create-hq 10.0.0 → 10.7.0

package/dist/auth.js

@@ -1,44 +1,56 @@
 /**
- * Auth utilities for create-hq — OAuth PKCE flow for Clerk (US-008)
+ * GitHub App device flow auth for create-hq.
  *
- * Reuses the same patterns as hq-cli/src/utils/auth.ts and
- * hq-cli/src/utils/token-store.ts but bundled inline so create-hq
- * has no dependency on @indigoai-us/hq-cli.
+ * Talks directly to github.com — no backend involved.
+ *
+ * Flow:
+ *   1. POST github.com/login/device/code with our App's client_id
+ *   2. Display user_code, open verification_uri in browser
+ *   3. Poll github.com/login/oauth/access_token at the GitHub-specified interval
+ *   4. On success: GET api.github.com/user → store { access_token, login, id, name, email }
+ *
+ * Token is stored at ~/.hq/credentials.json (mode 0600). Tokens are
+ * GitHub App user-to-server tokens (ghu_…), so they ignore OAuth scopes —
+ * permissions are configured on the App settings page.
  *
  * Token values are NEVER written to stdout or logs.
  */
-import * as crypto from "crypto";
-import * as http from "http";
 import * as fs from "fs";
 import * as path from "path";
 import * as os from "os";
 import { exec } from "child_process";
+import chalk from "chalk";
+// ─── Constants ──────────────────────────────────────────────────────────────
+/** hq-team-sync GitHub App client ID (public — safe to commit). */
+export const HQ_GITHUB_APP_CLIENT_ID = "Iv23liSdkCBQYhrNcRmI";
+export const HQ_GITHUB_APP_SLUG = "hq-team-sync";
+const GITHUB_DEVICE_CODE_URL = "https://github.com/login/device/code";
+const GITHUB_TOKEN_URL = "https://github.com/login/oauth/access_token";
+const GITHUB_API_USER_URL = "https://api.github.com/user";
 const HQ_DIR = path.join(os.homedir(), ".hq");
-const AUTH_FILE = path.join(HQ_DIR, "auth.json");
-// ─── Token store ─────────────────────────────────────────────────────────────
+const CREDENTIALS_FILE = path.join(HQ_DIR, "credentials.json");
+// ─── Token store ────────────────────────────────────────────────────────────
 function ensureHqDir() {
     if (!fs.existsSync(HQ_DIR)) {
         fs.mkdirSync(HQ_DIR, { recursive: true, mode: 0o700 });
     }
 }
-/** Save auth token to ~/.hq/auth.json with 0600 permissions. */
-export function saveToken(token) {
+/** Save credentials to ~/.hq/credentials.json with 0600 perms. */
+export function saveGitHubAuth(auth) {
     ensureHqDir();
-    const content = JSON.stringify(token, null, 2);
-    fs.writeFileSync(AUTH_FILE, content, { mode: 0o600 });
+    fs.writeFileSync(CREDENTIALS_FILE, JSON.stringify(auth, null, 2), {
+        mode: 0o600,
+    });
 }
-/** Load auth token from ~/.hq/auth.json. Returns null if missing/invalid. */
-export function loadToken() {
+/** Load credentials, or null if missing/invalid. */
+export function loadGitHubAuth() {
     try {
-        if (!fs.existsSync(AUTH_FILE)) {
+        if (!fs.existsSync(CREDENTIALS_FILE))
             return null;
-        }
-        const content = fs.readFileSync(AUTH_FILE, "utf-8");
-        const parsed = JSON.parse(content);
-        if (typeof parsed.clerk_session_token !== "string" ||
-            typeof parsed.user_id !== "string" ||
-            typeof parsed.email !== "string" ||
-            typeof parsed.expires_at !== "string") {
+        const parsed = JSON.parse(fs.readFileSync(CREDENTIALS_FILE, "utf-8"));
+        if (typeof parsed.access_token !== "string" ||
+            typeof parsed.login !== "string" ||
+            typeof parsed.id !== "number") {
             return null;
         }
         return parsed;
@@ -47,110 +59,201 @@ export function loadToken() {
         return null;
     }
 }
-/** Check if a token is expired or within 5 minutes of expiry. */
-export function isTokenExpired(token) {
-    const expiresAt = new Date(token.expires_at).getTime();
-    const bufferMs = 5 * 60 * 1000;
-    return Date.now() >= expiresAt - bufferMs;
-}
-// ─── PKCE helpers ────────────────────────────────────────────────────────────
-function generateCodeVerifier() {
-    return crypto.randomBytes(32).toString("base64url");
+/** Remove stored credentials. */
+export function clearGitHubAuth() {
+    try {
+        if (fs.existsSync(CREDENTIALS_FILE)) {
+            fs.unlinkSync(CREDENTIALS_FILE);
+        }
+    }
+    catch {
+        // ignore
+    }
 }
-function generateCodeChallenge(verifier) {
-    return crypto.createHash("sha256").update(verifier).digest("base64url");
+/**
+ * Quick liveness probe — does the stored token still work?
+ * Calls api.github.com/user with the token; returns true on 200.
