create-hq 10.10.0 → 10.12.0

package/dist/auth.js

@@ -1,397 +1,108 @@
 /**
- * GitHub App device flow auth for create-hq.
- *
- * Talks directly to github.com — no backend involved.
- *
- * Flow:
- *   1. POST github.com/login/device/code with our App's client_id
- *   2. Display user_code, open verification_uri in browser
- *   3. Poll github.com/login/oauth/access_token at the GitHub-specified interval
- *   4. On success: GET api.github.com/user → save token to ~/.hq/app-token.json
- *
- * The HQ App token is stored in ~/.hq/app-token.json (mode 0600) and is
- * completely independent of the user's `gh` CLI auth. This means:
- *   - Running `gh auth login` / `gh auth logout` does not affect HQ auth
- *   - HQ auth does not overwrite the user's existing `gh` token
- *   - The App token is only used for HQ-specific API calls (installations, etc.)
- *
- * Token values are NEVER written to stdout or logs.
- */
-import * as fs from "fs";
-import * as path from "path";
-import * as os from "os";
-import { exec, execSync } from "child_process";
-import chalk from "chalk";
-// ─── Constants ──────────────────────────────────────────────────────────────
-/** hq-team-sync GitHub App client ID (public — safe to commit). */
-export const HQ_GITHUB_APP_CLIENT_ID = "Iv23liSdkCBQYhrNcRmI";
-export const HQ_GITHUB_APP_SLUG = "hq-team-sync";
-const GITHUB_DEVICE_CODE_URL = "https://github.com/login/device/code";
-const GITHUB_TOKEN_URL = "https://github.com/login/oauth/access_token";
-const GITHUB_API_USER_URL = "https://api.github.com/user";
-const HQ_DIR = path.join(os.homedir(), ".hq");
-/** Where the HQ App token is persisted. Exported for tests. */
-export const HQ_APP_TOKEN_PATH = path.join(HQ_DIR, "app-token.json");
-// ─── Token persistence (~/.hq/app-token.json) ────────────────────────────
-/**
- * Save the HQ App auth to ~/.hq/app-token.json.
- *
- * The file is written with mode 0600 (owner read+write only). The user's
- * existing `gh` CLI auth is never touched.
- *
- * @param tokenPath — override for testing; defaults to HQ_APP_TOKEN_PATH
- */
-export function saveGitHubAuth(auth, tokenPath = HQ_APP_TOKEN_PATH) {
-    const dir = path.dirname(tokenPath);
-    if (!fs.existsSync(dir)) {
-        fs.mkdirSync(dir, { recursive: true });
-    }
-    fs.writeFileSync(tokenPath, JSON.stringify(auth, null, 2), {
-        encoding: "utf-8",
-        mode: 0o600,
-    });
-}
-/**
- * Load HQ App auth from ~/.hq/app-token.json.
- *
- * Returns null if the file doesn't exist, is corrupted, or is missing
- * required fields. Does NOT fall back to `gh` CLI — the HQ App token
- * is separate from the user's personal GitHub auth.
- *
- * @param tokenPath — override for testing; defaults to HQ_APP_TOKEN_PATH
+ * Cognito-based authentication for create-hq.
+ *
+ * Uses the shared OSS `@indigoai-us/hq-cloud` helper to drive Cognito Hosted UI
+ * through a PKCE + loopback OAuth flow. Forces Google as the identity provider
+ * so the experience matches hq-installer (the Tauri desktop app) and the rest
+ * of the HQ by Indigo suite.
+ *
+ * Token cache: `~/.hq/cognito-tokens.json` — canonical shared session file used
+ * by hq-cloud, hq-cli, hq-installer, and the deploy skill. All four agree on
+ * this path, so any of them can refresh or invalidate the session.
+ *
+ * Exports follow the pattern in hq-cli's `utils/cognito-session.ts`:
+ *   - DEFAULT_COGNITO  — config matching hq-installer's .env.local
+ *   - ensureCognitoToken({ interactive }) — top-level helper used by the
+ *     teams flow. Returns `CognitoTokens` or null if sign-in failed.
+ *   - readIdentity(tokens) — decodes the ID token payload (email, name).
  */
-export function loadGitHubAuth(tokenPath = HQ_APP_TOKEN_PATH) {
-    try {
-        if (!fs.existsSync(tokenPath))
-            return null;
-        const raw = fs.readFileSync(tokenPath, "utf-8");
-        const data = JSON.parse(raw);
-        // Minimal validation — must have at least a token and login
-        if (!data.access_token || !data.login)
-            return null;
-        return data;
-    }
-    catch {
-        return null;
-    }
-}
-/**
- * Remove stored HQ App credentials.
- *
- * Deletes ~/.hq/app-token.json. Does NOT touch `gh` CLI auth.
