hub-launch 1.23.0 → 1.25.0

package/CHANGELOG.md

@@ -7,6 +7,41 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [1.25.0] - 2026-08-23
+
+### Added
+
+- New `hula error-watcher` command to manage production **Error Watchers** — inbound error webhooks that deduplicate reported errors and auto-launch a fix (PR, plan, or feedback run). Seven modes: `--create`, `--list`, `--show`, `--events`, `--update`, `--delete`, and `--print-setup`. `--create` and `--print-setup` print the steps to mint a project ingest key, a paste-ready `.env` block, and a hard-coded signed-request snippet that signs the exact `` `${timestamp}.${body}` `` payload the server verifies. Credentials resolve flags → `.hublaunch/hublaunch.config.js` → env, identical to `hula schedule`, and are never written to any file. `--events` shows each error's disposition (`deduped`, `skipped_environment`, `skipped_budget`, `skipped_credits`, `skipped_open_pr`, `launched`, `failed`) so "why was there no PR?" is answerable from the terminal; with no watcher id it covers every watcher on the project. Requires a hula-server with Error Watcher support; older servers return a clear "not supported yet" message. See [docs/error-watcher.md](./docs/error-watcher.md).
+- `--instructions`, `--error-env KEY=VALUE`, and `--secret <literal>` flags on `--create`/`--update` for the three watcher fields that shape what the fix agent sees: trusted guidance rendered into the agent's brief, environment variables injected into the fix sandbox, and extra literal values redacted from every payload. Each replaces the stored value wholesale, with matching `--clear-instructions` / `--clear-error-env` / `--clear-secrets` flags. Values are write-only — the server never echoes them back, and the CLI never prints them.
+- Optional `errorWebhookUrl` config key to override the Error Watcher ingest URL for self-hosted servers whose webhook host differs from `hulaProjectUrl`.
+
+### Changed
+
+- **Error Watcher ingest now authenticates on a project ingest key.** Matching the server, the credential a reporting app presents moved from the per-watcher `hew_` token to a project-level `hik_` key signing with its own `his_` secret. The generated `.env` block emits `HULA_INGEST_KEY` / `HULA_INGEST_SECRET` (was `HULA_ERROR_WATCHER_TOKEN` / `HULA_ERROR_WATCHER_SECRET`) and the snippet sends `X-Hula-Api-Key` (was `X-Hula-Watcher`). The watcher now holds configuration only; `--create` prints no credential of its own and instead directs you to **Projects → gear icon → Error reporting API keys**, the only place a key can be minted. **Any reporter wired up against an earlier build of this command must be updated or it will 401.**
+- The printed snippet now sends `errorName` and `errorCode` alongside `key`. The server's dedupe fingerprint is built from those three identity fields and nothing else, so a report carrying none of them shares a single bucket with every other such report — one fix per watcher per dedupe window.
+- `--events` with no watcher id lists the project's watchers and queries each one, merging the results newest-first. It previously requested a project-wide events route that does not exist on the server and always returned 404.
+- `--update` now rejects `--container-cpu`, `--container-memory`, `--container-disk`, `--update-notification-url`, and `--update-notification-name-tag` up front. The update endpoint ignores those fields, so sending them reported success while changing nothing; they remain settable at `--create`.
+- `--delete` no longer claims reports will start returning 401. Deleting a watcher revokes no credential — ingest keys keep authenticating, and the webhook answers 409 once the project has no enabled watcher left.
+- `--show` displays the watcher's `instructions` and no longer prints the vestigial watcher token prefix.
+- A `409` from the ingest webhook now maps to a specific message naming the cause ("no enabled error watcher is configured for this project") and the commands that fix it, instead of falling through to a generic status line.
+
+### Removed
+
+- `hula error-watcher --rotate`. It rotated the watcher's signing secret, which the ingest webhook no longer verifies, and its response handling did not match the server's shape. The signing secret that matters belongs to the project ingest key and is rotated from the dashboard settings page, which has no REST route for the CLI to call.
+
+## [1.24.0] - 2026-08-18
+
+### Fixed
+
+- Entitlement is now verified with the server on every launch instead of being cached indefinitely in local config. A cancelled subscription, an expired free trial, or exhausted PR credits no longer slips past the local gate only to fail later against the server. `usageTier` is now treated as a refreshable cache of the last server answer, consulted only when the server is unreachable.
+- Access-denied messages now reflect the account's actual subscription status — never subscribed (offers the free trial), cancelled, payment failed, or the server's status verbatim — instead of always claiming the user is on the free tier.
+- Billing and upgrade links point at the configured server's own dashboard rather than a hardcoded hublaunch.site, so preview and self-hosted deployments send users to their own billing page.
+- Chained hula skills (`/hula-plan` → confirm → launch) now execute inline explicitly, fixing the "blocked by disable-model-invocation" break under newer Claude Code versions that enforce that flag on model-initiated Skill-tool calls.
+
+### Changed
+
+- Prefer the server's own 402 response message and its `upgradeUrl` / `buyCreditsUrl` over anything the CLI infers, in both the single-repo and `--folder` launch paths.
+
 ## [1.23.0] - 2026-08-13
 
