",
+            vaultConfig: VAULT_CONFIG,
+        })).resolves.toBeUndefined();
+    });
+    it("maps 404 to human-readable message", async () => {
+        fetchSpy
+            .mockResolvedValueOnce(jsonResponse(200, { entity: { uid: "cmp_abc", slug: "acme", type: "company", status: "active" } }))
+            .mockResolvedValueOnce(jsonResponse(404, { message: "Not found" }));
+        await expect(revokeInvite({
+            tokenOrKey: "psn_1#cmp_abc",
+            company: "acme",
+            vaultConfig: VAULT_CONFIG,
+        })).rejects.toThrow("Invite not found");
+    });
+});
+//# sourceMappingURL=invite.test.js.map

package/dist/cli/invite.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"invite.test.js","sourceRoot":"","sources":["../../src/cli/invite.test.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,SAAS,EAAqB,MAAM,QAAQ,CAAC;AAC5F,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAGhE,8EAA8E;AAC9E,UAAU;AACV,8EAA8E;AAE9E,SAAS,YAAY,CAAC,MAAc,EAAE,IAAa;IACjD,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE;QACxC,MAAM;QACN,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;KAChD,CAAC,CAAC;AACL,CAAC;AAED,MAAM,YAAY,GAAuB;IACvC,MAAM,EAAE,gCAAgC;IACxC,SAAS,EAAE,YAAY;CACxB,CAAC;AAEF,IAAI,QAAoC,CAAC;AAEzC,UAAU,CAAC,GAAG,EAAE;IACd,QAAQ,GAAG,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;AAC3C,CAAC,CAAC,CAAC;AAEH,SAAS,CAAC,GAAG,EAAE;IACb,EAAE,CAAC,eAAe,EAAE,CAAC;AACvB,CAAC,CAAC,CAAC;AAEH,8EAA8E;AAC9E,WAAW;AACX,8EAA8E;AAE9E,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE;IACtB,EAAE,CAAC,wDAAwD,EAAE,KAAK,IAAI,EAAE;QACtE,mDAAmD;QACnD,QAAQ;aACL,qBAAqB,CACpB,YAAY,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,CAAC,CACnG;YACD,4BAA4B;aAC3B,qBAAqB,CACpB,YAAY,CAAC,GAAG,EAAE;YAChB,UAAU,EAAE,EAAE,aAAa,EAAE,eAAe,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE;YACjF,WAAW,EAAE,eAAe;SAC7B,CAAC,CACH,CAAC;QAEJ,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC;YAC1B,MAAM,EAAE,mBAAmB;YAC3B,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,MAAM;YACf,WAAW,EAAE,YAAY;YACzB,SAAS,EAAE,WAAW;SACvB,CAAC,CAAC;QAEH,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;QAC3D,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QACjD,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sCAAsC,EAAE,KAAK,IAAI,EAAE;QACpD,qDAAqD;QACrD,QAAQ,CAAC,qBAAqB,CAC5B,YAAY,CAAC,GAAG,EAAE;YAChB,UAAU,EAAE,EAAE,aAAa,EAAE,iBAAiB,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE;YAClF,WAAW,EAAE,SAAS;SACvB,CAAC,CACH,CAAC;QAEF,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC;YAC1B,MAAM,EAAE,SAAS;YACjB,IAAI,EAAE,OAAO;YACb,OAAO,EAAE,SAAS;YAClB,WAAW,EAAE,YAAY;YACzB,SAAS,EAAE,WAAW;SACvB,CAAC,CAAC;QAEH,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;QAErD,mEAAmE;QACnE,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,IAAc,CAAC,CAAC;QACnE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACvC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,aAAa,EAAE,CAAC;IAC5C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sCAAsC,EAAE,KAAK,IAAI,EAAE;QACpD,MAAM,MAAM,CACV,MAAM,CAAC;YACL,MAAM,EAAE,mBAAmB;YAC3B,IAAI,EAAE,QAAQ;YACd,KAAK,EAAE,OAAO;YACd,OAAO,EAAE,MAAM;YACf,WAAW,EAAE,YAAY;YACzB,SAAS,EAAE,WAAW;SACvB,CAAC,CACH,CAAC,OAAO,CAAC,OAAO,CAAC,yCAAyC,CAAC,CAAC;IAC/D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kCAAkC,EAAE,KAAK,IAAI,EAAE;QAChD,QAAQ;aACL,qBAAqB,CACpB,YAAY,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