@indigoai-us/hq-cli 5.108.25 → 5.109.0

package/dist/commands/access.js

@@ -0,0 +1,783 @@
+/**
+ * `hq access <path-or-query>` — existence + ACL probe with a self-healing
+ * ladder: resolve, list, probe ACL, then (with --fix) download / pin / repair
+ * sync or request access from the grantor.
+ *
+ * Tells a teammate whether a vault file exists and whether they can read it,
+ * so they never see a bare not-found.
+ *
+ * Vending uses the multi-tenant STS route `vaultClient.sts.vend({ companyUid })`
+ * (`/sts/vend`). The legacy `POST /vend` is never used — it assumes a single
+ * static BUCKET_ARN that is unset in multi-tenant prod.
+ *
+ * Company vault keys are company-relative; the CLI speaks the anchored form
+ * `companies/<slug>/...` for display.
+ */
+import chalk from "chalk";
+import * as fs from "node:fs";
+import * as path from "node:path";
+import * as readline from "node:readline";
+import { ListObjectsV2Command, } from "@aws-sdk/client-s3";
+import { DEFAULT_HQ_ROOT } from "../utils/cognito-session.js";
+import { getCompanyUid, vaultApiFetch, resolveCallerPersonUid } from "../utils/vault-api.js";
+import { parseCompanySlugFromPath, resolveBrowseSession, makeCompanyPresignFactory, runGet, } from "./files-browse.js";
+import { listJournals, syncDoctor, } from "@indigoai-us/hq-cloud";
+import { listActiveMembers } from "./members.js";
+import { buildDmBody } from "./dm.js";
+import { peekIdToken } from "../utils/id-token.js";
+import { findRecentAccessRequest, formatTimeAgo, recordAccessRequest, } from "../utils/access-requests.js";
+export function outcomeExitCode(outcome) {
+    if (outcome === "local" || outcome === "not-synced")
+        return 0;
+    if (outcome === "never-existed")
+        return 2;
+    if (outcome === "no-access" || outcome === "pending-confirmation")
+        return 3;
+    return 4;
+}
+export function formatAccessOutcome(result) {
+    const lines = [];
+    switch (result.outcome) {
+        case "never-existed":
+            lines.push(`This path was never created in the ${result.company} vault.`);
+            lines.push(`Looked up: ${result.path}`);
+            break;
+        case "local":
+            lines.push(`The file is local under your HQ tree.`);
+            lines.push(result.path);
+            break;
+        case "not-synced":
+            lines.push(`The file exists in the vault but is not synced locally.`);
+            lines.push(result.path);
+            break;
+        case "no-access":
+            lines.push(`The file exists in the vault, but you do not have read access.`);
+            lines.push(result.path);
+            break;
+        case "pending-confirmation":
+            lines.push(`Ask the grantor for read access to this path.`);
+            lines.push(result.path);
+            break;
+        case "ambiguous":
+            lines.push(`Several vault keys match that query. Pick one and re-run:`);
+            for (const c of result.candidates ?? []) {
+                lines.push(`  ${c}`);
+            }
+            break;
+    }
+    if (result.fixed && result.localPath) {
+        lines.push(`now local at ${result.localPath}`);
+    }
+    if (result.requestNote) {
+        lines.push(result.requestNote);
+    }
+    for (const step of result.steps) {
+        lines.push(`  - ${step}`);
+    }
+    return lines.join("\n");
+}
+function normalizeTarget(raw, slug) {
+    let t = raw.trim();
+    if (t.startsWith("./"))
+        t = t.slice(2);
+    t = t.replace(/^\/+/, "");
+    const anchor = `companies/${slug}/`;
+    if (t.startsWith(anchor))
+        t = t.slice(anchor.length);
+    return t;
+}
+function httpStatusOf(err) {
+    if (!err || typeof err !== "object")
+        return undefined;
+    const rec = err;
+    if (typeof rec.status === "number")
+        return rec.status;
+    if (typeof rec.$metadata?.httpStatusCode === "number") {
+        return rec.$metadata.httpStatusCode;
+    }
+    return undefined;
+}
+/**
+ * List under `prefix`. A 403 from the list route (`/v1/files/list`) means the
+ * caller cannot enumerate the prefix — surfaced as `{ denied: true }` so the
+ * caller maps it to outcome `no-access` (exit 3) instead of a bare error.