+ */
+export async function isGitHubAuthValid(auth) {
+    try {
+        const res = await fetch(GITHUB_API_USER_URL, {
+            headers: {
+                Authorization: `token ${auth.access_token}`,
+                Accept: "application/vnd.github+json",
+                "User-Agent": "create-hq",
+            },
+            signal: AbortSignal.timeout(10_000),
+        });
+        return res.ok;
+    }
+    catch {
+        return false;
+    }
 }
-function openBrowser(url) {
-    const command = process.platform === "darwin" ? `open "${url}"` : `xdg-open "${url}"`;
+// ─── Browser open (cross-platform) ──────────────────────────────────────────
+/** Open a URL in the user's default browser. Best-effort, never throws. */
+export function openBrowser(url) {
+    let command;
+    if (process.platform === "darwin") {
+        command = `open "${url}"`;
+    }
+    else if (process.platform === "win32") {
+        // Windows: `start` is a cmd.exe builtin. The empty quotes are the
+        // window title argument (start treats the first quoted arg as title).
+        command = `start "" "${url}"`;
+    }
+    else {
+        command = `xdg-open "${url}"`;
+    }
     exec(command, (err) => {
         if (err) {
-            console.error(`Could not open browser automatically. Please visit:\n  ${url}`);
+            console.error(chalk.dim(`  (could not open browser automatically — visit ${url} manually)`));
         }
     });
 }
-// ─── Auth flow ───────────────────────────────────────────────────────────────
+// ─── Device flow ────────────────────────────────────────────────────────────
+function sleep(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
 /**
- * Start the OAuth PKCE auth flow:
- * 1. Generate PKCE code_verifier + code_challenge
- * 2. Start local HTTP server on a random port for the callback
- * 3. Open browser to Clerk auth URL
- * 4. Wait for callback with auth code
- * 5. Exchange code for token via registry /auth/token endpoint
- * 6. Save token and return AuthToken
+ * Run the GitHub App device authorization flow.
+ *
+ * Throws on:
+ *   - Network errors talking to github.com
+ *   - User-denied authorization (access_denied)
+ *   - Device code expiration
+ *   - Failure to fetch the user profile
  */
-export async function startAuthFlow(registryUrl) {
-    const codeVerifier = generateCodeVerifier();
-    const codeChallenge = generateCodeChallenge(codeVerifier);
-    return new Promise((resolve, reject) => {
-        const server = http.createServer(async (req, res) => {
-            try {
-                const url = new URL(req.url ?? "/", "http://localhost");
-                if (url.pathname !== "/callback") {
-                    res.writeHead(404);
-                    res.end("Not found");
-                    return;
-                }
-                const code = url.searchParams.get("code");
-                const error = url.searchParams.get("error");
-                if (error) {
-                    res.writeHead(200, { "Content-Type": "text/html" });
-                    res.end("<html><body><h2>Authentication failed</h2><p>You can close this window.</p></body></html>");
-                    server.close();
-                    reject(new Error(`Auth failed: ${error}`));
-                    return;
-                }
-                if (!code) {
-                    res.writeHead(400, { "Content-Type": "text/html" });
-                    res.end("<html><body><h2>Missing auth code</h2><p>You can close this window.</p></body></html>");
-                    server.close();
-                    reject(new Error("No authorization code received"));
-                    return;
-                }
-                // Exchange code for token
-                const tokenResponse = await fetch(`${registryUrl}/auth/token`, {
-                    method: "POST",
-                    headers: { "Content-Type": "application/json" },
-                    body: JSON.stringify({
-                        code,
-                        code_verifier: codeVerifier,
-                        redirect_uri: `http://localhost:${server.address().port}/callback`,
-                    }),
-                });
-                if (!tokenResponse.ok) {
-                    const body = await tokenResponse.text();
-                    res.writeHead(200, { "Content-Type": "text/html" });
-                    res.end("<html><body><h2>Token exchange failed</h2><p>You can close this window.</p></body></html>");
-                    server.close();
-                    reject(new Error(`Token exchange failed (${tokenResponse.status}): ${body}`));
-                    return;
-                }
-                const tokenData = (await tokenResponse.json());
-                // Save token to ~/.hq/auth.json
-                saveToken(tokenData);
-                res.writeHead(200, { "Content-Type": "text/html" });
-                res.end("<html><body><h2>Authenticated!</h2><p>You can close this window and return to the terminal.</p></body></html>");
-                server.close();
-                resolve(tokenData);
-            }
-            catch (err) {
-                server.close();