 ### Added

package/README.md

@@ -128,6 +128,7 @@ they're there when you want them:
 | `/hula-confirm`  | Re-validate a plan you've edited by hand                                             |
 | `/hula-upload`   | Sync a plan to `origin/main` (normally automatic during launch)                      |
 | `/hula-schedule` | Run or schedule autonomous actions (e.g. a nightly `harden` security audit)          |
+| `hula error-watcher` | Manage production Error Watchers — inbound error webhooks that auto-launch fix PRs |
 | `/hula-help`     | Interactive onboarding and reference — walks through setup, the workflow, or any command/skill |
 | `/hula-create`   | Legacy: create an issue without launching (the modern flow is `/hula-plan` → launch) |
 
@@ -135,6 +136,64 @@ Full details: [Commands Reference](./docs/commands.md) ·
 [Advanced Usage](./docs/advanced.md) (launch pipeline internals, resume,
 test mode, env forwarding, scheduling).
 
+## Error Watchers
+
+An **Error Watcher** is an inbound webhook: your production app reports an error
+to HubLaunch, HubLaunch deduplicates it, and — when the error is new — auto-launches
+a fix (a PR, a plan, or a feedback run). Manage watchers from the CLI:
+
+Reporting an error needs **two** pieces, created in different places:
+
+- the **watcher** — the configuration (dedupe window, environments, PR policy,
+  agent instructions), managed from the CLI;
+- a **project ingest key** — the credential your app presents (`hik_…` plus its
+  own signing secret `his_…`), created in the dashboard under **Projects → gear
+  icon → Error reporting API keys**.
+
+```bash
+# Create a watcher; prints where to mint the ingest key, a .env block, and a
+# ready-to-paste signed-request snippet.
+hula error-watcher --create --name api-prod
+
+# See what your watchers have been doing, and why each error did or didn't
+# launch a fix (omit the id to cover every watcher on the project)
+hula error-watcher --events
+
+# List, inspect, patch tuning, or delete
+hula error-watcher --list
+hula error-watcher --show <watcherId>
+hula error-watcher --update <watcherId> --max-fixes-per-day 10
+hula error-watcher --update <watcherId> --instructions "Never touch billing/"
+hula error-watcher --delete <watcherId>
+
+# Re-print the setup snippet at any time (placeholders only — no secrets, works offline)
+hula error-watcher --print-setup
+```
+
+Add the printed block to your production environment, filling in the key and
+secret from the dashboard:
+
+```bash
+HULA_ERROR_WEBHOOK_URL=https://www.hublaunch.site/api/v1/webhooks/error
+HULA_INGEST_KEY=hik_…
+HULA_INGEST_SECRET=his_…
+```
+
+The **key and secret are shown only once** and are never handled by the CLI —
+copy them into your deployment's secret store immediately. Every report is signed
+with `HMAC-SHA256` over `` `${timestamp}.${body}` `` (the exact payload the printed
+snippet produces) and sent as `X-Hula-Api-Key` + `X-Hula-Signature`. Rotate the
+secret from the same settings page; the previous one keeps verifying for 24 hours.
+
+Send at least a `key`, `errorName`, or `errorCode` with every report — the dedupe
+fingerprint is built from those three fields alone, and a report carrying none of
+them shares one bucket with every other such report.
+
+A `409` means the key is valid but the project has no enabled watcher; create one
+with `--create`. Requires a hula-server with Error Watcher support; older servers
+return a clear "not supported yet" message. Full reference:
+[docs/error-watcher.md](./docs/error-watcher.md).
+
 ## Multi-repo feature groups
 