+ */
+async function listKeys(s3, bucket, prefix) {
+    try {
+        return { keys: await listKeysOrThrow(s3, bucket, prefix), denied: false };
+    }
+    catch (err) {
+        if (httpStatusOf(err) === 403)
+            return { keys: [], denied: true };
+        throw err;
+    }
+}
+async function listKeysOrThrow(s3, bucket, prefix) {
+    const keys = [];
+    let continuationToken;
+    do {
+        const resp = (await s3.send(new ListObjectsV2Command({
+            Bucket: bucket,
+            Prefix: prefix,
+            ContinuationToken: continuationToken,
+        })));
+        for (const obj of resp.Contents ?? []) {
+            if (!obj.Key)
+                continue;
+            if (obj.Key.endsWith("/") && (obj.Size ?? 0) === 0)
+                continue;
+            keys.push(obj.Key);
+        }
+        continuationToken = resp.NextContinuationToken ?? undefined;
+    } while (continuationToken);
+    return keys;
+}
+function treeIsEmpty(tree) {
+    const noDirect = tree.directRow == null;
+    const noInherited = !tree.inherited || tree.inherited.length === 0;
+    const noChildren = !tree.children || tree.children.length === 0;
+    return noDirect && noInherited && noChildren;
+}
+function aclDenied(tree) {
+    if (!tree)
+        return false;
+    if (treeIsEmpty(tree))
+        return false;
+    const perm = tree.effectivePermission;
+    return perm === null || perm === "none" || perm === "deny";
+}
+function finish(outcome, fields) {
+    return { outcome, exitCode: outcomeExitCode(outcome), ...fields };
+}
+export function resolveGrantor(tree, members) {
+    const creatorUid = tree?.directRow?.creatorUid;
+    if (creatorUid) {
+        const creator = members.find((m) => m.personUid === creatorUid);
+        if (creator) {
+            return {
+                personUid: creator.personUid,
+                email: creator.personEmail,
+                name: creator.personName,
+                source: "acl-creator",
+            };
+        }
+    }
+    const owner = members.find((m) => m.role === "owner");
+    if (owner) {
+        return {
+            personUid: owner.personUid,
+            email: owner.personEmail,
+            name: owner.personName,
+            source: "owner",
+        };
+    }
+    const admin = members.find((m) => m.role === "admin");
+    if (admin) {
+        return {
+            personUid: admin.personUid,
+            email: admin.personEmail,
+            name: admin.personName,
+            source: "admin",
+        };
+    }
+    return null;
+}
+function grantorLabel(g) {
+    const name = g.name ? `${g.name} ` : "";
+    return `${name}${g.email}`.trim();
+}
+export async function runAccess(input) {
+    const { deps, json } = input;
+    const log = deps.log ?? ((line) => console.log(line));
+    const stderr = deps.stderr ?? ((line) => console.error(line));
+    const slug = deps.companySlug;
+    const steps = [];
+    const relative = normalizeTarget(input.target, slug);
+    const anchored = (key) => `companies/${slug}/${key}`;
+    let vendDenied = false;
+    try {
+        await deps.vaultClient.sts.vend({ companyUid: deps.companyUid });
+        steps.push("vend: ok");
+    }
+    catch (err) {
+        const status = httpStatusOf(err);
+        if (status === 403) {
+            vendDenied = true;
+            steps.push("vend: 403 (no-access)");
+        }
+        else if (status === 404) {
+            steps.push("vend: 404");
+        }
+        else {
+            throw err;
+        }
+    }
+    const entity = await deps.vaultClient.entity.findInMyNamespace("company", slug);
+    const bucket = entity?.bucketName ?? `hq-vault-cmp-${slug}`;
+    const s3 = deps.companyClient({ companyUid: deps.companyUid });
+    let listDenied = false;
+    const prefixList = await listKeys(s3, bucket, relative);
+    const exact = prefixList.keys.find((k) => k === relative);
+    let key;
+    if (prefixList.denied) {
+        // The server refused to enumerate — the caller has no read on this
+        // prefix. Keep the target as the key so the request rung can still name
+        // it for the grantor.