- *
- * @param tokenPath — override for testing; defaults to HQ_APP_TOKEN_PATH
- */
-export function clearGitHubAuth(tokenPath = HQ_APP_TOKEN_PATH) {
-    try {
-        if (fs.existsSync(tokenPath)) {
-            fs.unlinkSync(tokenPath);
-        }
-    }
-    catch {
-        // ignore — may already be gone
-    }
-}
-/**
- * Quick liveness probe — does the stored token still work?
- * Validates the token by hitting GET /user on api.github.com.
- */
-export async function isGitHubAuthValid(auth) {
-    if (!auth.access_token)
-        return false;
-    try {
-        const res = await fetch(GITHUB_API_USER_URL, {
-            headers: {
-                Authorization: `token ${auth.access_token}`,
-                Accept: "application/vnd.github+json",
-                "User-Agent": "create-hq",
-            },
-            signal: AbortSignal.timeout(10_000),
-        });
-        return res.ok;
-    }
-    catch {
-        return false;
-    }
-}
+import { browserLogin, refreshTokens, loadCachedTokens, clearCachedTokens, isExpiring, } from "@indigoai-us/hq-cloud";
 /**
- * Probe whether a token has GitHub App scopes by hitting /user/installations.
- *
- * Returns:
- *   - `"yes"`     — 2xx, token has App scopes
- *   - `"no"`      — 403, token is definitively the wrong type
- *   - `"unknown"` — transient failure (network error, 5xx, timeout)
- *
- * Callers should only delete cached tokens on `"no"`, not on `"unknown"`.
- * This is a lightweight check — we request per_page=1 to minimise payload.
+ * Default Cognito pool for HQ by Indigo. Mirrors hq-installer's `.env.local`
+ * and hq-cli's `DEFAULT_COGNITO`. All three tools share the same pool so a
+ * single sign-in works across installer, CLI, and create-hq.
+ *
+ * Defaults point at the shared `vault-indigo-hq-prod` Cognito pool (canonical
+ * post-2026-04-25 cutover). The legacy `hq-vault-dev` pool is no longer the
+ * fallback — it remains reachable only via explicit `HQ_COGNITO_DOMAIN` env
+ * override for staging tests. Mirrors `packages/hq-cli/src/utils/cognito-session.ts`
+ * and `packages/hq-cloud/src/bin/sync-runner.ts` so all three callers stay
+ * drift-free.
+ *
+ * Port 8765 matches hq-cli (not hq-installer's 53682) — Cognito App Client
+ * callback URLs must list every port we use, and we're standardizing on 8765
+ * for all Node-based callers.
  */
-export async function isAppScopedToken(auth) {
-    if (!auth.access_token)
-        return "no";
-    try {
-        const res = await fetch("https://api.github.com/user/installations?per_page=1", {
-            headers: {
-                Authorization: `token ${auth.access_token}`,
-                Accept: "application/vnd.github+json",
-                "User-Agent": "create-hq",
-            },
-            signal: AbortSignal.timeout(10_000),
-        });
-        if (res.ok)
-            return "yes";
-        // 401/403 = definitive "wrong token type"
-        if (res.status === 401 || res.status === 403)
-            return "no";
-        // Anything else (429, 5xx) = transient
-        return "unknown";
-    }
-    catch {
-        // Network error, timeout, DNS failure = transient
-        return "unknown";
-    }
-}
-// ─── Browser open (cross-platform) ──────────────────────────────────────────
-/** Open a URL in the user's default browser. Best-effort, never throws. */
-export function openBrowser(url) {
-    let command;
-    if (process.platform === "darwin") {
-        command = `open "${url}"`;
-    }
-    else if (process.platform === "win32") {
-        // Windows: `start` is a cmd.exe builtin. The empty quotes are the
-        // window title argument (start treats the first quoted arg as title).
-        command = `start "" "${url}"`;
-    }
-    else {
-        command = `xdg-open "${url}"`;
-    }
-    exec(command, (err) => {
-        if (err) {
-            console.error(chalk.dim(`  (could not open browser automatically — visit ${url} manually)`));
-        }
-    });
-}
-// ─── Device flow ────────────────────────────────────────────────────────────
-function sleep(ms) {
-    return new Promise((resolve) => setTimeout(resolve, ms));
-}
+export const DEFAULT_COGNITO = {
+    region: process.env.AWS_REGION ?? "us-east-1",
+    userPoolDomain: process.env.HQ_COGNITO_DOMAIN ?? "vault-indigo-hq-prod",
+    clientId: process.env.HQ_COGNITO_CLIENT_ID ?? "7acei2c8v870enheptb1j5foln",
+    port: process.env.HQ_COGNITO_CALLBACK_PORT
+        ? Number(process.env.HQ_COGNITO_CALLBACK_PORT)
+        : 8765,
+    identityProvider: "Google",
+    prompt: "select_account",
+};
 /**
- * Run the GitHub App device authorization flow.
- *
- * On success, the token is:
- *   1. Returned in-memory as part of GitHubAuth (for the current session)
- *   2. Persisted to ~/.hq/app-token.json for future sessions
- *
- * The user's existing `gh` CLI auth is never modified.