 A feature that spans several repositories — say a mobile app plus its backend

package/dist/commands/errorWatcher.d.ts

@@ -0,0 +1,147 @@
+import type { Command } from 'commander';
+import type { Config } from '../types/index.js';
+export interface ErrorWatcherOptions {
+    create?: boolean;
+    list?: boolean;
+    show?: string;
+    /** `--events [watcherId]`: `true` (all watchers) or a specific watcher id. */
+    events?: string | boolean;
+    update?: string;
+    delete?: string;
+    /** `--print-setup [watcherId]`: the id is informational only. */
+    printSetup?: string | boolean;
+    name?: string;
+    dedupeWindow?: number;
+    maxFixesPerDay?: number;
+    environments?: string;
+    outcomeType?: string;
+    prPolicy?: string;
+    enabled?: string;
+    /** Trusted guidance rendered into the fix agent's brief. */
+    instructions?: string;
+    /** Clear the stored instructions (sends `instructions: null`). */
+    clearInstructions?: boolean;
+    /** Repeatable `KEY=VALUE` env vars injected into the fix sandbox. */
+    errorEnv?: string[];
+    /** Clear all errorEnvVars (sends an empty map). */
+    clearErrorEnv?: boolean;
+    /** Repeatable literal values redacted from every payload for this watcher. */
+    secret?: string[];
+    /** Clear the extra redaction list (sends an empty array). */
+    clearSecrets?: boolean;
+    status?: string;
+    limit?: number;
+    provider?: string;
+    providerKey?: string;
+    containerCpu?: number;
+    containerMemory?: number;
+    containerDisk?: number;
+    updateNotificationUrl?: string;
+    updateNotificationNameTag?: string;
+    project?: string;
+    url?: string;
+    apiKey?: string;
+    json?: boolean;
+    yes?: boolean;
+}
+/** The mutually-exclusive command modes, in dispatch order. */
+export type WatcherMode = 'create' | 'list' | 'show' | 'events' | 'update' | 'delete' | 'print-setup';
+/**
+ * Manage production Error Watchers — thin REST client over
+ * `/api/v1/error-watchers`, structured like `hula schedule`.
+ */
+export declare function errorWatcherCommand(program: Command, config: Config): void;
+/**
+ * Commander collector for a repeatable flag. `previous` is undefined on the
+ * first occurrence, which is what lets a caller distinguish "flag omitted"
+ * (undefined) from "flag given" — the distinction PATCH relies on to leave a
+ * field untouched rather than clearing it.
+ */
+export declare function collectRepeatable(value: string, previous?: string[]): string[];
+/**
+ * Which mode flags are active. `--events` and `--print-setup` count when
+ * present even without a value (`true`); every other flag counts when truthy.
+ */
+export declare function selectModes(options: ErrorWatcherOptions): WatcherMode[];
+/**
+ * Dispatch a single mode. Enforces mutual exclusion BEFORE any network call, so
+ * two mode flags fail without issuing a request. With no mode flag, prints help.
+ */
+export declare function runErrorWatcher(config: Config, options: ErrorWatcherOptions, showHelp?: () => void): Promise<void>;
+/**
+ * The ingest webhook URL the customer's production app POSTs to. Defaults to
+ * `<serverUrl>/api/v1/webhooks/error`, overridable via `config.errorWebhookUrl`
+ * for self-hosted servers whose webhook host differs from `hulaProjectUrl`.
+ */
+export declare function resolveWebhookUrl(serverUrl: string, config: Config): string;
+/**
+ * Where a project ingest key (`hik_…`) is minted. Key CRUD is exposed over
+ * tRPC only — there is no REST route for the CLI to call — so every setup path