+        listDenied = true;
+        key = relative;
+        steps.push("list: 403 (no-access)");
+    }
+    else if (exact) {
+        key = exact;
+        steps.push("resolve: exact key");
+        steps.push("list: 1 hit");
+    }
+    else {
+        const allList = await listKeys(s3, bucket, "");
+        const q = relative.toLowerCase();
+        // A root-list 403 only says the caller cannot enumerate the WHOLE bucket.
+        // The prefix list above succeeded, so fuzzy-match within it first; the
+        // root denial is the verdict only when the readable prefix has no match.
+        const pool = allList.denied ? prefixList.keys : allList.keys;
+        const fuzzy = pool.filter((k) => k.toLowerCase().includes(q));
+        if (allList.denied && fuzzy.length === 0) {
+            listDenied = true;
+            key = relative;
+            steps.push("list: 403 (no-access)");
+        }
+        else if (fuzzy.length === 0) {
+            steps.push("list: 0 hits");
+            const result = finish("never-existed", {
+                path: anchored(relative) || input.target,
+                company: slug,
+                exists: false,
+                steps,
+            });
+            emit(input, result, log);
+            return result;
+        }
+        else if (fuzzy.length === 1) {
+            key = fuzzy[0];
+            steps.push("resolve: fuzzy (1 hit)");
+            steps.push("list: 1 hit");
+        }
+        else {
+            const candidates = fuzzy.map(anchored);
+            steps.push(`list: ${fuzzy.length} hits`);
+            let picked = null;
+            if (deps.pick) {
+                picked = await deps.pick(candidates);
+            }
+            if (!picked) {
+                const result = finish("ambiguous", {
+                    path: input.target,
+                    company: slug,
+                    exists: false,
+                    candidates,
+                    steps,
+                });
+                emit(input, result, log);
+                return result;
+            }
+            const stripped = normalizeTarget(picked, slug);
+            key = stripped;
+            steps.push("resolve: pick");
+        }
+    }
+    const resolvedKey = key;
+    const resolvedPath = anchored(resolvedKey);
+    const tree = await deps.fetchAclTree(resolvedKey);
+    let noAccess = vendDenied || listDenied;
+    if (tree == null || treeIsEmpty(tree)) {
+        steps.push("acl: no record (membership-distributed)");
+    }
+    else if (aclDenied(tree)) {
+        noAccess = true;
+        steps.push("acl: deny");
+    }
+    else {
+        steps.push(`acl: ${tree.effectivePermission ?? "ok"}`);
+    }
+    if (vendDenied || listDenied) {
+        noAccess = true;
+    }
+    const onDisk = fs.existsSync(path.join(deps.hqRoot, "companies", slug, resolvedKey));
+    steps.push(onDisk ? "disk: present" : "disk: missing");
+    let outcome;
+    if (noAccess) {
+        outcome = "no-access";
+    }
+    else if (onDisk) {
+        outcome = "local";
+    }
+    else {
+        outcome = "not-synced";
+    }
+    let fixed;
+    let localPath;
+    if (outcome === "not-synced" && input.fix === true && !noAccess) {
+        const absLocal = path.join(deps.hqRoot, "companies", slug, resolvedKey);
+        const getFn = deps.get ??
+            ((anchoredPath) => runGet({
+                path: anchoredPath,
+                hqRoot: deps.hqRoot,
+                companySlug: slug,
+                vaultClient: deps.vaultClient,
+                companyClient: deps.companyClient,
+                region: deps.region,
+            }));
+        const statusFn = deps.syncStatus ??