,CAAC,CACnG;aACA,qBAAqB,CACpB,YAAY,CAAC,GAAG,EAAE;YAChB,UAAU,EAAE,EAAE,aAAa,EAAE,eAAe,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,eAAe,EAAE,CAAC,OAAO,EAAE,SAAS,CAAC,EAAE;YACvH,WAAW,EAAE,WAAW;SACzB,CAAC,CACH,CAAC;QAEJ,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC;YAC1B,MAAM,EAAE,mBAAmB;YAC3B,IAAI,EAAE,OAAO;YACb,KAAK,EAAE,gBAAgB;YACvB,OAAO,EAAE,MAAM;YACf,WAAW,EAAE,YAAY;YACzB,SAAS,EAAE,WAAW;SACvB,CAAC,CAAC;QAEH,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC;QAExE,qCAAqC;QACrC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,IAAc,CAAC,CAAC;QACnE,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC;IAC7D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2DAA2D,EAAE,KAAK,IAAI,EAAE;QACzE,QAAQ;aACL,qBAAqB,CACpB,YAAY,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,CAAC,CACnG;aACA,qBAAqB,CACpB,YAAY,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,gBAAgB,EAAE,CAAC,CACjD,CAAC;QAEJ,MAAM,MAAM,CACV,MAAM,CAAC;YACL,MAAM,EAAE,mBAAmB;YAC3B,OAAO,EAAE,MAAM;YACf,WAAW,EAAE,YAAY;YACzB,SAAS,EAAE,YAAY;SACxB,CAAC,CACH,CAAC,OAAO,CAAC,OAAO,CAAC,+DAA+D,CAAC,CAAC;IACrF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kCAAkC,EAAE,KAAK,IAAI,EAAE;QAChD,MAAM,MAAM,CACV,MAAM,CAAC;YACL,MAAM,EAAE,mBAAmB;YAC3B,WAAW,EAAE,YAAY;YACzB,SAAS,EAAE,WAAW;SACvB,CAAC,CACH,CAAC,OAAO,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mDAAmD,EAAE,KAAK,IAAI,EAAE;QACjE,QAAQ;aACL,qBAAqB,CACpB,YAAY,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,CAAC,CACnG;aACA,qBAAqB,CACpB,YAAY,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,gBAAgB,EAAE,CAAC,CACjD,CAAC;QAEJ,MAAM,MAAM,CACV,MAAM,CAAC;YACL,MAAM,EAAE,mBAAmB;YAC3B,OAAO,EAAE,MAAM;YACf,WAAW,EAAE,YAAY;YACzB,SAAS,EAAE,WAAW;SACvB,CAAC,CACH,CAAC,OAAO,CAAC,OAAO,CAAC,4CAA4C,CAAC,CAAC;IAClE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,8EAA8E;AAC9E,gBAAgB;AAChB,8EAA8E;AAE9E,QAAQ,CAAC,aAAa,EAAE,GAAG,EAAE;IAC3B,EAAE,CAAC,uCAAuC,EAAE,KAAK,IAAI,EAAE;QACrD,QAAQ;aACL,qBAAqB,CACpB,YAAY,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,CAAC,CACnG;aACA,qBAAqB,CACpB,YAAY,CAAC,GAAG,EAAE;YAChB,OAAO,EAAE;gBACP,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE;gBACrE,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE;aACrE;SACF,CAAC,CACH,CAAC;QAEJ,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC;YAChC,OAAO,EAAE,MAAM;YACf,WAAW,EAAE,YAAY;YACzB,SAAS,EAAE,WAAW;SACvB,CAAC,CAAC;QAEH,MAAM,CAAC,OAAO,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IAClC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,8EAA8E;AAC9E,iBAAiB;AACjB,8EAA8E;AAE9E,QAAQ,CAAC,cAAc,EAAE,GAAG,EAAE;IAC5B,EAAE,CAAC,0BAA0B,EAAE,KAAK,IAAI,EAAE;QACxC,QAAQ;aACL,qBAAqB,CACpB,YAAY,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,CAAC,CACnG;aACA,qBAAqB,CAAC,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;QAE9D,MAAM,MAAM,CACV,YAAY,CAAC;YACX,UAAU,EAAE,eAAe;YAC3B,OAAO,EAAE,MAAM;YACf,WAAW,EAAE,YAAY;SAC1B,CAAC,CACH,CAAC,QAAQ,CAAC,aAAa,EAAE,CAAC;IAC7B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oCAAoC,EAAE,KAAK,IAAI,EAAE;QAClD,QAAQ;aACL,qBAAqB,CACpB,YAAY,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,CAAC,CACnG;aACA,qBAAqB,CAAC,YAAY,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC;QAEtE,MAAM,MAAM,CACV,YAAY,CAAC;YACX,UAAU,EAAE,eAAe;YAC3B,OAAO,EAAE,MAAM;YACf,WAAW,EAAE,YAAY;SAC1B,CAAC,CACH,CAAC,OAAO,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/cli/promote.d.ts