+ * points the user at this page rather than pretending to issue a credential.
+ */
+export declare function resolveProjectSettingsUrl(serverUrl: string): string;
+/**
+ * Validate tuning flags client-side so the common mistakes are caught without a
+ * network round trip. Returns a list of error strings (empty when all valid).
+ * The server validates independently; this is a convenience, not the boundary.
+ */
+export declare function validateTuningOptions(options: ErrorWatcherOptions): string[];
+/**
+ * Validate the repeatable `--error-env KEY=VALUE` pairs. Reserved names are
+ * rejected here because the server returns a 400 for them, and the platform
+ * owns those variables inside the fix sandbox.
+ */
+export declare function validateErrorEnv(entries: string[] | undefined): string[];
+/**
+ * Validate the repeatable `--secret` values. The minimum length is the server's
+ * floor: a very short literal would match everywhere and shred the very error
+ * text the fix agent needs.
+ */
+export declare function validateSecrets(entries: string[] | undefined): string[];
+/** Parse validated `KEY=VALUE` entries into the map the server expects. */
+export declare function parseErrorEnv(entries: string[]): Record<string, string>;
+/**
+ * The signed-request snippet. HARD-CODED (never fetched) so `--print-setup`
+ * works with the server unreachable. Built line-by-line from single/double
+ * quoted strings so the literal `${timestamp}.${body}` signing payload survives
+ * verbatim into the printed output (it must NOT be interpolated here).
+ */
+export declare function buildSigningSnippet(): string;
+/**
+ * The `.env` block for the customer's production environment.
+ *
+ * The credential is the PROJECT ingest key (`hik_…`) and its own signing secret
+ * (`his_…`), minted in the dashboard settings page — not the watcher. The CLI
+ * never holds either value, so both are always placeholders.
+ */
+export declare function buildEnvBlock(webhookUrl: string): string;
+/**
+ * Print the wiring steps for a watcher: mint the project ingest key, set the
+ * env vars, paste the signed-request snippet.
+ *
+ * The CLI deliberately prints no credential of its own. Ingest keys are created
+ * over tRPC from the dashboard and have no REST route, so the only honest thing
+ * the CLI can do is say where to get one. The watcher `hew_`/`hes_` values the
+ * create endpoint still returns authenticate nothing and are never shown.
+ */
+export declare function printSetupInstructions(serverUrl: string, webhookUrl: string): void;
+/**
+ * One-line rendering of the watcher's `instructions`. Long guidance is elided
+ * rather than wrapped so the field stays one row in the detail block.
+ */
+export declare function summarizeInstructions(instructions: string | null | undefined, maxLen?: number): string;
+/** Humanize a duration in seconds: 300 → 5m, 3600 → 1h, 86400 → 24h, 604800 → 7d. */
+export declare function humanizeDuration(seconds: number): string;
+/** Relative time such as "12m ago" for an ISO timestamp. */
+export declare function relativeTime(iso: string): string;
+/**
+ * Map server responses to actionable messages. NEVER echoes the Authorization
+ * header, the watcher token, or the secret — none of those are read from the
+ * error object, so no redaction pass is needed. Re-throws non-axios errors for
+ * the caller's outer handler.
+ */
+export declare function handleWatcherApiError(error: unknown, serverUrl: string, ctx?: {
+    project?: string;
+    watcherId?: string;
+}): void;
+//# sourceMappingURL=errorWatcher.d.ts.map