+            (async () => {
+                const journals = listJournals();
+                if (journals.length === 0)
+                    return "no sync journal yet";
+                let files = 0;
+                for (const j of journals) {
+                    const entries = Object.entries(j.journal.files ?? {});
+                    files += entries.filter(([, e]) => !e.removedAt).length;
+                }
+                return `${journals.length} journals, ${files} files tracked`;
+            });
+        const doctorFn = deps.syncDoctor ??
+            (async (apply) => {
+                const result = await syncDoctor({
+                    entity: "local",
+                    vaultConfig: {},
+                    hqRoot: deps.hqRoot,
+                    yes: apply,
+                    reconcileConflicts: true,
+                });
+                const twins = result.conflictTwins?.plan?.length ?? 0;
+                const bulkRefused = Boolean(result.plan?.bulkRefused);
+                return {
+                    twins,
+                    summary: `${twins} conflict twins`,
+                    bulkRefused,
+                    breakerMessage: bulkRefused
+                        ? "bulk-asymmetry circuit-breaker tripped — refusing the delete leg"
+                        : undefined,
+                };
+            });
+        const applyGetSuccess = (label) => {
+            steps.push(`${label}: ok ${absLocal}`);
+            outcome = "local";
+            fixed = true;
+            localPath = absLocal;
+        };
+        try {
+            await getFn(resolvedPath);
+            applyGetSuccess("get");
+        }
+        catch (err) {
+            const status = httpStatusOf(err);
+            const message = err instanceof Error ? err.message : String(err);
+            if (status === 403) {
+                steps.push(`get: failed ${message}`);
+                outcome = "no-access";
+            }
+            else {
+                steps.push(`get: failed ${message}`);
+                const statusSummary = await statusFn();
+                steps.push(`sync status: ${statusSummary}`);
+                const dry = await doctorFn(false);
+                steps.push(`sync doctor (dry-run): ${dry.summary}`);
+                if (dry.bulkRefused) {
+                    if (dry.breakerMessage) {
+                        steps.push(dry.breakerMessage);
+                    }
+                    steps.push("sync doctor: circuit-breaker — aborting repair (never override; see policy hq-sync-bulk-asymmetry-breaker-means-abort)");
+                }
+                else {
+                    if (dry.twins > 0) {
+                        const applied = await doctorFn(true);
+                        steps.push(`sync doctor (apply): ${applied.summary}`);
+                    }
+                    try {
+                        await getFn(resolvedPath);
+                        applyGetSuccess("get (retry)");
+                    }
+                    catch (retryErr) {
+                        const retryMsg = retryErr instanceof Error ? retryErr.message : String(retryErr);
+                        steps.push(`get (retry): failed ${retryMsg}`);
+                    }
+                }
+            }
+        }
+    }
+    let grantor;
+    let requestSentAt;
+    let alreadyAskedAt;
+    let requestNote;
+    if (outcome === "no-access" && input.fix === true) {
+        if (!deps.dm) {
+            steps.push("request: no dm transport");
+        }
+        else {
+            const members = await deps.listMembers();
+            const resolved = resolveGrantor(tree, members);
+            if (!resolved) {
+                steps.push("request: no grantor found");
+                requestNote = "No grantor found. Contact a company owner.";
+            }
+            else {
+                grantor = resolved;
+                const grantorLine = `Grantor: ${grantorLabel(resolved)} (${resolved.source})`;
+                // The recipient is always shown BEFORE any send. Under --json stdout is
+                // reserved for the single JSON object, so the line goes to stderr.