-                reject(err);
-            }
-        });
-        // Listen on random port
-        server.listen(0, "127.0.0.1", () => {
-            const addr = server.address();
-            const redirectUri = `http://localhost:${addr.port}/callback`;
-            const authUrl = `${registryUrl}/auth/login?redirect_uri=${encodeURIComponent(redirectUri)}&code_challenge=${codeChallenge}&code_challenge_method=S256`;
-            console.log("  Opening browser for authentication...");
-            openBrowser(authUrl);
-            console.log(`\n  If the browser doesn't open, visit:\n  ${authUrl}\n`);
+export async function startGitHubDeviceFlow() {
+    // 1. Request a device code
+    const deviceRes = await fetch(GITHUB_DEVICE_CODE_URL, {
+        method: "POST",
+        headers: {
+            Accept: "application/json",
+            "Content-Type": "application/json",
+            "User-Agent": "create-hq",
+        },
+        body: JSON.stringify({
+            client_id: HQ_GITHUB_APP_CLIENT_ID,
+        }),
+        signal: AbortSignal.timeout(15_000),
+    });
+    if (!deviceRes.ok) {
+        const body = await deviceRes.text().catch(() => "");
+        throw new Error(`GitHub device code request failed (${deviceRes.status}): ${body}`);
+    }
+    const device = (await deviceRes.json());
+    // 2. Display the code and open the browser
+    console.log();
+    console.log(chalk.bold("  Sign in with GitHub"));
+    console.log();
+    console.log(`  Open this URL in your browser:`);
+    console.log(`  ${chalk.cyan(device.verification_uri)}`);
+    console.log();
+    console.log(`  Enter this code: ${chalk.bold.white(device.user_code)}`);
+    console.log();
+    console.log(chalk.dim("  Waiting for authorization..."));
+    openBrowser(device.verification_uri);
+    // 3. Poll for token
+    let pollInterval = Math.max((device.interval ?? 5) * 1000, 5000);
+    const expiresAt = Date.now() + (device.expires_in ?? 900) * 1000;
+    while (Date.now() < expiresAt) {
+        await sleep(pollInterval);
+        let tokenRes;
+        try {
+            tokenRes = await fetch(GITHUB_TOKEN_URL, {
+                method: "POST",
+                headers: {
+                    Accept: "application/json",
+                    "Content-Type": "application/json",
+                    "User-Agent": "create-hq",
+                },
+                body: JSON.stringify({
+                    client_id: HQ_GITHUB_APP_CLIENT_ID,
+                    device_code: device.device_code,
+                    grant_type: "urn:ietf:params:oauth:grant-type:device_code",
+                }),
+                signal: AbortSignal.timeout(15_000),
+            });
+        }
+        catch {
+            // Network blip — keep polling
+            continue;
+        }
+        const data = (await tokenRes.json().catch(() => ({})));
+        if (data.error === "authorization_pending")
+            continue;
+        if (data.error === "slow_down") {
+            // Per spec: increase polling interval by at least 5 seconds
+            const bump = (data.interval ?? 5) * 1000;
+            pollInterval = Math.max(pollInterval + bump, pollInterval + 5000);
+            continue;
+        }
+        if (data.error === "expired_token") {
+            throw new Error("GitHub device code expired — please run create-hq again");
+        }
+        if (data.error === "access_denied") {
+            throw new Error("Authorization was denied");
+        }
+        if (data.error) {
+            throw new Error(`GitHub auth error: ${data.error}${data.error_description ? ` — ${data.error_description}` : ""}`);
+        }
+        if (!data.access_token) {
+            throw new Error("GitHub returned no access_token");
+        }
+        // 4. Fetch the authenticated user profile
+        const userRes = await fetch(GITHUB_API_USER_URL, {
+            headers: {
+                Authorization: `token ${data.access_token}`,
+                Accept: "application/vnd.github+json",
+                "User-Agent": "create-hq",
+            },
+            signal: AbortSignal.timeout(15_000),
         });
-        // Timeout after 2 minutes
-        setTimeout(() => {
-            server.close();
-            reject(new Error("Authentication timed out after 2 minutes"));
-        }, 120_000);
+        if (!userRes.ok) {
+            const body = await userRes.text().catch(() => "");
+            throw new Error(`Failed to fetch GitHub user (${userRes.status}): ${body}`);
+        }
+        const user = (await userRes.json());
+        const auth = {
+            access_token: data.access_token,
+            login: user.login,
+            id: user.id,
+            name: user.name,
+            email: user.email,
+            issued_at: new Date().toISOString(),
+        };
+        saveGitHubAuth(auth);
+        return auth;
+    }
+    throw new Error("GitHub device flow timed out — please try again");
+}
+// ─── GitHub API helpers used by downstream flows ────────────────────────────
+/**
+ * Authenticated fetch against api.github.com. Throws on non-2xx with
+ * the response body included for diagnostics.