package/dist/commands/errorWatcher.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errorWatcher.d.ts","sourceRoot":"","sources":["../../src/commands/errorWatcher.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAKzC,OAAO,KAAK,EACV,MAAM,EAIP,MAAM,mBAAmB,CAAC;AAiD3B,MAAM,WAAW,mBAAmB;IAElC,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,8EAA8E;IAC9E,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IAC1B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,iEAAiE;IACjE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IAG9B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,4DAA4D;IAC5D,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,kEAAkE;IAClE,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,qEAAqE;IACrE,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,mDAAmD;IACnD,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,8EAA8E;IAC9E,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,6DAA6D;IAC7D,YAAY,CAAC,EAAE,OAAO,CAAC;IAGvB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IAGf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,yBAAyB,CAAC,EAAE,MAAM,CAAC;IACnC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,GAAG,CAAC,EAAE,OAAO,CAAC;CACf;AAED,+DAA+D;AAC/D,MAAM,MAAM,WAAW,GACnB,QAAQ,GACR,MAAM,GACN,MAAM,GACN,QAAQ,GACR,QAAQ,GACR,QAAQ,GACR,aAAa,CAAC;AAElB;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CA4H1E;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,MAAM,EACb,QAAQ,CAAC,EAAE,MAAM,EAAE,GAClB,MAAM,EAAE,CAEV;AAED;;;GAGG;AACH,wBAAgB,WAAW,CAAC,OAAO,EAAE,mBAAmB,GAAG,WAAW,EAAE,CAUvE;AAED;;;GAGG;AACH,wBAAsB,eAAe,CACnC,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,mBAAmB,EAC5B,QAAQ,CAAC,EAAE,MAAM,IAAI,GACpB,OAAO,CAAC,IAAI,CAAC,CAwCf;AA4BD;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAE3E;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAEnE;AAWD;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,mBAAmB,GAAG,MAAM,EAAE,CAgF5E;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,SAAS,GAAG,MAAM,EAAE,CAuCxE;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,SAAS,GAAG,MAAM,EAAE,CAiBvE;AAED,2EAA2E;AAC3E,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAQvE;AA+ED;;;;;GAKG;AACH,wBAAgB,mBAAmB,IAAI,MAAM,CA2C5C;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAOxD;AA+BD;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CACpC,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,GACjB,IAAI,CAgBN;AAydD;;;GAGG;AACH,wBAAgB,qBAAqB,CACnC,YAAY,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACvC,MAAM,SAAK,GACV,MAAM,CAKR;AAED,qFAAqF;AACrF,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAKxD;AAMD,4DAA4D;AAC5D,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAWhD;AAaD;;;;;GAKG;AACH,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,OAAO,EACd,SAAS,EAAE,MAAM,EACjB,GAAG,GAAE;IAAE,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAO,GACjD,IAAI,CAoFN"}