+ * Return a valid set of Cognito tokens, refreshing or launching the browser
+ * flow as needed. Returns null when interactive login fails (user closed the
+ * tab, timeout, network error) — caller should treat that as "user declined".
  *
- * Throws on:
- *   - Network errors talking to github.com
- *   - User-denied authorization (access_denied)
- *   - Device code expiration
- *   - Failure to fetch the user profile
+ * When `interactive: false`, this function will never open a browser — it
+ * returns null if no valid cached token is available. Useful for CI / non-TTY
+ * environments where we want a hard fail instead of a hung browser prompt.
  */
-export async function startGitHubDeviceFlow() {
-    // 1. Request a device code
-    const deviceRes = await fetch(GITHUB_DEVICE_CODE_URL, {
-        method: "POST",
-        headers: {
-            Accept: "application/json",
-            "Content-Type": "application/json",
-            "User-Agent": "create-hq",
-        },
-        body: JSON.stringify({
-            client_id: HQ_GITHUB_APP_CLIENT_ID,
-        }),
-        signal: AbortSignal.timeout(15_000),
-    });
-    if (!deviceRes.ok) {
-        const body = await deviceRes.text().catch(() => "");
-        throw new Error(`GitHub device code request failed (${deviceRes.status}): ${body}`);
-    }
-    const device = (await deviceRes.json());
-    // 2. Display the code and open the browser
-    console.log();
-    console.log(chalk.bold("  Sign in with GitHub"));
-    console.log();
-    console.log(`  Open this URL in your browser:`);
-    console.log(`  ${chalk.cyan(device.verification_uri)}`);
-    console.log();
-    console.log(`  Enter this code: ${chalk.bold.white(device.user_code)}`);
-    console.log();
-    console.log(chalk.dim("  Waiting for authorization..."));
-    openBrowser(device.verification_uri);
-    // 3. Poll for token
-    let pollInterval = Math.max((device.interval ?? 5) * 1000, 5000);
-    const expiresAt = Date.now() + (device.expires_in ?? 900) * 1000;
-    while (Date.now() < expiresAt) {
-        await sleep(pollInterval);
-        let tokenRes;
+export async function ensureCognitoToken(opts = {}) {
+    const interactive = opts.interactive ?? true;
+    const config = opts.config ?? DEFAULT_COGNITO;
+    const cached = loadCachedTokens();
+    if (cached && !isExpiring(cached))
+        return cached;
+    if (cached) {
         try {
-            tokenRes = await fetch(GITHUB_TOKEN_URL, {
-                method: "POST",
-                headers: {
-                    Accept: "application/json",
-                    "Content-Type": "application/json",
-                    "User-Agent": "create-hq",
-                },
-                body: JSON.stringify({
-                    client_id: HQ_GITHUB_APP_CLIENT_ID,
-                    device_code: device.device_code,
-                    grant_type: "urn:ietf:params:oauth:grant-type:device_code",
-                }),
-                signal: AbortSignal.timeout(15_000),
-            });
+            return await refreshTokens(config, cached.refreshToken);
         }
         catch {
-            // Network blip — keep polling
-            continue;
-        }
-        const data = (await tokenRes.json().catch(() => ({})));
-        if (data.error === "authorization_pending")
-            continue;
-        if (data.error === "slow_down") {
-            // Per spec: increase polling interval by at least 5 seconds
-            const bump = (data.interval ?? 5) * 1000;
-            pollInterval = Math.max(pollInterval + bump, pollInterval + 5000);
-            continue;
-        }
-        if (data.error === "expired_token") {
-            throw new Error("GitHub device code expired — please run create-hq again");
-        }
-        if (data.error === "access_denied") {
-            throw new Error("Authorization was denied");
-        }
-        if (data.error) {
-            throw new Error(`GitHub auth error: ${data.error}${data.error_description ? ` — ${data.error_description}` : ""}`);
+            // Refresh failed — fall through to interactive login (or return null
+            // if interactive is disabled).
         }
-        if (!data.access_token) {
-            throw new Error("GitHub returned no access_token");
-        }
-        // 4. Fetch the authenticated user profile
-        const userRes = await fetch(GITHUB_API_USER_URL, {
-            headers: {
-                Authorization: `token ${data.access_token}`,
-                Accept: "application/vnd.github+json",
-                "User-Agent": "create-hq",
-            },
-            signal: AbortSignal.timeout(15_000),
-        });
-        if (!userRes.ok) {
-            const body = await userRes.text().catch(() => "");
-            throw new Error(`Failed to fetch GitHub user (${userRes.status}): ${body}`);
-        }
-        const user = (await userRes.json());
-        const auth = {
-            access_token: data.access_token,
-            login: user.login,
-            id: user.id,
-            name: user.name,
-            email: user.email,
-            issued_at: new Date().toISOString(),
-        };
-        // Persist for future sessions (does not touch gh CLI)
-        saveGitHubAuth(auth);
-        return auth;
     }
-    throw new Error("GitHub device flow timed out — please try again");
-}
-// ─── gh CLI token (opportunistic) ──────────────────────────────────────────
-/**
- * Try to get the user's `gh` CLI OAuth token.