+ */
+export async function githubApi(pathname, auth, init = {}) {
+    const url = pathname.startsWith("https://")
+        ? pathname
+        : `https://api.github.com${pathname.startsWith("/") ? "" : "/"}${pathname}`;
+    const res = await fetch(url, {
+        ...init,
+        headers: {
+            Authorization: `token ${auth.access_token}`,
+            Accept: "application/vnd.github+json",
+            "User-Agent": "create-hq",
+            ...(init.headers || {}),
+        },
+        signal: init.signal ?? AbortSignal.timeout(20_000),
     });
+    if (!res.ok) {
+        const body = await res.text().catch(() => "");
+        throw new Error(`GitHub API ${res.status} ${pathname}: ${body}`);
+    }
+    // Some endpoints return 204
+    if (res.status === 204)
+        return undefined;
+    return (await res.json());
 }
 //# sourceMappingURL=auth.js.map

package/dist/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,MAAM,MAAM,QAAQ,CAAC;AACjC,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAWrC,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,KAAK,CAAC,CAAC;AAC9C,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;AAEjD,gFAAgF;AAEhF,SAAS,WAAW;IAClB,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3B,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACzD,CAAC;AACH,CAAC;AAED,gEAAgE;AAChE,MAAM,UAAU,SAAS,CAAC,KAAgB;IACxC,WAAW,EAAE,CAAC;IACd,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAC/C,EAAE,CAAC,aAAa,CAAC,SAAS,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;AACxD,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,SAAS;IACvB,IAAI,CAAC;QACH,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC9B,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QACpD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAEnC,IACE,OAAO,MAAM,CAAC,mBAAmB,KAAK,QAAQ;YAC9C,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ;YAClC,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ;YAChC,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ,EACrC,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,MAAmB,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,cAAc,CAAC,KAAgB;IAC7C,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,CAAC;IACvD,MAAM,QAAQ,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;IAC/B,OAAO,IAAI,CAAC,GAAG,EAAE,IAAI,SAAS,GAAG,QAAQ,CAAC;AAC5C,CAAC;AAED,gFAAgF;AAEhF,SAAS,oBAAoB;IAC3B,OAAO,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AACtD,CAAC;AAED,SAAS,qBAAqB,CAAC,QAAgB;IAC7C,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;AAC1E,CAAC;AAED,SAAS,WAAW,CAAC,GAAW;IAC9B,MAAM,OAAO,GACX,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,GAAG,GAAG,CAAC,CAAC,CAAC,aAAa,GAAG,GAAG,CAAC;IACxE,IAAI,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;QACpB,IAAI,GAAG,EAAE,CAAC;YACR,OAAO,CAAC,KAAK,CACX,0DAA0D,GAAG,EAAE,CAChE,CAAC;QACJ,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED,gFAAgF;AAEhF;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,WAAmB;IACrD,MAAM,YAAY,GAAG,oBAAoB,EAAE,CAAC;IAC5C,MAAM,aAAa,GAAG,qBAAqB,CAAC,YAAY,CAAC,CAAC;IAE1D,OAAO,IAAI,OAAO,CAAY,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAChD,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;YAClD,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,kBAAkB,CAAC,CAAC;gBAExD,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW,EAAE,CAAC;oBACjC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;oBACnB,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;oBACrB,OAAO;gBACT,CAAC;gBAED,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;gBAC1C,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;gBAE5C,IAAI,KAAK,EAAE,CAAC;oBACV,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;oBACpD,GAAG,CAAC,GAAG,CACL,2FAA2F,CAC5F,CAAC;oBACF,MAAM,CAAC,KAAK,EAAE,CAAC;oBACf,MAAM,CAAC,IAAI,KAAK,CAAC,gBAAgB,KAAK,EAAE,CAAC,CAAC,CAAC;oBAC3C,OAAO;gBACT,CAAC;gBAED,IAAI,CAAC,IAAI,EAAE,CAAC;oBACV,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;oBACpD,GAAG,CAAC,GAAG,CACL,uFAAuF,CACxF,CAAC;oBACF,MAAM,CAAC,KAAK,EAAE,CAAC;oBACf,MAAM,CAAC,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC,CAAC;oBACpD,OAAO;gBACT,CAAC;gBAED,0BAA0B;gBAC1B,MAAM,aAAa,GAAG,MAAM,KAAK,CAAC,GAAG,WAAW,aAAa,EAAE;oBAC7D,MAAM,EAAE,MAAM;oBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;oBAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;wBACnB,IAAI;wBACJ,aAAa,EAAE,YAAY;wBAC3B,YAAY,EAAE,oBAAqB,MAAM,CAAC,OAAO,EAAuB,CAAC,IAAI,WAAW;qBACzF,CAAC;iBACH,CAAC,CAAC;gBAEH,IAAI,CAAC,aAAa,CAAC,EAAE,EAAE,CAAC;oBACtB,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,IAAI,EAAE,CAAC;oBACxC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;oBACpD,GAAG,CAAC,GAAG,CACL,2FAA2F,CAC5F,CAAC;oBACF,MAAM,CAAC,KAAK,EAAE,CAAC;oBACf,MAAM,CACJ,IAAI,KAAK,CACP,0BAA0B,aAAa,CAAC,MAAM,MAAM,IAAI,EAAE,CAC3D,CACF,CAAC;oBACF,OAAO;gBACT,CAAC;gBAED,MAAM,SAAS,GAAG,CAAC,MAAM,aAAa,CAAC,IAAI,EAAE,CAAc,CAAC;gBAE5D,gCAAgC;gBAChC,SAAS,CAAC,SAAS,CAAC,CAAC;gBAErB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;gBACpD,GAAG,CAAC,GAAG,CACL,+GAA+G,CAChH,CAAC;gBACF,MAAM,CAAC,KAAK,EAAE,CAAC;gBACf,OAAO,CAAC,SAAS,CAAC,CAAC;YACrB,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,CAAC,KAAK,EAAE,CAAC;gBACf,MAAM,CAAC,GAAG,CAAC,CAAC;YACd,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,wBAAwB;QACxB,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE;YACjC,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,EAAsB,CAAC;YAClD,MAAM,WAAW,GAAG,oBAAoB,IAAI,CAAC,IAAI,WAAW,CAAC;YAC7D,MAAM,OAAO,GAAG,GAAG,WAAW,4BAA4B,kBAAkB,CAAC,WAAW,CAAC,mBAAmB,aAAa,6BAA6B,CAAC;YAEvJ,OAAO,CAAC,GAAG,CAAC,yCAAyC,CAAC,CAAC;YACvD,WAAW,CAAC,OAAO,CAAC,CAAC;YACrB,OAAO,CAAC,GAAG,CAAC,8CAA8C,OAAO,IAAI,CAAC,CAAC;QACzE,CAAC,CAAC,CAAC;QAEH,0BAA0B;QAC1B,UAAU,CAAC,GAAG,EAAE;YACd,MAAM,CAAC,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC,CAAC;QAChE,CAAC,EAAE,OAAO,CAAC,CAAC;IACd,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AACrC,OAAO,KAAK,MAAM,OAAO,CAAC;AAE1B,+EAA+E;AAE/E,mEAAmE;AACnE,MAAM,CAAC,MAAM,uBAAuB,GAAG,sBAAsB,CAAC;AAC9D,MAAM,CAAC,MAAM,kBAAkB,GAAG,cAAc,CAAC;AAEjD,MAAM,sBAAsB,GAAG,sCAAsC,CAAC;AACtE,MAAM,gBAAgB,GAAG,6CAA6C,CAAC;AACvE,MAAM,mBAAmB,GAAG,6BAA6B,CAAC;AAE1D,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,KAAK,CAAC,CAAC;AAC9C,MAAM,gBAAgB,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;AAkD/D,+EAA+E;AAE/E,SAAS,WAAW;IAClB,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3B,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACzD,CAAC;AACH,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,cAAc,CAAC,IAAgB;IAC7C,WAAW,EAAE,CAAC;IACd,EAAE,CAAC,aAAa,CAAC,gBAAgB,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE;QAChE,IAAI,EAAE,KAAK;KACZ,CAAC,CAAC;AACL,CAAC;AAED,oDAAoD;AACpD,MAAM,UAAU,cAAc;IAC5B,IAAI,CAAC;QACH,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,gBAAgB,CAAC;YAAE,OAAO,IAAI,CAAC;QAClD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,gBAAgB,EAAE,OAAO,CAAC,CAAC,CAAC;QACtE,IACE,OAAO,MAAM,CAAC,YAAY,KAAK,QAAQ;YACvC,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ;YAChC,OAAO,MAAM,CAAC,EAAE,KAAK,QAAQ,EAC7B,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,MAAoB,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,iCAAiC;AACjC,MAAM,UAAU,eAAe;IAC7B,IAAI,CAAC;QACH,IAAI,EAAE,CAAC,UAAU,CAAC,gBAAgB,CAAC,EAAE,CAAC;YACpC,EAAE,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,SAAS;IACX,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,IAAgB;IACtD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,mBAAmB,EAAE;YAC3C,OAAO,EAAE;gBACP,aAAa,EAAE,SAAS,IAAI,CAAC,YAAY,EAAE;gBAC3C,MAAM,EAAE,6BAA6B;gBACrC,YAAY,EAAE,WAAW;aAC1B;YACD,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;SACpC,CAAC,CAAC;QACH,OAAO,GAAG,CAAC,EAAE,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,+EAA+E;AAE/E,2EAA2E;AAC3E,MAAM,UAAU,WAAW,CAAC,GAAW;IACrC,IAAI,OAAe,CAAC;IACpB,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAClC,OAAO,GAAG,SAAS,GAAG,GAAG,CAAC;IAC5B,CAAC;SAAM,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACxC,kEAAkE;QAClE,sEAAsE;QACtE,OAAO,GAAG,aAAa,GAAG,GAAG,CAAC;IAChC,CAAC;SAAM,CAAC;QACN,OAAO,GAAG,aAAa,GAAG,GAAG,CAAC;IAChC,CAAC;IACD,IAAI,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;QACpB,IAAI,GAAG,EAAE,CAAC;YACR,OAAO,CAAC,KAAK,CACX,KAAK,CAAC,GAAG,CAAC,mDAAmD,GAAG,YAAY,CAAC,CAC9E,CAAC;QACJ,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED,+EAA+E;AAE/E,SAAS,KAAK,CAAC,EAAU;IACvB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAC3D,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB;IACzC,2BAA2B;IAC3B,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,sBAAsB,EAAE;QACpD,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,MAAM,EAAE,kBAAkB;YAC1B,cAAc,EAAE,kBAAkB;YAClC,YAAY,EAAE,WAAW;SAC1B;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,SAAS,EAAE,uBAAuB;SACnC,CAAC;QACF,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;KACpC,CAAC,CAAC;IAEH,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;QAClB,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,sCAAsC,SAAS,CAAC,MAAM,MAAM,IAAI,EAAE,CAAC,CAAC;IACtF,CAAC;IAED,MAAM,MAAM,GAAG,CAAC,MAAM,SAAS,CAAC,IAAI,EAAE,CAAuB,CAAC;IAE9D,2CAA2C;IAC3C,OAAO,CAAC,GAAG,EAAE,CAAC;IACd,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC,CAAC;IACjD,OAAO,CAAC,GAAG,EAAE,CAAC;IACd,OAAO,CAAC,GAAG,CAAC,kCAAkC,CAAC,CAAC;IAChD,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC;IACxD,OAAO,CAAC,GAAG,EAAE,CAAC;IACd,OAAO,CAAC,GAAG,CAAC,sBAAsB,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IACxE,OAAO,CAAC,GAAG,EAAE,CAAC;IACd,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