+                if (json)
+                    stderr(grantorLine);
+                else
+                    log(grantorLine);
+                const nowMs = (deps.now ?? Date.now)();
+                const recent = findRecentAccessRequest(deps.hqRoot, {
+                    requester: deps.requester.email,
+                    prefix: resolvedKey,
+                    company: slug,
+                    grantor: resolved.email,
+                    now: nowMs,
+                });
+                if (recent) {
+                    alreadyAskedAt = recent.sentAt;
+                    const ago = formatTimeAgo(recent.sentAt, nowMs);
+                    const who = resolved.name ?? resolved.email;
+                    requestNote = `already asked ${who} ${ago}`;
+                    steps.push(`request: already asked ${resolved.email}`);
+                }
+                else {
+                    const question = `Ask ${grantorLabel(resolved)} for read access to ${resolvedKey}?`;
+                    const yes = input.yes === true;
+                    let approved = false;
+                    if (yes) {
+                        approved = true;
+                    }
+                    else if (json) {
+                        outcome = "pending-confirmation";
+                        steps.push("request: pending confirmation");
+                    }
+                    else if (!deps.confirm) {
+                        log(question);
+                        log("Re-run with --yes to send.");
+                        steps.push("request: confirmation unavailable");
+                    }
+                    else {
+                        approved = await deps.confirm(question);
+                        if (!approved) {
+                            requestNote = "not sent";
+                            steps.push("request: declined");
+                        }
+                    }
+                    if (approved && outcome === "no-access") {
+                        const message = `${deps.requester.email} is asking for read access to ${resolvedKey} in ${slug}.`;
+                        const prompt = `hq files share ${resolvedKey} --with ${deps.requester.email} --permission read --company ${slug}`;
+                        const sent = await deps.dm.send({
+                            recipient: resolved.email,
+                            message,
+                            prompt,
+                        });
+                        const sentAt = new Date(nowMs).toISOString();
+                        requestSentAt = sentAt;
+                        try {
+                            recordAccessRequest(deps.hqRoot, {
+                                requester: deps.requester.email,
+                                prefix: resolvedKey,
+                                company: slug,
+                                grantor: resolved.email,
+                                sentAt,
+                                eventId: sent.eventId,
+                            });
+                        }
+                        catch (err) {
+                            // The DM is already out. Never let a ledger failure hide that
+                            // from the caller or crash the run after the side effect.
+                            const msg = err instanceof Error ? err.message : String(err);
+                            steps.push(`ledger: write failed after send — ${msg}`);
+                            stderr(`Warning: the request was sent but could not be recorded (${msg}); the next run may ask again.`);
+                        }
+                        steps.push(`request: sent to ${resolved.email} (eventId ${sent.eventId})`);
+                        const who = resolved.name ?? resolved.email;
+                        requestNote = `asked ${who}, you will get a DM when granted`;
+                    }
+                }
+            }
+        }
+    }
+    const result = finish(outcome, {
+        path: resolvedPath,
+        company: slug,
+        exists: true,
+        steps,
+        ...(fixed ? { fixed, localPath } : {}),
+        ...(grantor ? { grantor } : {}),
+        ...(requestSentAt ? { requestSentAt } : {}),
+        ...(alreadyAskedAt ? { alreadyAskedAt } : {}),
+        ...(requestNote ? { requestNote } : {}),
+    });
+    emit(input, result, log);
+    return result;
+}
+function emit(input, result, log) {
+    if (input.json) {
+        const payload = {
+            outcome: result.outcome,
+            path: result.path,
+            company: result.company,
+            exists: result.exists,
+            steps: result.steps,
+        };
+        if (result.grantor)
+            payload.grantor = result.grantor;
+        if (result.candidates)
+            payload.candidates = result.candidates;
+        if (result.fixed)
+            payload.fixed = result.fixed;
+        if (result.localPath)
+            payload.localPath = result.localPath;
+        if (result.requestSentAt)
+            payload.requestSentAt = result.requestSentAt;
+        if (result.alreadyAskedAt)
+            payload.alreadyAskedAt = result.alreadyAskedAt;
+        log(JSON.stringify(payload, null, 2));
+    }
+    else {
+        log(formatAccessOutcome(result));
+    }
+}
+function readActiveCompany(hqRoot) {
+    try {
+        const raw = fs.readFileSync(path.join(hqRoot, ".hq", "config.json"), "utf-8");
+        const cfg = JSON.parse(raw);
+        if (typeof cfg.activeCompany === "string" && cfg.activeCompany.length > 0) {
+            return cfg.activeCompany;
+        }
+    }
+    catch {
+        /* missing */
+    }
+    return undefined;
+}
+function slugFromTarget(target) {
+    try {
+        return parseCompanySlugFromPath(target);
+    }
+    catch {
+        return undefined;
+    }
+}
+async function promptPick(candidates) {
+    if (!process.stdin.isTTY)
+        return null;
+    // Candidates are prompt UI, not output — keep them off stdout so --json
+    // stays a single parseable object.