@@ -0,0 +1,30 @@
+/**
+ * `hq promote` command — change an existing member's role (VLT-7 US-003).
+ *
+ * Admin+ only. Surfaces last-owner demotion errors as human messages.
+ */
+import type { VaultServiceConfig } from "../types.js";
+import type { MembershipRole, Membership } from "../vault-client.js";
+export interface PromoteOptions {
+    /** Person slug or UID of the member to promote */
+    target: string;
+    /** New role to assign */
+    newRole: MembershipRole;
+    /** Allowed prefixes (only valid with guest role) */
+    paths?: string;
+    /** Company slug or UID */
+    company?: string;
+    /** Caller's person UID */
+    callerUid: string;
+    /** Vault service config */
+    vaultConfig: VaultServiceConfig;
+}
+export interface PromoteResult {
+    membership: Membership;
+    previousRole?: MembershipRole;
+}
+/**
+ * Change a member's role.
+ */
+export declare function promote(options: PromoteOptions): Promise<PromoteResult>;
+//# sourceMappingURL=promote.d.ts.map

package/dist/cli/promote.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"promote.d.ts","sourceRoot":"","sources":["../../src/cli/promote.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAQtD,OAAO,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAErE,MAAM,WAAW,cAAc;IAC7B,kDAAkD;IAClD,MAAM,EAAE,MAAM,CAAC;IACf,yBAAyB;IACzB,OAAO,EAAE,cAAc,CAAC;IACxB,oDAAoD;IACpD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,0BAA0B;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,0BAA0B;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,2BAA2B;IAC3B,WAAW,EAAE,kBAAkB,CAAC;CACjC;AAED,MAAM,WAAW,aAAa;IAC5B,UAAU,EAAE,UAAU,CAAC;IACvB,YAAY,CAAC,EAAE,cAAc,CAAC;CAC/B;AAED;;GAEG;AACH,wBAAsB,OAAO,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC,CA6C7E"}

package/dist/cli/promote.js

@@ -0,0 +1,79 @@
+/**
+ * `hq promote` command — change an existing member's role (VLT-7 US-003).
+ *
+ * Admin+ only. Surfaces last-owner demotion errors as human messages.
+ */
+import { VaultClient, VaultAuthError, VaultPermissionDeniedError, VaultNotFoundError, VaultConflictError, } from "../vault-client.js";
+/**
+ * Change a member's role.
+ */
+export async function promote(options) {
+    const { target, newRole, paths, company, callerUid, vaultConfig } = options;
+    // Validate: --paths only with guest role
+    if (paths && newRole !== "guest") {
+        throw new Error("--paths is only valid with --role guest (allowedPrefixes are only meaningful for the guest role)");
+    }
+    const client = new VaultClient(vaultConfig);
+    // Resolve company UID
+    const companyUid = await resolveCompanyUid(client, company);
+    // Build membership key from target + company
+    const membershipKey = buildMembershipKey(target, companyUid);
+    const allowedPrefixes = paths
+        ? paths.split(",").map((p) => p.trim()).filter(Boolean)
+        : undefined;
+    try {
+        const membership = await client.updateRole({
+            membershipKey,
+            newRole,
+            allowedPrefixes,
+            updaterUid: callerUid,
+            companyUid,
+        });
+        return { membership };
+    }
+    catch (err) {
+        if (err instanceof VaultAuthError) {
+            throw new Error("Authentication failed — run `hq auth` to refresh your session");
+        }
+        if (err instanceof VaultPermissionDeniedError) {
+            throw new Error("Permission denied — only admins and owners can change member roles");
+        }
+        if (err instanceof VaultNotFoundError) {
+            throw new Error(`Member "${target}" not found in this company`);
+        }
+        if (err instanceof VaultConflictError) {
+            throw new Error("Cannot leave company without an owner — promote another member to owner first");
+        }
+        throw err;
+    }
+}
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+function buildMembershipKey(personRef, companyUid) {
+    // If already a composite key, use as-is
+    if (personRef.includes("#")) {
+        return personRef;
+    }
+    // Build composite key: personUid#companyUid
+    return `${personRef}#${companyUid}`;
+}
+async function resolveCompanyUid(client, companyRef) {
+    if (!companyRef) {
+        throw new Error("No company specified. Use --company <slug> or set up .hq/config.json");
+    }
+    if (companyRef.startsWith("cmp_")) {
+        return companyRef;
+    }
+    try {
+        const entity = await client.entity.findBySlug("company", companyRef);
+        return entity.uid;
+    }
+    catch (err) {
+        if (err instanceof VaultNotFoundError) {
+            throw new Error(`Company "${companyRef}" not found in the vault registry`);
+        }
+        throw err;
+    }
+}
+//# sourceMappingURL=promote.js.map