,gCAAgC,CAAC,CAAC,CAAC;IAEzD,WAAW,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;IAErC,oBAAoB;IACpB,IAAI,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,QAAQ,IAAI,CAAC,CAAC,GAAG,IAAI,EAAE,IAAI,CAAC,CAAC;IACjE,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,UAAU,IAAI,GAAG,CAAC,GAAG,IAAI,CAAC;IAEjE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,EAAE,CAAC;QAC9B,MAAM,KAAK,CAAC,YAAY,CAAC,CAAC;QAE1B,IAAI,QAAkB,CAAC;QACvB,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,KAAK,CAAC,gBAAgB,EAAE;gBACvC,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,MAAM,EAAE,kBAAkB;oBAC1B,cAAc,EAAE,kBAAkB;oBAClC,YAAY,EAAE,WAAW;iBAC1B;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACnB,SAAS,EAAE,uBAAuB;oBAClC,WAAW,EAAE,MAAM,CAAC,WAAW;oBAC/B,UAAU,EAAE,8CAA8C;iBAC3D,CAAC;gBACF,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;aACpC,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,8BAA8B;YAC9B,SAAS;QACX,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAkB,CAAC;QAExE,IAAI,IAAI,CAAC,KAAK,KAAK,uBAAuB;YAAE,SAAS;QAErD,IAAI,IAAI,CAAC,KAAK,KAAK,WAAW,EAAE,CAAC;YAC/B,4DAA4D;YAC5D,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC;YACzC,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,YAAY,GAAG,IAAI,EAAE,YAAY,GAAG,IAAI,CAAC,CAAC;YAClE,SAAS;QACX,CAAC;QAED,IAAI,IAAI,CAAC,KAAK,KAAK,eAAe,EAAE,CAAC;YACnC,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;QAC7E,CAAC;QACD,IAAI,IAAI,CAAC,KAAK,KAAK,eAAe,EAAE,CAAC;YACnC,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;QAC9C,CAAC;QACD,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CACb,sBAAsB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAClG,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;QACrD,CAAC;QAED,0CAA0C;QAC1C,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,mBAAmB,EAAE;YAC/C,OAAO,EAAE;gBACP,aAAa,EAAE,SAAS,IAAI,CAAC,YAAY,EAAE;gBAC3C,MAAM,EAAE,6BAA6B;gBACrC,YAAY,EAAE,WAAW;aAC1B;YACD,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;SACpC,CAAC,CAAC;QAEH,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;YAChB,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;YAClD,MAAM,IAAI,KAAK,CAAC,gCAAgC,OAAO,CAAC,MAAM,MAAM,IAAI,EAAE,CAAC,CAAC;QAC9E,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,CAAuB,CAAC;QAE1D,MAAM,IAAI,GAAe;YACvB,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,EAAE,EAAE,IAAI,CAAC,EAAE;YACX,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC,CAAC;QAEF,cAAc,CAAC,IAAI,CAAC,CAAC;QACrB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;AACrE,CAAC;AAED,+EAA+E;AAE/E;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,QAAgB,EAChB,IAAgB,EAChB,OAAoB,EAAE;IAEtB,MAAM,GAAG,GAAG,QAAQ,CAAC,UAAU,CAAC,UAAU,CAAC;QACzC,CAAC,CAAC,QAAQ;QACV,CAAC,CAAC,yBAAyB,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG,QAAQ,EAAE,CAAC;IAE9E,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;QAC3B,GAAG,IAAI;QACP,OAAO,EAAE;YACP,aAAa,EAAE,SAAS,IAAI,CAAC,YAAY,EAAE;YAC3C,MAAM,EAAE,6BAA6B;YACrC,YAAY,EAAE,WAAW;YACzB,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC;SACxB;QACD,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;KACnD,CAAC,CAAC;IAEH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,cAAc,GAAG,CAAC,MAAM,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC,CAAC;IACnE,CAAC;IAED,4BAA4B;IAC5B,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,SAAc,CAAC;IAC9C,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAM,CAAC;AACjC,CAAC"}

package/dist/company-template.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Company / team-repo template generator.
+ *
+ * When an admin creates a new team, we need to seed the new {org}/hq private
+ * repo with a baseline directory structure that mirrors what /newcompany
+ * produces. This module renders that structure into a target directory
+ * (which is then committed and pushed to the new GitHub repo).
+ *
+ * No filesystem dependencies on the core HQ template — these files are
+ * synthesized in code so the seed is version-locked with the create-hq
+ * release the user just installed.
+ */
+export interface TeamMetadata {
+    team_id: string;
+    team_name: string;
+    team_slug: string;
+    org_login: string;
+    org_id: number;
+    created_by: string;
+    created_at: string;
+    hq_version: string;
+}
+/**
+ * Render the company template into targetDir. Creates the directory if it
+ * does not exist. Will not overwrite existing files (idempotent on re-runs).
+ */
+export declare function writeCompanyTemplate(targetDir: string, meta: TeamMetadata): void;
+/**
+ * Ensure all standard company subdirectories exist inside targetDir
+ * without overwriting any existing files. Used after cloning a team repo
+ * to fill in any directories the upstream repo doesn't have yet.