+    for (let i = 0; i < candidates.length; i += 1) {
+        console.error(`  ${i + 1}. ${candidates[i]}`);
+    }
+    const rl = readline.createInterface({
+        input: process.stdin,
+        output: process.stderr,
+    });
+    const answer = await new Promise((resolve) => {
+        rl.question("Pick a number: ", (line) => {
+            rl.close();
+            resolve(line);
+        });
+    });
+    const n = Number.parseInt(answer.trim(), 10);
+    if (!Number.isFinite(n) || n < 1 || n > candidates.length)
+        return null;
+    return candidates[n - 1] ?? null;
+}
+function treeFromBody(body) {
+    if (!body)
+        return null;
+    if (treeIsEmpty(body))
+        return null;
+    return body;
+}
+export function registerAccessCommand(program) {
+    program
+        .command("access <path-or-query>")
+        .description("Tell whether a vault file exists and whether you can read it. Never a bare not-found. Exit codes: 0 local/not-synced, 2 never-existed, 3 no-access, 4 ambiguous.")
+        .option("--company <slug>", "Company slug")
+        .option("--json", "Print a single JSON object")
+        .option("--no-fix", "Diagnose only: do not fetch, pin, or repair sync")
+        .option("--yes", "Answer the one send-confirmation yes (hosts must pass this explicitly)")
+        .option("--hq-root <path>", `Local HQ tree root (default: ${DEFAULT_HQ_ROOT})`, DEFAULT_HQ_ROOT)
+        .addHelpText("after", `
+Exit codes:
+  0  local or not-synced (file exists and you can read it)
+  2  never-existed (the path was never created)
+  3  no-access (the file exists but you cannot read it)
+  4  ambiguous (several keys matched; pick one)
+`)
+        .action(async (target, opts) => {
+        try {
+            const result = await runAccessForPath(target, opts);
+            process.exitCode = result.exitCode;
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            console.error(chalk.red("Error:") + " " + message);
+            process.exitCode = 1;
+        }
+    });
+}
+/**
+ * Resolve the company `hq access` runs against: explicit `company` (the
+ * ladder forwards the slug stamped on a 403), else the slug anchored in the
+ * target path, else the active company in `<hqRoot>/.hq/config.json`.
+ */
+export function resolveAccessCompany(target, opts) {
+    const hqRoot = opts?.hqRoot ?? DEFAULT_HQ_ROOT;
+    return opts?.company ?? slugFromTarget(target) ?? readActiveCompany(hqRoot);
+}
+export async function runAccessForPath(path, opts) {
+    const target = path;
+    const hqRoot = opts?.hqRoot ?? DEFAULT_HQ_ROOT;
+    const slug = resolveAccessCompany(target, opts);
+    if (!slug) {
+        throw new Error("Pass --company <slug>, an anchored companies/<slug>/... path, or set activeCompany in .hq/config.json.");
+    }
+    const { token, client } = await resolveBrowseSession();
+    const companyUid = await getCompanyUid(token, slug);
+    const fetchAclTree = async (prefix) => {
+        const res = await vaultApiFetch({
+            token,
+            path: `/files/${encodeURIComponent(companyUid)}/acl/tree`,
+            query: { prefix },
+        });
+        if (res.status === 404)
+            return null;
+        if (!res.ok) {
+            const body = (await res.json().catch(() => ({})));
+            throw new Error(body.message ?? body.error ?? `acl/tree failed (${res.status})`);
+        }
+        const tree = (await res.json());
+        return treeFromBody(tree);
+    };
+    const listMembers = async () => {
+        const rows = await listActiveMembers(token, companyUid);
+        return rows
+            .filter((m) => ["owner", "admin", "member", "guest"].includes(m.role))
+            .map((m) => ({
+            personUid: m.personUid,
+            personEmail: m.personEmail ?? "",
+            personName: m.personName,
+            role: m.role,
+        }));
+    };
+    const members = await listMembers();
+    const callerUid = await resolveCallerPersonUid(token);
+    const me = members.find((m) => m.personUid === callerUid);
+    let requesterEmail = me?.personEmail;
+    const requesterName = me?.personName;