package/dist/cli/promote.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"promote.js","sourceRoot":"","sources":["../../src/cli/promote.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EACL,WAAW,EACX,cAAc,EACd,0BAA0B,EAC1B,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,oBAAoB,CAAC;AAuB5B;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,OAAuB;IACnD,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC;IAE5E,yCAAyC;IACzC,IAAI,KAAK,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,kGAAkG,CAAC,CAAC;IACtH,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,WAAW,CAAC,WAAW,CAAC,CAAC;IAE5C,sBAAsB;IACtB,MAAM,UAAU,GAAG,MAAM,iBAAiB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAE5D,6CAA6C;IAC7C,MAAM,aAAa,GAAG,kBAAkB,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAE7D,MAAM,eAAe,GAAG,KAAK;QAC3B,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;QACvD,CAAC,CAAC,SAAS,CAAC;IAEd,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC;YACzC,aAAa;YACb,OAAO;YACP,eAAe;YACf,UAAU,EAAE,SAAS;YACrB,UAAU;SACX,CAAC,CAAC;QAEH,OAAO,EAAE,UAAU,EAAE,CAAC;IACxB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,cAAc,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;QACnF,CAAC;QACD,IAAI,GAAG,YAAY,0BAA0B,EAAE,CAAC;YAC9C,MAAM,IAAI,KAAK,CAAC,oEAAoE,CAAC,CAAC;QACxF,CAAC;QACD,IAAI,GAAG,YAAY,kBAAkB,EAAE,CAAC;YACtC,MAAM,IAAI,KAAK,CAAC,WAAW,MAAM,6BAA6B,CAAC,CAAC;QAClE,CAAC;QACD,IAAI,GAAG,YAAY,kBAAkB,EAAE,CAAC;YACtC,MAAM,IAAI,KAAK,CAAC,+EAA+E,CAAC,CAAC;QACnG,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,UAAU;AACV,8EAA8E;AAE9E,SAAS,kBAAkB,CAAC,SAAiB,EAAE,UAAkB;IAC/D,wCAAwC;IACxC,IAAI,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5B,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,4CAA4C;IAC5C,OAAO,GAAG,SAAS,IAAI,UAAU,EAAE,CAAC;AACtC,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC9B,MAAmB,EACnB,UAAmB;IAEnB,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CACb,sEAAsE,CACvE,CAAC;IACJ,CAAC;IAED,IAAI,UAAU,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QAClC,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;QACrE,OAAO,MAAM,CAAC,GAAG,CAAC;IACpB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,kBAAkB,EAAE,CAAC;YACtC,MAAM,IAAI,KAAK,CAAC,YAAY,UAAU,mCAAmC,CAAC,CAAC;QAC7E,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC"}

package/dist/cli/share.d.ts

@@ -0,0 +1,33 @@
+/**
+ * `hq share` command — selective push to entity vault (VLT-5 US-002).
+ *
+ * Broadcasts local file(s) to the company's S3 vault bucket.
+ * Refuses to overwrite a newer remote version without prompting.
+ */
+import type { VaultServiceConfig } from "../types.js";
+import type { ConflictStrategy } from "./conflict.js";
+export interface ShareOptions {
+    /** Path(s) to share (files or directories) */
+    paths: string[];
+    /** Company slug or UID (defaults to active company from config) */
+    company?: string;
+    /** Optional message attached to journal entries */
+    message?: string;
+    /** Non-interactive conflict strategy */
+    onConflict?: ConflictStrategy;
+    /** Vault service config */
+    vaultConfig: VaultServiceConfig;
+    /** HQ root directory */
+    hqRoot: string;
+}
+export interface ShareResult {
+    filesUploaded: number;
+    bytesUploaded: number;
+    filesSkipped: number;
+    aborted: boolean;
+}
+/**
+ * Share local file(s) to the entity vault.
+ */
+export declare function share(options: ShareOptions): Promise<ShareResult>;
+//# sourceMappingURL=share.d.ts.map

package/dist/cli/share.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"share.d.ts","sourceRoot":"","sources":["../../src/cli/share.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAMtD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAEtD,MAAM,WAAW,YAAY;IAC3B,8CAA8C;IAC9C,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,mEAAmE;IACnE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,mDAAmD;IACnD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,wCAAwC;IACxC,UAAU,CAAC,EAAE,gBAAgB,CAAC;IAC9B,2BAA2B;IAC3B,WAAW,EAAE,kBAAkB,CAAC;IAChC,wBAAwB;IACxB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,WAAW;IAC1B,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,OAAO,CAAC;CAClB;AAED;;GAEG;AACH,wBAAsB,KAAK,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC,CA+FvE"}