+ */
+export declare function ensureCompanyStructure(targetDir: string): void;
+//# sourceMappingURL=company-template.d.ts.map

package/dist/company-template.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"company-template.d.ts","sourceRoot":"","sources":["../src/company-template.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAKH,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;CACpB;AA0ED;;;GAGG;AACH,wBAAgB,oBAAoB,CAClC,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,YAAY,GACjB,IAAI,CA6CN;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAO9D"}

package/dist/company-template.js

@@ -0,0 +1,142 @@
+/**
+ * Company / team-repo template generator.
+ *
+ * When an admin creates a new team, we need to seed the new {org}/hq private
+ * repo with a baseline directory structure that mirrors what /newcompany
+ * produces. This module renders that structure into a target directory
+ * (which is then committed and pushed to the new GitHub repo).
+ *
+ * No filesystem dependencies on the core HQ template — these files are
+ * synthesized in code so the seed is version-locked with the create-hq
+ * release the user just installed.
+ */
+import * as fs from "fs";
+import * as path from "path";
+const COMPANY_SUBDIRS = [
+    "knowledge",
+    "settings",
+    "data",
+    "workers",
+    "repos",
+    "projects",
+    "policies",
+];
+const GITIGNORE = `# Local secrets and caches — never commit
+settings/*.local.*
+settings/.env*
+data/cache/
+data/tmp/
+*.log
+.DS_Store
+Thumbs.db
+`;
+function readme(meta) {
+    return `# ${meta.team_name}
+
+HQ Teams workspace for **${meta.org_login}**.
+
+## What is this?
+
+This repository is the shared workspace for the **${meta.team_name}** HQ team.
+Members of the \`${meta.org_login}\` GitHub organization with access to this
+repo will see its contents inside their local HQ at:
+
+\`\`\`
+companies/${meta.team_slug}/
+\`\`\`
+
+## Structure
+
+| Directory | Purpose |
+|-----------|---------|
+| \`knowledge/\` | Shared docs, references, and qmd-indexed content |
+| \`settings/\` | Team-scoped credentials and config (gitignore secrets) |
+| \`data/\` | Exports, datasets, and reports |
+| \`workers/\` | Custom worker definitions for this team |
+| \`repos/\` | References to repos the team owns |
+| \`projects/\` | Active projects with PRDs and stories |
+| \`policies/\` | Team policies (auto-loaded by Claude Code) |
+
+## Adding members
+
+Anyone with access to this repository on GitHub will automatically pick up
+this workspace when they run \`npx create-hq\`. To add a teammate, grant them
+access through the \`${meta.org_login}\` GitHub organization or directly to
+this repository.
+
+## Created
+
+- Created by: @${meta.created_by}
+- Created at: ${meta.created_at}
+- Seeded from: create-hq / HQ template ${meta.hq_version}
+`;
+}
+function knowledgeReadme(meta) {
+    return `# ${meta.team_name} Knowledge
+
+This is the shared knowledge base for the ${meta.team_name} HQ team.
+
+Drop markdown files here to share docs, references, and conventions across
+the team. Indexed by qmd for semantic + full-text search.
+`;
+}
+/**
+ * Render the company template into targetDir. Creates the directory if it
+ * does not exist. Will not overwrite existing files (idempotent on re-runs).
+ */
+export function writeCompanyTemplate(targetDir, meta) {
+    fs.mkdirSync(targetDir, { recursive: true });
+    // Subdirectories with .gitkeep
+    for (const sub of COMPANY_SUBDIRS) {
+        const dir = path.join(targetDir, sub);
+        fs.mkdirSync(dir, { recursive: true });
+        const gitkeep = path.join(dir, ".gitkeep");
+        if (!fs.existsSync(gitkeep)) {
+            fs.writeFileSync(gitkeep, "", "utf-8");
+        }
+    }
+    // README.md
+    const readmePath = path.join(targetDir, "README.md");
+    if (!fs.existsSync(readmePath)) {
+        fs.writeFileSync(readmePath, readme(meta), "utf-8");
+    }
+    // team.json
+    const teamJsonPath = path.join(targetDir, "team.json");
+    if (!fs.existsSync(teamJsonPath)) {
+        fs.writeFileSync(teamJsonPath, JSON.stringify(meta, null, 2) + "\n", "utf-8");
+    }
+    // knowledge/README.md (replaces .gitkeep there)
+    const knowledgeReadmePath = path.join(targetDir, "knowledge", "README.md");
+    if (!fs.existsSync(knowledgeReadmePath)) {
+        fs.writeFileSync(knowledgeReadmePath, knowledgeReadme(meta), "utf-8");
+        // Remove the redundant .gitkeep now that there's a real file
+        const gitkeep = path.join(targetDir, "knowledge", ".gitkeep");
+        if (fs.existsSync(gitkeep)) {
+            try {
+                fs.unlinkSync(gitkeep);
+            }
+            catch {
+                // ignore
+            }
+        }
+    }
+    // .gitignore
+    const gitignorePath = path.join(targetDir, ".gitignore");
+    if (!fs.existsSync(gitignorePath)) {
+        fs.writeFileSync(gitignorePath, GITIGNORE, "utf-8");
+    }
+}
+/**
+ * Ensure all standard company subdirectories exist inside targetDir
+ * without overwriting any existing files. Used after cloning a team repo
+ * to fill in any directories the upstream repo doesn't have yet.