+    if (!requesterEmail) {
+        const claims = peekIdToken(token);
+        const emailClaim = claims.email;
+        if (typeof emailClaim === "string" && emailClaim.length > 0) {
+            requesterEmail = emailClaim;
+        }
+    }
+    if (!requesterEmail) {
+        throw new Error("Could not resolve your email; pass --company and ensure you are an active member");
+    }
+    const dm = {
+        async send(msg) {
+            const body = buildDmBody({
+                recipient: msg.recipient,
+                message: msg.message,
+                prompt: msg.prompt,
+                details: msg.details,
+                now: Date.now(),
+            });
+            const res = await vaultApiFetch({
+                token,
+                path: "/v1/notify/dm",
+                method: "POST",
+                body: body,
+            });
+            if (!res.ok) {
+                const errBody = (await res.json().catch(() => ({})));
+                throw new Error(errBody.message ?? errBody.error ?? `dm failed (${res.status})`);
+            }
+            const data = (await res.json());
+            return { eventId: data.eventId ?? "" };
+        },
+    };
+    const confirm = process.stdin.isTTY
+        ? async (question) => {
+            const rl = readline.createInterface({
+                input: process.stdin,
+                output: process.stdout,
+            });
+            const answer = await new Promise((resolve) => {
+                rl.question(`${question} [y/N] `, (line) => {
+                    rl.close();
+                    resolve(line);
+                });
+            });
+            const t = answer.trim().toLowerCase();
+            return t === "y" || t === "yes";
+        }
+        : undefined;
+    const result = await runAccess({
+        target,
+        fix: opts?.fix !== false,
+        json: Boolean(opts?.json),
+        yes: Boolean(opts?.yes),
+        deps: {
+            hqRoot,
+            companySlug: slug,
+            companyUid,
+            vaultClient: client,
+            companyClient: makeCompanyPresignFactory(token, slug),
+            region: "us-east-1",
+            fetchAclTree,
+            listMembers,
+            requester: { email: requesterEmail, name: requesterName },
+            dm,
+            confirm,
+            now: Date.now,
+            pick: promptPick,
+            get: (anchoredPath) => runGet({
+                path: anchoredPath,
+                hqRoot,
+                companySlug: slug,
+                vaultClient: client,
+                companyClient: makeCompanyPresignFactory(token, slug),
+                region: "us-east-1",
+            }),
+            syncStatus: async () => {
+                const journals = listJournals();
+                if (journals.length === 0)
+                    return "no sync journal yet";
+                let files = 0;
+                for (const j of journals) {
+                    const entries = Object.entries(j.journal.files ?? {});
+                    files += entries.filter(([, e]) => !e.removedAt).length;
+                }
+                return `${journals.length} journals, ${files} files tracked`;
+            },
+            syncDoctor: async (apply) => {
+                const doctorResult = await syncDoctor({
+                    entity: "local",
+                    vaultConfig: {},
+                    hqRoot,
+                    yes: apply,
+                    reconcileConflicts: true,
+                });
+                const twins = doctorResult.conflictTwins?.plan?.length ?? 0;
+                const bulkRefused = Boolean(doctorResult.plan?.bulkRefused);
+                return {
+                    twins,
+                    summary: `${twins} conflict twins`,
+                    bulkRefused,
+                    breakerMessage: bulkRefused
+                        ? "bulk-asymmetry circuit-breaker tripped — refusing the delete leg"
+                        : undefined,
+                };
+            },
+        },
+    });
+    return result;
+}
+//# sourceMappingURL=access.js.map