package/dist/cli/share.js

@@ -0,0 +1,153 @@
+/**
+ * `hq share` command — selective push to entity vault (VLT-5 US-002).
+ *
+ * Broadcasts local file(s) to the company's S3 vault bucket.
+ * Refuses to overwrite a newer remote version without prompting.
+ */
+import * as fs from "fs";
+import * as path from "path";
+import { resolveEntityContext, isExpiringSoon, refreshEntityContext } from "../context.js";
+import { uploadFile, headRemoteFile } from "../s3.js";
+import { readJournal, writeJournal, hashFile, updateEntry } from "../journal.js";
+import { createIgnoreFilter, isWithinSizeLimit } from "../ignore.js";
+import { resolveConflict } from "./conflict.js";
+/**
+ * Share local file(s) to the entity vault.
+ */
+export async function share(options) {
+    const { paths, company, message, onConflict, vaultConfig, hqRoot } = options;
+    // Resolve company — slug, UID, or from active config
+    const companyRef = company ?? resolveActiveCompany(hqRoot);
+    if (!companyRef) {
+        throw new Error("No company specified and no active company found. " +
+            "Use --company <slug> or set up .hq/config.json.");
+    }
+    // Resolve entity context (handles STS vending + caching)
+    let ctx = await resolveEntityContext(companyRef, vaultConfig);
+    const shouldSync = createIgnoreFilter(hqRoot);
+    const journal = readJournal(hqRoot);
+    let filesUploaded = 0;
+    let bytesUploaded = 0;
+    let filesSkipped = 0;
+    // Collect all files to share
+    const filesToShare = collectFiles(paths, hqRoot, shouldSync);
+    for (const { absolutePath, relativePath } of filesToShare) {
+        if (!isWithinSizeLimit(absolutePath)) {
+            console.error(`  Skipped (too large): ${relativePath}`);
+            filesSkipped++;
+            continue;
+        }
+        // Auto-refresh context if credentials expiring
+        if (isExpiringSoon(ctx.expiresAt)) {
+            ctx = await refreshEntityContext(companyRef, vaultConfig);
+        }
+        // Check for remote conflict — refuse to overwrite newer remote version
+        const remoteMeta = await headRemoteFile(ctx, relativePath);
+        if (remoteMeta) {
+            const journalEntry = journal.files[relativePath];
+            const localHash = hashFile(absolutePath);
+            // If remote has changed since our last sync, it's a conflict
+            if (journalEntry && journalEntry.hash !== localHash) {
+                // Local has changes — check if remote also changed
+                const resolution = await resolveConflict({
+                    path: relativePath,
+                    localHash,
+                    remoteModified: remoteMeta.lastModified,
+                    direction: "push",
+                }, onConflict);
+                if (resolution === "abort") {
+                    return { filesUploaded, bytesUploaded, filesSkipped, aborted: true };
+                }
+                if (resolution === "keep" || resolution === "skip") {
+                    filesSkipped++;
+                    continue;
+                }
+                // "overwrite" falls through to upload
+            }
+        }
+        // Upload
+        try {
+            const stat = fs.statSync(absolutePath);
+            const hash = hashFile(absolutePath);
+            await uploadFile(ctx, absolutePath, relativePath);
+            // Update journal with optional message
+            updateEntry(journal, relativePath, hash, stat.size, "up");
+            if (message) {
+                journal.files[relativePath] = {
+                    ...journal.files[relativePath],
+                    message,
+                };
+            }
+            filesUploaded++;
+            bytesUploaded += stat.size;
+            console.log(`  ✓ ${relativePath}`);
+        }
+        catch (err) {
+            console.error(`  ✗ ${relativePath} — ${err instanceof Error ? err.message : err}`);
+        }
+    }
+    writeJournal(hqRoot, journal);
+    return { filesUploaded, bytesUploaded, filesSkipped, aborted: false };
+}
+/**
+ * Resolve active company from .hq/config.json or parent directory chain.
+ */
+function resolveActiveCompany(hqRoot) {
+    const configPath = path.join(hqRoot, ".hq", "config.json");
+    if (fs.existsSync(configPath)) {
+        try {
+            const config = JSON.parse(fs.readFileSync(configPath, "utf-8"));
+            return config.activeCompany ?? config.companySlug;
+        }
+        catch {
+            // Ignore parse errors
+        }
+    }
+    return undefined;
+}
+/**
+ * Collect files from paths (expanding directories recursively).
+ */
+function collectFiles(paths, hqRoot, filter) {
+    const results = [];
+    for (const p of paths) {
+        const absolutePath = path.isAbsolute(p) ? p : path.resolve(hqRoot, p);
+        if (!fs.existsSync(absolutePath)) {
+            console.error(`  Warning: ${p} does not exist, skipping.`);
+            continue;
+        }
+        const stat = fs.statSync(absolutePath);
+        if (stat.isDirectory()) {
+            results.push(...walkDir(absolutePath, hqRoot, filter));
+        }
+        else if (stat.isFile()) {
+            const relativePath = path.relative(hqRoot, absolutePath);
+            if (filter(absolutePath)) {
+                results.push({ absolutePath, relativePath });
+            }
+        }
+    }
+    return results;
+}
+function walkDir(dir, root, filter) {
+    const results = [];
+    if (!fs.existsSync(dir))
+        return results;
+    const entries = fs.readdirSync(dir, { withFileTypes: true });
+    for (const entry of entries) {
+        const absolutePath = path.join(dir, entry.name);
+        if (!filter(absolutePath))
+            continue;
+        if (entry.isDirectory()) {
+            results.push(...walkDir(absolutePath, root, filter));
+        }
+        else if (entry.isFile()) {
+            results.push({
+                absolutePath,
+                relativePath: path.relative(root, absolutePath),
+            });
+        }
+    }
+    return results;
+}
+//# sourceMappingURL=share.js.map