+ */
+export function ensureCompanyStructure(targetDir) {
+    for (const sub of COMPANY_SUBDIRS) {
+        const dir = path.join(targetDir, sub);
+        if (!fs.existsSync(dir)) {
+            fs.mkdirSync(dir, { recursive: true });
+        }
+    }
+}
+//# sourceMappingURL=company-template.js.map

package/dist/company-template.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"company-template.js","sourceRoot":"","sources":["../src/company-template.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAa7B,MAAM,eAAe,GAAG;IACtB,WAAW;IACX,UAAU;IACV,MAAM;IACN,SAAS;IACT,OAAO;IACP,UAAU;IACV,UAAU;CACX,CAAC;AAEF,MAAM,SAAS,GAAG;;;;;;;;CAQjB,CAAC;AAEF,SAAS,MAAM,CAAC,IAAkB;IAChC,OAAO,KAAK,IAAI,CAAC,SAAS;;2BAED,IAAI,CAAC,SAAS;;;;oDAIW,IAAI,CAAC,SAAS;mBAC/C,IAAI,CAAC,SAAS;;;;YAIrB,IAAI,CAAC,SAAS;;;;;;;;;;;;;;;;;;;uBAmBH,IAAI,CAAC,SAAS;;;;;iBAKpB,IAAI,CAAC,UAAU;gBAChB,IAAI,CAAC,UAAU;yCACU,IAAI,CAAC,UAAU;CACvD,CAAC;AACF,CAAC;AAED,SAAS,eAAe,CAAC,IAAkB;IACzC,OAAO,KAAK,IAAI,CAAC,SAAS;;4CAEgB,IAAI,CAAC,SAAS;;;;CAIzD,CAAC;AACF,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAClC,SAAiB,EACjB,IAAkB;IAElB,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAE7C,+BAA+B;IAC/B,KAAK,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;QAClC,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QACtC,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACvC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;QAC3C,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YAC5B,EAAE,CAAC,aAAa,CAAC,OAAO,EAAE,EAAE,EAAE,OAAO,CAAC,CAAC;QACzC,CAAC;IACH,CAAC;IAED,YAAY;IACZ,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;IACrD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC/B,EAAE,CAAC,aAAa,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC;IACtD,CAAC;IAED,YAAY;IACZ,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;IACvD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QACjC,EAAE,CAAC,aAAa,CAAC,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,OAAO,CAAC,CAAC;IAChF,CAAC;IAED,gDAAgD;IAChD,MAAM,mBAAmB,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC;IAC3E,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,mBAAmB,CAAC,EAAE,CAAC;QACxC,EAAE,CAAC,aAAa,CAAC,mBAAmB,EAAE,eAAe,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC;QACtE,6DAA6D;QAC7D,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC;QAC9D,IAAI,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3B,IAAI,CAAC;gBACH,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;YACzB,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;QACH,CAAC;IACH,CAAC;IAED,aAAa;IACb,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;IACzD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;QAClC,EAAE,CAAC,aAAa,CAAC,aAAa,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;IACtD,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CAAC,SAAiB;IACtD,KAAK,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;QAClC,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QACtC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACxB,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACzC,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/deps.d.ts

@@ -13,6 +13,8 @@ export interface InstallCommands {
     dnf?: string;
     pacman?: string;
     npm?: string;
+    winget?: string;
+    choco?: string;
 }
 export interface Dep {
     name: string;

package/dist/deps.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deps.d.ts","sourceRoot":"","sources":["../src/deps.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAElD,MAAM,MAAM,SAAS,GAAG,WAAW,GAAG,gBAAgB,GAAG,SAAS,GAAG,SAAS,CAAC;AAE/E,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,OAAO,CAAC;IAClB,MAAM,EAAE,SAAS,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,GAAG;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,OAAO,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,OAAO,CAAC;IACzB,eAAe,EAAE,eAAe,CAAC;CAClC;AA+ED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAC/B,GAAG,EAAE,GAAG,EACR,QAAQ,EAAE,YAAY,GACrB,MAAM,GAAG,IAAI,CAef;AAgCD,wBAAsB,SAAS,IAAI,OAAO,CAAC;IAAE,WAAW,EAAE,OAAO,CAAA;CAAE,CAAC,CA+EnE"}
+{"version":3,"file":"deps.d.ts","sourceRoot":"","sources":["../src/deps.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAElD,MAAM,MAAM,SAAS,GAAG,WAAW,GAAG,gBAAgB,GAAG,SAAS,GAAG,SAAS,CAAC;AAE/E,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,OAAO,CAAC;IAClB,MAAM,EAAE,SAAS,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,GAAG;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,OAAO,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,OAAO,CAAC;IACzB,eAAe,EAAE,eAAe,CAAC;CAClC;AA8FD;;;;GAIG;AACH,wBAAgB,iBAAiB,CAC/B,GAAG,EAAE,GAAG,EACR,QAAQ,EAAE,YAAY,GACrB,MAAM,GAAG,IAAI,CAef;AAgCD,wBAAsB,SAAS,IAAI,OAAO,CAAC;IAAE,WAAW,EAAE,OAAO,CAAA;CAAE,CAAC,CAgFnE"}