- *
- * Returns the token string if `gh` is installed, the user is logged in, and
- * `gh auth token` succeeds. Returns null otherwise — this is purely
- * opportunistic and never throws.
- *
- * The gh CLI token typically has `read:org` scope, which lets us enumerate
- * ALL the user's org memberships — not just orgs where our GitHub App is
- * installed. This gives us a better org picker during admin onboarding.
- */
-export function getGhCliToken() {
-    try {
-        const token = execSync("gh auth token", {
-            stdio: ["pipe", "pipe", "pipe"],
-            timeout: 5_000,
-        })
-            .toString()
-            .trim();
-        // Sanity check — gh tokens start with gho_ or ghp_ (OAuth / PAT)
-        if (token && token.length > 10)
-            return token;
+    if (!interactive)
         return null;
+    try {
+        return await browserLogin(config);
     }
     catch {
         return null;
     }
 }
 /**
- * Fetch orgs where the user is an admin, using a raw bearer token.
- *
- * Works with both gh CLI tokens (PAT/OAuth) and GitHub App user tokens.
- * The difference: a gh CLI token with `read:org` scope sees ALL orgs,
- * while an App token only sees orgs where the App is installed.
- *
- * Returns an empty array on any error (permissions, network, etc.).
+ * Decode the ID token payload. No signature verification — we only read
+ * display fields (email, name) for the UI. Never trust these claims for
+ * authorization; the server re-verifies the JWT on every API call.
  */
-export async function fetchAdminOrgsWithToken(token) {
+export function readIdentity(tokens) {
     try {
-        const res = await fetch("https://api.github.com/user/memberships/orgs?state=active&per_page=100", {
-            headers: {
-                Authorization: `token ${token}`,
-                Accept: "application/vnd.github+json",
-                "User-Agent": "create-hq",
-            },
-            signal: AbortSignal.timeout(15_000),
-        });
-        if (!res.ok)
-            return [];
-        const memberships = (await res.json());
-        return memberships
-            .filter((m) => m.role === "admin")
-            .map((m) => ({
-            login: m.organization.login,
-            id: m.organization.id,
-        }));
+        const [, payloadB64] = tokens.idToken.split(".");
+        if (!payloadB64)
+            return null;
+        const b64 = payloadB64.replace(/-/g, "+").replace(/_/g, "/");
+        const pad = b64.length % 4 === 0 ? "" : "=".repeat(4 - (b64.length % 4));
+        const json = Buffer.from(b64 + pad, "base64").toString("utf-8");
+        const claims = JSON.parse(json);
+        return {
+            sub: String(claims.sub ?? ""),
+            email: typeof claims.email === "string" ? claims.email : undefined,
+            name: typeof claims.name === "string" ? claims.name : undefined,
+            claims,
+        };
     }
     catch {
-        return [];
+        return null;
     }
 }
-// ─── GitHub API helpers used by downstream flows ────────────────────────────
-/**
- * Authenticated fetch against api.github.com. Throws on non-2xx with
- * the response body included for diagnostics.
- */
-export async function githubApi(pathname, auth, init = {}) {
-    const url = pathname.startsWith("https://")
-        ? pathname
-        : `https://api.github.com${pathname.startsWith("/") ? "" : "/"}${pathname}`;
-    const res = await fetch(url, {
-        ...init,
-        headers: {
-            Authorization: `token ${auth.access_token}`,
-            Accept: "application/vnd.github+json",
-            "User-Agent": "create-hq",
-            ...(init.headers || {}),
-        },
-        signal: init.signal ?? AbortSignal.timeout(20_000),
-    });
-    if (!res.ok) {
-        const body = await res.text().catch(() => "");
-        // Friendly error when a non-App token hits the App-only installations endpoint.