package/dist/cli/share.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"share.js","sourceRoot":"","sources":["../../src/cli/share.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAE7B,OAAO,EAAE,oBAAoB,EAAE,cAAc,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAC3F,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AACtD,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AACjF,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACrE,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAyBhD;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,KAAK,CAAC,OAAqB;IAC/C,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;IAE7E,qDAAqD;IACrD,MAAM,UAAU,GAAG,OAAO,IAAI,oBAAoB,CAAC,MAAM,CAAC,CAAC;IAC3D,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CACb,oDAAoD;YACpD,iDAAiD,CAClD,CAAC;IACJ,CAAC;IAED,yDAAyD;IACzD,IAAI,GAAG,GAAG,MAAM,oBAAoB,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;IAC9D,MAAM,UAAU,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;IAC9C,MAAM,OAAO,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;IAEpC,IAAI,aAAa,GAAG,CAAC,CAAC;IACtB,IAAI,aAAa,GAAG,CAAC,CAAC;IACtB,IAAI,YAAY,GAAG,CAAC,CAAC;IAErB,6BAA6B;IAC7B,MAAM,YAAY,GAAG,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;IAE7D,KAAK,MAAM,EAAE,YAAY,EAAE,YAAY,EAAE,IAAI,YAAY,EAAE,CAAC;QAC1D,IAAI,CAAC,iBAAiB,CAAC,YAAY,CAAC,EAAE,CAAC;YACrC,OAAO,CAAC,KAAK,CAAC,0BAA0B,YAAY,EAAE,CAAC,CAAC;YACxD,YAAY,EAAE,CAAC;YACf,SAAS;QACX,CAAC;QAED,+CAA+C;QAC/C,IAAI,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;YAClC,GAAG,GAAG,MAAM,oBAAoB,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;QAC5D,CAAC;QAED,uEAAuE;QACvE,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;QAC3D,IAAI,UAAU,EAAE,CAAC;YACf,MAAM,YAAY,GAAG,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;YACjD,MAAM,SAAS,GAAG,QAAQ,CAAC,YAAY,CAAC,CAAC;YAEzC,6DAA6D;YAC7D,IAAI,YAAY,IAAI,YAAY,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBACpD,mDAAmD;gBACnD,MAAM,UAAU,GAAG,MAAM,eAAe,CACtC;oBACE,IAAI,EAAE,YAAY;oBAClB,SAAS;oBACT,cAAc,EAAE,UAAU,CAAC,YAAY;oBACvC,SAAS,EAAE,MAAM;iBAClB,EACD,UAAU,CACX,CAAC;gBAEF,IAAI,UAAU,KAAK,OAAO,EAAE,CAAC;oBAC3B,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;gBACvE,CAAC;gBACD,IAAI,UAAU,KAAK,MAAM,IAAI,UAAU,KAAK,MAAM,EAAE,CAAC;oBACnD,YAAY,EAAE,CAAC;oBACf,SAAS;gBACX,CAAC;gBACD,sCAAsC;YACxC,CAAC;QACH,CAAC;QAED,SAAS;QACT,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;YACvC,MAAM,IAAI,GAAG,QAAQ,CAAC,YAAY,CAAC,CAAC;YAEpC,MAAM,UAAU,CAAC,GAAG,EAAE,YAAY,EAAE,YAAY,CAAC,CAAC;YAElD,uCAAuC;YACvC,WAAW,CAAC,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YAC1D,IAAI,OAAO,EAAE,CAAC;gBACZ,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,GAAG;oBAC5B,GAAG,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC;oBAC9B,OAAO;iBAC8C,CAAC;YAC1D,CAAC;YAED,aAAa,EAAE,CAAC;YAChB,aAAa,IAAI,IAAI,CAAC,IAAI,CAAC;YAC3B,OAAO,CAAC,GAAG,CAAC,OAAO,YAAY,EAAE,CAAC,CAAC;QACrC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CACX,OAAO,YAAY,MAAM,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,CACpE,CAAC;QACJ,CAAC;IACH,CAAC;IAED,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAE9B,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,YAAY,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AACxE,CAAC;AAED;;GAEG;AACH,SAAS,oBAAoB,CAAC,MAAc;IAC1C,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,aAAa,CAAC,CAAC;IAC3D,IAAI,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC9B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;YAChE,OAAO,MAAM,CAAC,aAAa,IAAI,MAAM,CAAC,WAAW,CAAC;QACpD,CAAC;QAAC,MAAM,CAAC;YACP,sBAAsB;QACxB,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;GAEG;AACH,SAAS,YAAY,CACnB,KAAe,EACf,MAAc,EACd,MAA8B;IAE9B,MAAM,OAAO,GAAqD,EAAE,CAAC;IAErE,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,MAAM,YAAY,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QAEtE,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;YACjC,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC,4BAA4B,CAAC,CAAC;YAC3D,SAAS;QACX,CAAC;QAED,MAAM,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;QACvC,IAAI,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;YACvB,OAAO,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,YAAY,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;QACzD,CAAC;aAAM,IAAI,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;YACzB,MAAM,YAAY,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;YACzD,IAAI,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC;gBACzB,OAAO,CAAC,IAAI,CAAC,EAAE,YAAY,EAAE,YAAY,EAAE,CAAC,CAAC;YAC/C,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,OAAO,CACd,GAAW,EACX,IAAY,EACZ,MAA8B;IAE9B,MAAM,OAAO,GAAqD,EAAE,CAAC;IACrE,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,OAAO,CAAC;IAExC,MAAM,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7D,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAChD,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC;YAAE,SAAS;QAEpC,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YACxB,OAAO,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,YAAY,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;QACvD,CAAC;aAAM,IAAI,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;YAC1B,OAAO,CAAC,IAAI,CAAC;gBACX,YAAY;gBACZ,YAAY,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;aAChD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/cli/share.test.d.ts

