@wrongstack/cli 0.305.0 → 0.306.0

package/dist/{hq-5G6D5YIU.js → hq-ZK6PGN3W.js}

@@ -1,9 +1,9 @@
-import {
-  resolveAuditActor
-} from "./chunk-Q5GTM25S.js";
 import {
   parseTokenTtlValue
 } from "./chunk-BGFM3PD7.js";
+import {
+  resolveAuditActor
+} from "./chunk-Q5GTM25S.js";
 import "./chunk-7OCVIDC7.js";
 
 // src/subcommands/handlers/hq.ts
@@ -28,6 +28,10 @@ function resolveDataDir(deps) {
 }
 var hqCmd = async (args, deps) => {
   const sub = args[0];
+  if (deps.flags?.["help"] === true && (!sub || sub === "serve")) {
+    printHelp(deps);
+    return 0;
+  }
   if (!sub || sub === "serve") {
     return startServer(deps);
   }
@@ -160,6 +164,10 @@ HQ auth loaded from ${handle.firstRunSetup.dataDir}
 }
 async function hqTokenCmd(args, deps) {
   const action = args[0];
+  if (deps.flags?.["help"] === true || action === "help" || action === "--help") {
+    printTokenHelp(deps);
+    return 0;
+  }
   if (action === "create") {
     return tokenCreate(args.slice(1), deps);
   }
@@ -171,17 +179,21 @@ async function hqTokenCmd(args, deps) {
   }
   deps.renderer.writeError(`Unknown hq token subcommand: ${action ?? "(none)"}
 `);
-  deps.renderer.write("Usage: wstack hq token <create|list|revoke>\n");
+  printTokenHelp(deps);
   return 1;
 }
 async function hqAuditCmd(args, deps) {
   const action = args[0];
+  if (deps.flags?.["help"] === true || action === "help" || action === "--help") {
+    printAuditHelp(deps);
+    return 0;
+  }
   if (action === "verify" || action === void 0) {
     return hqAuditVerify(deps);
   }
   deps.renderer.writeError(`Unknown hq audit subcommand: ${action ?? "(none)"}
 `);
-  deps.renderer.write("Usage: wstack hq audit <verify>\n");
+  printAuditHelp(deps);
   return 1;
 }
 async function hqAuditVerify(deps) {
@@ -608,8 +620,85 @@ function printHelp(deps) {
   deps.renderer.write(`auth.json schema version: ${HQ_AUTH_FILE_VERSION}.
 `);
 }
+function printTokenHelp(deps) {
+  deps.renderer.write(`Usage: wstack hq token <create | list | revoke>
+`);
+  deps.renderer.write("\n");
+  deps.renderer.write(
+    `  wstack hq token create [label] [--ttl <dur>]          Mint a browser token (enters token mode).
+`
+  );
+  deps.renderer.write(
+    `  wstack hq token create --client [label] [--ttl <dur>] Mint a client token (/ws/client).
+`
+  );
+  deps.renderer.write(`  wstack hq token list                                 List issued browser tokens (alias: ls).
+`);
+  deps.renderer.write(`  wstack hq token list --client                         List issued client tokens.
+`);
+  deps.renderer.write(
+    `  wstack hq token revoke <id>                           Revoke a browser token (id prefix match).
+`
+  );
+  deps.renderer.write(`  wstack hq token revoke --client <id>                  Revoke a client token.
+`);
+  deps.renderer.write("\n");
+  deps.renderer.write(`The token secret is printed once at create time and cannot be recovered
+`);
+  deps.renderer.write(`from auth.json (only its SHA-256 verifier is persisted). Tokens live in
+`);
+  deps.renderer.write(`<dataDir>/auth.json (default ~/.wrongstack/hq/auth.json).
+`);
+  deps.renderer.write("\n");
+  deps.renderer.write(`Flags:
+`);
+  deps.renderer.write(
+    `  --data-dir <path>   Override HQ data directory (default ~/.wrongstack/hq).
+`
+  );
+  deps.renderer.write(`  --client, -c        Operate on client tokens instead of browser tokens.
+`);
+  deps.renderer.write(
+    `  --capabilities <csv>  Comma-separated capability grants (browser: control.enqueue; client: telemetry.publish,control.execute).
+`
+  );
+  deps.renderer.write(
+    `  --ttl <duration>    Stamp an expiresAt on the token (e.g. --ttl 1h, --ttl 7d, --ttl 3600s).
+`
+  );
+  deps.renderer.write("\n");
+  deps.renderer.write(`Run \`wstack hq --help\` for the full HQ command list.
+`);
+}
+function printAuditHelp(deps) {
+  deps.renderer.write(`Usage: wstack hq audit <verify>
+`);
+  deps.renderer.write("\n");
+  deps.renderer.write(
+    `  wstack hq audit verify   Re-derive the SHA-256 contentHash from the current
+`
+  );
+  deps.renderer.write(
+    `                           auth.json and print it so an operator can compare
+`
+  );
+  deps.renderer.write(
+    `                           it against a contentHash field in an audit-log entry.
+`
+  );
+  deps.renderer.write("\n");
+  deps.renderer.write(`Flags:
+`);
+  deps.renderer.write(
+    `  --data-dir <path>   Override HQ data directory (default ~/.wrongstack/hq).
+`
+  );
+  deps.renderer.write("\n");
+  deps.renderer.write(`Run \`wstack hq --help\` for the full HQ command list.
+`);
+}
 export {
   hqCmd,
   resolveAuditActor
 };
-//# sourceMappingURL=hq-5G6D5YIU.js.map
+//# sourceMappingURL=hq-ZK6PGN3W.js.map