-        if (res.status === 403 &&
-            pathname.startsWith("/user/installations") &&
-            body.includes("authorized to a GitHub App")) {
-            throw new Error("You're signed in with a regular GitHub token that can't list App installations.\n" +
-                "  HQ Teams requires authentication through the HQ GitHub App.\n\n" +
-                "  To fix this, re-run the installer — it will prompt you to authorize the HQ App:\n" +
-                "    npx create-hq");
-        }
-        throw new Error(`GitHub API ${res.status} ${pathname}: ${body}`);
-    }
-    // Some endpoints return 204
-    if (res.status === 204)
-        return undefined;
-    return (await res.json());
+/** Delete the cached Cognito session. */
+export function signOut() {
+    clearCachedTokens();
 }
 //# sourceMappingURL=auth.js.map

package/dist/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,KAAK,MAAM,OAAO,CAAC;AAE1B,+EAA+E;AAE/E,mEAAmE;AACnE,MAAM,CAAC,MAAM,uBAAuB,GAAG,sBAAsB,CAAC;AAC9D,MAAM,CAAC,MAAM,kBAAkB,GAAG,cAAc,CAAC;AAEjD,MAAM,sBAAsB,GAAG,sCAAsC,CAAC;AACtE,MAAM,gBAAgB,GAAG,6CAA6C,CAAC;AACvE,MAAM,mBAAmB,GAAG,6BAA6B,CAAC;AAE1D,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,KAAK,CAAC,CAAC;AAE9C,+DAA+D;AAC/D,MAAM,CAAC,MAAM,iBAAiB,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;AAkDrE,4EAA4E;AAE5E;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc,CAAC,IAAgB,EAAE,SAAS,GAAG,iBAAiB;IAC5E,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACpC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACxB,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACzC,CAAC;IACD,EAAE,CAAC,aAAa,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE;QACzD,QAAQ,EAAE,OAAO;QACjB,IAAI,EAAE,KAAK;KACZ,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,cAAc,CAAC,SAAS,GAAG,iBAAiB;IAC1D,IAAI,CAAC;QACH,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC;YAAE,OAAO,IAAI,CAAC;QAC3C,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAChD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC7B,4DAA4D;QAC5D,IAAI,CAAC,IAAI,CAAC,YAAY,IAAI,CAAC,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QACnD,OAAO,IAAkB,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,SAAS,GAAG,iBAAiB;IAC3D,IAAI,CAAC;QACH,IAAI,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC7B,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,+BAA+B;IACjC,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,IAAgB;IACtD,IAAI,CAAC,IAAI,CAAC,YAAY;QAAE,OAAO,KAAK,CAAC;IACrC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,mBAAmB,EAAE;YAC3C,OAAO,EAAE;gBACP,aAAa,EAAE,SAAS,IAAI,CAAC,YAAY,EAAE;gBAC3C,MAAM,EAAE,6BAA6B;gBACrC,YAAY,EAAE,WAAW;aAC1B;YACD,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;SACpC,CAAC,CAAC;QACH,OAAO,GAAG,CAAC,EAAE,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAKD;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,IAAgB;IACrD,IAAI,CAAC,IAAI,CAAC,YAAY;QAAE,OAAO,IAAI,CAAC;IACpC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CACrB,sDAAsD,EACtD;YACE,OAAO,EAAE;gBACP,aAAa,EAAE,SAAS,IAAI,CAAC,YAAY,EAAE;gBAC3C,MAAM,EAAE,6BAA6B;gBACrC,YAAY,EAAE,WAAW;aAC1B;YACD,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;SACpC,CACF,CAAC;QACF,IAAI,GAAG,CAAC,EAAE;YAAE,OAAO,KAAK,CAAC;QACzB,0CAA0C;QAC1C,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC;QAC1D,uCAAuC;QACvC,OAAO,SAAS,CAAC;IACnB,CAAC;IAAC,MAAM,CAAC;QACP,kDAAkD;QAClD,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,+EAA+E;AAE/E,2EAA2E;AAC3E,MAAM,UAAU,WAAW,CAAC,GAAW;IACrC,IAAI,OAAe,CAAC;IACpB,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAClC,OAAO,GAAG,SAAS,GAAG,GAAG,CAAC;IAC5B,CAAC;SAAM,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACxC,kEAAkE;QAClE,sEAAsE;QACtE,OAAO,GAAG,aAAa,GAAG,GAAG,CAAC;IAChC,CAAC;SAAM,CAAC;QACN,OAAO,GAAG,aAAa,GAAG,GAAG,CAAC;IAChC,CAAC;IACD,IAAI,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;QACpB,IAAI,GAAG,EAAE,CAAC;YACR,OAAO,CAAC,KAAK,CACX,KAAK,CAAC,GAAG,CAAC,mDAAmD,GAAG,YAAY,CAAC,CAC9E,CAAC;QACJ,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED,+EAA+E;AAE/E,SAAS,KAAK,CAAC,EAAU;IACvB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAC3D,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB;IACzC,2BAA2B;IAC3B,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,sBAAsB,EAAE;QACpD,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