@@ -0,0 +1,5 @@
+/**
+ * Unit tests for hq share command (VLT-5 US-002).
+ */
+export {};
+//# sourceMappingURL=share.test.d.ts.map

package/dist/cli/share.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"share.test.d.ts","sourceRoot":"","sources":["../../src/cli/share.test.ts"],"names":[],"mappings":"AAAA;;GAEG"}

package/dist/cli/share.test.js

@@ -0,0 +1,121 @@
+/**
+ * Unit tests for hq share command (VLT-5 US-002).
+ */
+import { describe, it, expect, beforeEach, afterEach, vi } from "vitest";
+import * as fs from "fs";
+import * as path from "path";
+import * as os from "os";
+import { clearContextCache } from "../context.js";
+// Mock s3 module at the top level
+vi.mock("../s3.js", () => ({
+    uploadFile: vi.fn().mockResolvedValue(undefined),
+    downloadFile: vi.fn().mockResolvedValue(undefined),
+    listRemoteFiles: vi.fn().mockResolvedValue([]),
+    deleteRemoteFile: vi.fn().mockResolvedValue(undefined),
+    headRemoteFile: vi.fn().mockResolvedValue(null),
+}));
+import { share } from "./share.js";
+import { headRemoteFile } from "../s3.js";
+const mockConfig = {
+    apiUrl: "https://vault-api.test",
+    authToken: "test-jwt-token",
+    region: "us-east-1",
+};
+const mockEntity = {
+    uid: "cmp_01ABCDEF",
+    slug: "acme",
+    bucketName: "hq-vault-acme-123",
+    status: "active",
+};
+const mockVendResponse = {
+    credentials: {
+        accessKeyId: "ASIA_TEST_KEY",
+        secretAccessKey: "test-secret",
+        sessionToken: "test-session-token",
+        expiration: new Date(Date.now() + 15 * 60 * 1000).toISOString(),
+    },
+    expiresAt: new Date(Date.now() + 15 * 60 * 1000).toISOString(),
+};
+function setupFetchMock() {
+    const fetchMock = vi.fn().mockImplementation(async (url) => {
+        const urlStr = String(url);
+        if (urlStr.includes("/entity/by-slug/")) {
+            return { ok: true, status: 200, json: async () => ({ entity: mockEntity }), text: async () => "" };
+        }
+        if (urlStr.includes("/sts/vend")) {
+            return { ok: true, status: 200, json: async () => mockVendResponse, text: async () => "" };
+        }
+        return { ok: false, status: 404, text: async () => "Not found" };
+    });
+    vi.stubGlobal("fetch", fetchMock);
+    return fetchMock;
+}
+describe("share", () => {
+    let tmpDir;
+    beforeEach(() => {
+        clearContextCache();
+        tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), "hq-share-test-"));
+        setupFetchMock();
+        vi.mocked(headRemoteFile).mockResolvedValue(null);
+    });
+    afterEach(() => {
+        vi.restoreAllMocks();
+        fs.rmSync(tmpDir, { recursive: true, force: true });
+    });
+    it("shares a single file", async () => {
+        const testFile = path.join(tmpDir, "test.md");
+        fs.writeFileSync(testFile, "# Hello World");
+        const result = await share({
+            paths: [testFile],
+            company: "acme",
+            vaultConfig: mockConfig,
+            hqRoot: tmpDir,
+        });
+        expect(result.filesUploaded).toBe(1);
+        expect(result.aborted).toBe(false);
+    });
+    it("respects ignore rules", async () => {
+        fs.mkdirSync(path.join(tmpDir, ".git"));
+        fs.writeFileSync(path.join(tmpDir, ".git", "config"), "git config");
+        fs.writeFileSync(path.join(tmpDir, "readme.md"), "readme");
+        const result = await share({
+            paths: [tmpDir],
+            company: "acme",
+            vaultConfig: mockConfig,
+            hqRoot: tmpDir,
+        });
+        expect(result.filesUploaded).toBe(1);
+    });
+    it("shares a directory of files", async () => {
+        fs.mkdirSync(path.join(tmpDir, "docs"));
+        fs.writeFileSync(path.join(tmpDir, "docs", "a.md"), "doc a");
+        fs.writeFileSync(path.join(tmpDir, "docs", "b.md"), "doc b");
+        const result = await share({
+            paths: [path.join(tmpDir, "docs")],
+            company: "acme",
+            vaultConfig: mockConfig,
+            hqRoot: tmpDir,
+        });
+        expect(result.filesUploaded).toBe(2);
+    });
+    it("throws when no company specified and no active company", async () => {
+        fs.writeFileSync(path.join(tmpDir, "test.md"), "test");
+        await expect(share({
+            paths: [path.join(tmpDir, "test.md")],
+            vaultConfig: mockConfig,
+            hqRoot: tmpDir,
+        })).rejects.toThrow(/No company specified/);
+    });
+    it("resolves active company from .hq/config.json", async () => {
+        fs.mkdirSync(path.join(tmpDir, ".hq"), { recursive: true });
+        fs.writeFileSync(path.join(tmpDir, ".hq", "config.json"), JSON.stringify({ activeCompany: "acme" }));
+        fs.writeFileSync(path.join(tmpDir, "test.md"), "test");
+        const result = await share({
+            paths: [path.join(tmpDir, "test.md")],
+            vaultConfig: mockConfig,
+            hqRoot: tmpDir,
+        });
+        expect(result.filesUploaded).toBe(1);
+    });
+});
+//# sourceMappingURL=share.test.js.map