package/dist/commands/errorWatcher.fixture.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Signing fixture for the reporter snippet the CLI prints.
+ *
+ * The CLI does not sign anything itself — it prints a snippet the customer
+ * pastes into their app. This fixture pins the algorithm that snippet
+ * documents, so a careless edit to `buildSigningSnippet()` fails here rather
+ * than surfacing as an unexplained production `401`.
+ *
+ * Signing payload: `${timestamp}.${body}` — the request timestamp, a literal
+ * `.`, then the raw JSON body. Signing the body alone (dropping the timestamp
+ * prefix) removes replay protection and is the exact mistake the snippet and
+ * this fixture guard against.
+ *
+ * The secret is the PROJECT ingest key's signing secret (`his_…`), minted with
+ * the key in the dashboard settings page. The per-watcher `hes_…` secret this
+ * fixture used to model no longer authenticates anything.
+ */
+export declare const WATCHER_SIGNATURE_FIXTURE: {
+    /** Test signing secret. NEVER a real credential. */
+    readonly secret: "his_test_secret_do_not_use_in_production";
+    /** Unix seconds, as sent in the `X-Hula-Timestamp` header. */
+    readonly timestamp: "1734556800";
+    /**
+     * The exact raw request body that was signed. Carries all three dedupe
+     * identity fields (`key`, `errorName`, `errorCode`) because those — and only
+     * those — build the server's fingerprint.
+     */
+    readonly body: "{\"errorDescription\":\"Payment gateway timed out\",\"key\":\"orders.checkout.timeout\",\"errorName\":\"TimeoutError\",\"errorCode\":\"ETIMEDOUT\",\"environment\":\"production\"}";
+    /** HMAC-SHA256(secret, `${timestamp}.${body}`) as lowercase hex. */
+    readonly signatureHex: "fe747ddcc36a1405b9ecc417328fbfdb0459d5c7d4d3b0528b47eed0c0b17045";
+};
+//# sourceMappingURL=errorWatcher.fixture.d.ts.map

package/dist/commands/errorWatcher.fixture.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errorWatcher.fixture.d.ts","sourceRoot":"","sources":["../../src/commands/errorWatcher.fixture.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,yBAAyB;IACpC,oDAAoD;;IAEpD,8DAA8D;;IAE9D;;;;OAIG;;IAEH,oEAAoE;;CAG5D,CAAC"}

package/dist/commands/errorWatcher.fixture.js

@@ -0,0 +1,32 @@
+/**
+ * Signing fixture for the reporter snippet the CLI prints.
+ *
+ * The CLI does not sign anything itself — it prints a snippet the customer
+ * pastes into their app. This fixture pins the algorithm that snippet
+ * documents, so a careless edit to `buildSigningSnippet()` fails here rather
+ * than surfacing as an unexplained production `401`.
+ *
+ * Signing payload: `${timestamp}.${body}` — the request timestamp, a literal
+ * `.`, then the raw JSON body. Signing the body alone (dropping the timestamp
+ * prefix) removes replay protection and is the exact mistake the snippet and
+ * this fixture guard against.
+ *
+ * The secret is the PROJECT ingest key's signing secret (`his_…`), minted with
+ * the key in the dashboard settings page. The per-watcher `hes_…` secret this
+ * fixture used to model no longer authenticates anything.
+ */
+export const WATCHER_SIGNATURE_FIXTURE = {
+    /** Test signing secret. NEVER a real credential. */
+    secret: 'his_test_secret_do_not_use_in_production',
+    /** Unix seconds, as sent in the `X-Hula-Timestamp` header. */
+    timestamp: '1734556800',
+    /**
+     * The exact raw request body that was signed. Carries all three dedupe
+     * identity fields (`key`, `errorName`, `errorCode`) because those — and only
+     * those — build the server's fingerprint.
+     */
+    body: '{"errorDescription":"Payment gateway timed out","key":"orders.checkout.timeout","errorName":"TimeoutError","errorCode":"ETIMEDOUT","environment":"production"}',
+    /** HMAC-SHA256(secret, `${timestamp}.${body}`) as lowercase hex. */
+    signatureHex: 'fe747ddcc36a1405b9ecc417328fbfdb0459d5c7d4d3b0528b47eed0c0b17045',
+};
+//# sourceMappingURL=errorWatcher.fixture.js.map

package/dist/commands/errorWatcher.fixture.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errorWatcher.fixture.js","sourceRoot":"","sources":["../../src/commands/errorWatcher.fixture.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG;IACvC,oDAAoD;IACpD,MAAM,EAAE,0CAA0C;IAClD,8DAA8D;IAC9D,SAAS,EAAE,YAAY;IACvB;;;;OAIG;IACH,IAAI,EAAE,gKAAgK;IACtK,oEAAoE;IACpE,YAAY,EACV,kEAAkE;CAC5D,CAAC"}