,MAAM,EAAE,kBAAkB;YAC1B,cAAc,EAAE,kBAAkB;YAClC,YAAY,EAAE,WAAW;SAC1B;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,SAAS,EAAE,uBAAuB;SACnC,CAAC;QACF,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;KACpC,CAAC,CAAC;IAEH,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;QAClB,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,sCAAsC,SAAS,CAAC,MAAM,MAAM,IAAI,EAAE,CAAC,CAAC;IACtF,CAAC;IAED,MAAM,MAAM,GAAG,CAAC,MAAM,SAAS,CAAC,IAAI,EAAE,CAAuB,CAAC;IAE9D,2CAA2C;IAC3C,OAAO,CAAC,GAAG,EAAE,CAAC;IACd,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC,CAAC;IACjD,OAAO,CAAC,GAAG,EAAE,CAAC;IACd,OAAO,CAAC,GAAG,CAAC,kCAAkC,CAAC,CAAC;IAChD,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC;IACxD,OAAO,CAAC,GAAG,EAAE,CAAC;IACd,OAAO,CAAC,GAAG,CAAC,sBAAsB,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IACxE,OAAO,CAAC,GAAG,EAAE,CAAC;IACd,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,gCAAgC,CAAC,CAAC,CAAC;IAEzD,WAAW,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;IAErC,oBAAoB;IACpB,IAAI,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,QAAQ,IAAI,CAAC,CAAC,GAAG,IAAI,EAAE,IAAI,CAAC,CAAC;IACjE,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,UAAU,IAAI,GAAG,CAAC,GAAG,IAAI,CAAC;IAEjE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,EAAE,CAAC;QAC9B,MAAM,KAAK,CAAC,YAAY,CAAC,CAAC;QAE1B,IAAI,QAAkB,CAAC;QACvB,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,KAAK,CAAC,gBAAgB,EAAE;gBACvC,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,MAAM,EAAE,kBAAkB;oBAC1B,cAAc,EAAE,kBAAkB;oBAClC,YAAY,EAAE,WAAW;iBAC1B;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACnB,SAAS,EAAE,uBAAuB;oBAClC,WAAW,EAAE,MAAM,CAAC,WAAW;oBAC/B,UAAU,EAAE,8CAA8C;iBAC3D,CAAC;gBACF,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;aACpC,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,8BAA8B;YAC9B,SAAS;QACX,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAkB,CAAC;QAExE,IAAI,IAAI,CAAC,KAAK,KAAK,uBAAuB;YAAE,SAAS;QAErD,IAAI,IAAI,CAAC,KAAK,KAAK,WAAW,EAAE,CAAC;YAC/B,4DAA4D;YAC5D,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC;YACzC,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,YAAY,GAAG,IAAI,EAAE,YAAY,GAAG,IAAI,CAAC,CAAC;YAClE,SAAS;QACX,CAAC;QAED,IAAI,IAAI,CAAC,KAAK,KAAK,eAAe,EAAE,CAAC;YACnC,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;QAC7E,CAAC;QACD,IAAI,IAAI,CAAC,KAAK,KAAK,eAAe,EAAE,CAAC;YACnC,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;QAC9C,CAAC;QACD,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CACb,sBAAsB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAClG,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;QACrD,CAAC;QAED,0CAA0C;QAC1C,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,mBAAmB,EAAE;YAC/C,OAAO,EAAE;gBACP,aAAa,EAAE,SAAS,IAAI,CAAC,YAAY,EAAE;gBAC3C,MAAM,EAAE,6BAA6B;gBACrC,YAAY,EAAE,WAAW;aAC1B;YACD,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;SACpC,CAAC,CAAC;QAEH,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;YAChB,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;YAClD,MAAM,IAAI,KAAK,CAAC,gCAAgC,OAAO,CAAC,MAAM,MAAM,IAAI,EAAE,CAAC,CAAC;QAC9E,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,CAAuB,CAAC;QAE1D,MAAM,IAAI,GAAe;YACvB,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,EAAE,EAAE,IAAI,CAAC,EAAE;YACX,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC,CAAC;QAEF,sDAAsD;QACtD,cAAc,CAAC,IAAI,CAAC,CAAC;QACrB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;AACrE,CAAC;AAED,8EAA8E;AAE9E;;;;;;;;;;GAUG;AACH,MAAM,UAAU,aAAa;IAC3B,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,QAAQ,CAAC,eAAe,EAAE;YACtC,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;YAC/B,OAAO,EAAE,KAAK;SACf,CAAC;aACC,QAAQ,EAAE;aACV,IAAI,EAAE,CAAC;QACV,iEAAiE;QACjE,IAAI,KAAK,IAAI,KAAK,CAAC,MAAM,GAAG,EAAE;YAAE,OAAO,KAAK,CAAC;QAC7C,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,KAAa;IAEb,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CACrB,wEAAwE,EACxE;YACE,OAAO,EAAE;gBACP,aAAa,EAAE,SAAS,KAAK,EAAE;gBAC/B,MAAM,EAAE,6BAA6B;gBACrC,YAAY,EAAE,WAAW;aAC1B;YACD,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;SACpC,CACF,CAAC;QACF,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,EAAE,CAAC;QACvB,MAAM,WAAW,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAGnC,CAAC;QACH,OAAO,WAAW;aACf,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC;aACjC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACX,KAAK,EAAE,CAAC,CAAC,YAAY,CAAC,KAAK;YAC3B,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,EAAE;SACtB,CAAC,CAAC,CAAC;IACR,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,+EAA+E;AAE/E;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,QAAgB,EAChB,IAAgB,EAChB,OAAoB,EAAE;IAEtB,MAAM,GAAG,GAAG,QAAQ,CAAC,UAAU,CAAC,UAAU,CAAC;QACzC,CAAC,CAAC,QAAQ;QACV,CAAC,CAAC,yBAAyB,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG,QAAQ,EAAE,CAAC;IAE9E,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;QAC3B,GAAG,IAAI;QACP,OAAO,EAAE;YACP,aAAa,EAAE,SAAS,IAAI,CAAC,YAAY,EAAE;YAC3C,MAAM,EAAE,6BAA6B;YACrC,YAAY,EAAE,WAAW;YACzB,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC;SACxB;QACD,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;KACnD,CAAC,CAAC;IAEH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QAE9C,gFAAgF;QAChF,IACE,GAAG,CAAC,MAAM,KAAK,GAAG;YAClB,QAAQ,CAAC,UAAU,CAAC,qBAAqB,CAAC;YAC1C,IAAI,CAAC,QAAQ,CAAC,4BAA4B,CAAC,EAC3C,CAAC;YACD,MAAM,IAAI,KAAK,CACb,mFAAmF;gBACnF,mEAAmE;gBACnE,qFAAqF;gBACrF,mBAAmB,CACpB,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,KAAK,CAAC,cAAc,GAAG,CAAC,MAAM,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC,CAAC;IACnE,CAAC;IAED,4BAA4B;IAC5B,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,SAAc,CAAC;IAC9C,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAM,CAAC;AACjC,CAAC"}
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EACL,YAAY,EACZ,aAAa,EACb,gBAAgB,EAChB,iBAAiB,EACjB,UAAU,GAGX,MAAM,uBAAuB,CAAC;AAE/B;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,eAAe,GAAsB;IAChD,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,WAAW;IAC7C,cAAc,EAAE,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,sBAAsB;IACvE,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,4BAA4B;IAC1E,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,wBAAwB;QACxC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC;QAC9C,CAAC,CAAC,IAAI;IACR,gBAAgB,EAAE,QAAQ;IAC1B,MAAM,EAAE,gBAAgB;CACzB,CAAC;AAWF;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,OAA8D,EAAE;IAEhE,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC;IAC7C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,eAAe,CAAC;IAE9C,MAAM,MAAM,GAAG,gBAAgB,EAAE,CAAC;IAClC,IAAI,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO,MAAM,CAAC;IAEjD,IAAI,MAAM,EAAE,CAAC;QACX,IAAI,CAAC;YACH,OAAO,MAAM,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;QAC1D,CAAC;QAAC,MAAM,CAAC;YACP,qEAAqE;YACrE,+BAA+B;QACjC,CAAC;IACH,CAAC;IAED,IAAI,CAAC,WAAW;QAAE,OAAO,IAAI,CAAC;IAE9B,IAAI,CAAC;QACH,OAAO,MAAM,YAAY,CAAC,MAAM,CAAC,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,MAAqB;IAChD,IAAI,CAAC;QACH,MAAM,CAAC,EAAE,UAAU,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACjD,IAAI,CAAC,UAAU;YAAE,OAAO,IAAI,CAAC;QAC7B,MAAM,GAAG,GAAG,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAC7D,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;QACzE,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,GAAG,GAAG,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAChE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAA4B,CAAC;QAC3D,OAAO;YACL,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC;YAC7B,KAAK,EAAE,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;YAClE,IAAI,EAAE,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;YAC/D,MAAM;SACP,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,yCAAyC;AACzC,MAAM,UAAU,OAAO;IACrB,iBAAiB,EAAE,CAAC;AACtB,CAAC"}

package/dist/fetch-template.d.ts

@@ -1,9 +1,14 @@
 /**
- * Fetch the HQ template from GitHub and extract it into targetDir.
+ * Fetch the hq-core scaffold from GitHub and extract it into targetDir.
+ *
+ * hq-core is the standalone scaffold seed (formerly the `template/` subdir of
+ * `indigoai-us/hq`). Its entire repository tree is the fresh-install content.
+ * Rich add-ons ship separately as `@indigoai-us/hq-pack-*` content packs
+ * installed by the next phase of create-hq via `hq install`.
  *
  * Strategy:
  * 1. GitHub REST API → download tarball_url
- * 2. Fallback: gh CLI (`gh api repos/indigoai-us/hq/tarball/{ref}`)
+ * 2. Fallback: gh CLI (`gh api repos/indigoai-us/hq-core/tarball/{ref}`)
  * 3. If both fail: throw with manual clone instructions
  *
  * Returns the version tag that was fetched.