package/dist/cli/share.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"share.test.js","sourceRoot":"","sources":["../../src/cli/share.test.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AACzE,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAGlD,kCAAkC;AAClC,EAAE,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;IACzB,UAAU,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,SAAS,CAAC;IAChD,YAAY,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,SAAS,CAAC;IAClD,eAAe,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,EAAE,CAAC;IAC9C,gBAAgB,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,SAAS,CAAC;IACtD,cAAc,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC;CAChD,CAAC,CAAC,CAAC;AAEJ,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AACnC,OAAO,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAE1C,MAAM,UAAU,GAAuB;IACrC,MAAM,EAAE,wBAAwB;IAChC,SAAS,EAAE,gBAAgB;IAC3B,MAAM,EAAE,WAAW;CACpB,CAAC;AAEF,MAAM,UAAU,GAAG;IACjB,GAAG,EAAE,cAAc;IACnB,IAAI,EAAE,MAAM;IACZ,UAAU,EAAE,mBAAmB;IAC/B,MAAM,EAAE,QAAQ;CACjB,CAAC;AAEF,MAAM,gBAAgB,GAAG;IACvB,WAAW,EAAE;QACX,WAAW,EAAE,eAAe;QAC5B,eAAe,EAAE,aAAa;QAC9B,YAAY,EAAE,oBAAoB;QAClC,UAAU,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE;KAChE;IACD,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE;CAC/D,CAAC;AAEF,SAAS,cAAc;IACrB,MAAM,SAAS,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,KAAK,EAAE,GAAW,EAAE,EAAE;QACjE,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QAC3B,IAAI,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;YACxC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,EAAE,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC;QACrG,CAAC;QACD,IAAI,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;YACjC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,gBAAgB,EAAE,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC;QAC7F,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACnE,CAAC,CAAC,CAAC;IACH,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IAClC,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,QAAQ,CAAC,OAAO,EAAE,GAAG,EAAE;IACrB,IAAI,MAAc,CAAC;IAEnB,UAAU,CAAC,GAAG,EAAE;QACd,iBAAiB,EAAE,CAAC;QACpB,MAAM,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,gBAAgB,CAAC,CAAC,CAAC;QAClE,cAAc,EAAE,CAAC;QACjB,EAAE,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC,GAAG,EAAE;QACb,EAAE,CAAC,eAAe,EAAE,CAAC;QACrB,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sBAAsB,EAAE,KAAK,IAAI,EAAE;QACpC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QAC9C,EAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;QAE5C,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC;YACzB,KAAK,EAAE,CAAC,QAAQ,CAAC;YACjB,OAAO,EAAE,MAAM;YACf,WAAW,EAAE,UAAU;YACvB,MAAM,EAAE,MAAM;SACf,CAAC,CAAC;QAEH,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACrC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uBAAuB,EAAE,KAAK,IAAI,EAAE;QACrC,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;QACxC,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,YAAY,CAAC,CAAC;QACpE,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,EAAE,QAAQ,CAAC,CAAC;QAE3D,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC;YACzB,KAAK,EAAE,CAAC,MAAM,CAAC;YACf,OAAO,EAAE,MAAM;YACf,WAAW,EAAE,UAAU;YACvB,MAAM,EAAE,MAAM;SACf,CAAC,CAAC;QAEH,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6BAA6B,EAAE,KAAK,IAAI,EAAE;QAC3C,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;QACxC,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,CAAC,CAAC;QAC7D,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,CAAC,CAAC;QAE7D,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC;YACzB,KAAK,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YAClC,OAAO,EAAE,MAAM;YACf,WAAW,EAAE,UAAU;YACvB,MAAM,EAAE,MAAM;SACf,CAAC,CAAC;QAEH,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wDAAwD,EAAE,KAAK,IAAI,EAAE;QACtE,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,CAAC,CAAC;QAEvD,MAAM,MAAM,CACV,KAAK,CAAC;YACJ,KAAK,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;YACrC,WAAW,EAAE,UAAU;YACvB,MAAM,EAAE,MAAM;SACf,CAAC,CACH,CAAC,OAAO,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8CAA8C,EAAE,KAAK,IAAI,EAAE;QAC5D,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5D,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,aAAa,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;QACrG,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,CAAC,CAAC;QAEvD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC;YACzB,KAAK,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;YACrC,WAAW,EAAE,UAAU;YACvB,MAAM,EAAE,MAAM;SACf,CAAC,CAAC;QAEH,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}