package/dist/fetch-template.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fetch-template.d.ts","sourceRoot":"","sources":["../src/fetch-template.ts"],"names":[],"mappings":"AAsJA;;;;;;;;;GASG;AACH,wBAAsB,aAAa,CACjC,SAAS,EAAE,MAAM,EACjB,GAAG,CAAC,EAAE,MAAM,EACZ,UAAU,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,GACnC,OAAO,CAAC;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,CAyC9B"}
+{"version":3,"file":"fetch-template.d.ts","sourceRoot":"","sources":["../src/fetch-template.ts"],"names":[],"mappings":"AA+JA;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,aAAa,CACjC,SAAS,EAAE,MAAM,EACjB,GAAG,CAAC,EAAE,MAAM,EACZ,UAAU,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,GACnC,OAAO,CAAC;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,CAyC9B"}

package/dist/fetch-template.js

@@ -4,7 +4,12 @@ import * as os from "os";
 import { exec } from "child_process";
 import { promisify } from "util";
 const execAsync = promisify(exec);
-const REPO = "indigoai-us/hq";
+// Scaffold source: the hq-core repo IS the scaffold (its entire tree is the
+// starter content). This replaced the older `indigoai-us/hq` + `template/`
+// subdirectory pattern when the monorepo was split (hq-core v12+). Old tags
+// still on the `indigoai-us/hq` side will not resolve via this client — users
+// on those must use the matching create-hq pre-v12 release.
+const REPO = "indigoai-us/hq-core";
 function formatBytes(bytes) {
     if (bytes < 1024)
         return `${bytes} B`;
@@ -80,8 +85,9 @@ async function downloadAndExtractViaApi(tarballUrl, targetDir, onProgress) {
     }
 }
 async function extractTemplateDirFromTar(tarPath, targetDir, onProgress) {
-    // The tarball contains a top-level directory like `indigoai-us-hq-<sha>/`
-    // We need to find the `template/` subdirectory within that and extract it.
+    // The tarball contains a top-level directory like `indigoai-us-hq-core-<sha>/`.
+    // The hq-core repo IS the scaffold — every file in it becomes part of the
+    // new HQ instance. Copy the entire root directory's contents (not a subdir).
     const tmpExtract = await fs.mkdtemp(path.join(os.tmpdir(), "create-hq-extract-"));
     try {
         // Extract the full tarball to a temp location
@@ -92,14 +98,15 @@ async function extractTemplateDirFromTar(tarPath, targetDir, onProgress) {
             throw new Error("Tarball was empty");
         }
         const rootDir = path.join(tmpExtract, entries[0]);
-        const templateSrc = path.join(rootDir, "template");
-        if (!await fs.pathExists(templateSrc)) {
-            throw new Error("template/ directory not found in HQ tarball");
+        // Sanity check — hq-core must carry core.yaml at its root.
+        const coreYaml = path.join(rootDir, "core.yaml");
+        if (!await fs.pathExists(coreYaml)) {
+            throw new Error("core.yaml not found at tarball root — this does not look like an hq-core scaffold");
         }
-        // Copy template contents to targetDir
-        onProgress?.("Copying template files...");
+        // Copy the entire hq-core tree to targetDir
+        onProgress?.("Copying scaffold files...");
         await fs.ensureDir(targetDir);
-        await fs.copy(templateSrc, targetDir, { overwrite: true });
+        await fs.copy(rootDir, targetDir, { overwrite: true });
     }
     finally {
         await fs.remove(tmpExtract);
@@ -122,11 +129,16 @@ async function extractTemplateDirViaGhCli(tag, targetDir, onProgress) {
     }
 }
 /**
- * Fetch the HQ template from GitHub and extract it into targetDir.
+ * Fetch the hq-core scaffold from GitHub and extract it into targetDir.
+ *
+ * hq-core is the standalone scaffold seed (formerly the `template/` subdir of
+ * `indigoai-us/hq`). Its entire repository tree is the fresh-install content.
+ * Rich add-ons ship separately as `@indigoai-us/hq-pack-*` content packs
+ * installed by the next phase of create-hq via `hq install`.
  *
  * Strategy:
  * 1. GitHub REST API → download tarball_url
- * 2. Fallback: gh CLI (`gh api repos/indigoai-us/hq/tarball/{ref}`)
+ * 2. Fallback: gh CLI (`gh api repos/indigoai-us/hq-core/tarball/{ref}`)
  * 3. If both fail: throw with manual clone instructions
  *
  * Returns the version tag that was fetched.
@@ -162,13 +174,13 @@ export async function fetchTemplate(targetDir, tag, onProgress) {
         // Both failed — provide a clear error message.
         const apiMsg = apiError instanceof Error ? apiError.message : String(apiError);
         const ghMsg = ghErr instanceof Error ? ghErr.message : String(ghErr);
-        throw new Error(`Failed to fetch HQ template from GitHub.\n\n` +
+        throw new Error(`Failed to fetch hq-core scaffold from GitHub.\n\n` +
             `  GitHub API error: ${apiMsg}\n` +
             `  gh CLI error:     ${ghMsg}\n\n` +
             `You appear to be offline or rate-limited.\n` +
-            `To set up HQ manually, clone the repo and copy the template directory:\n\n` +
-            `  git clone https://github.com/indigoai-us/hq.git\n` +
-            `  cp -R hq/template ${targetDir}\n`);
+            `To set up HQ manually, clone the scaffold repo:\n\n` +
+            `  git clone https://github.com/indigoai-us/hq-core.git ${targetDir}\n` +
+            `  rm -rf ${targetDir}/.git\n`);
     }
 }
 //# sourceMappingURL=fetch-template.js.map