@indigoai-us/hq-cli 5.117.0 → 5.117.1

package/dist/lib/mesh/live/daemon/credentials.js

@@ -385,4 +385,99 @@ export class CredentialRenewalManager {
         }
     }
 }
+export function normalizePersonalRealtimeBundle(raw) {
+    if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
+        throw new Error("contract-2 vend response is not an object");
+    }
+    const r = raw;
+    if (r.contractVersion !== 2) {
+        throw new Error(`expected contractVersion 2, got ${String(r.contractVersion)}`);
+    }
+    const creds = r.credentials;
+    if (!creds ||
+        typeof creds.accessKeyId !== "string" ||
+        typeof creds.secretAccessKey !== "string" ||
+        typeof creds.sessionToken !== "string") {
+        throw new Error("contract-2 vend missing credentials");
+    }
+    for (const key of ["clientId", "iotEndpoint", "region"]) {
+        if (typeof r[key] !== "string" || !r[key].trim()) {
+            throw new Error(`contract-2 vend missing ${key}`);
+        }
+    }
+    const topicsRaw = r.topics && typeof r.topics === "object" && !Array.isArray(r.topics)
+        ? r.topics
+        : {};
+    const topics = {};
+    for (const [k, v] of Object.entries(topicsRaw)) {
+        if (typeof v === "string" && v.trim())
+            topics[k] = v.trim();
+    }
+    if (!topics.dm && typeof r.topic === "string")
+        topics.dm = r.topic;
+    const actorUid = (typeof r.principalUid === "string" && /^(?:prs|agt)_[A-Za-z0-9]+$/.test(r.principalUid)
+        ? r.principalUid
+        : undefined) ||
+        actorUidFromPersonalTopic(topics.dm) ||
+        "";
+    if (!actorUid)
+        throw new Error("contract-2 vend could not derive actorUid");
+    // Only keep topics that belong to the vended principal.
+    for (const [k, v] of Object.entries(topics)) {
+        if (actorUidFromPersonalTopic(v) !== actorUid)
+            delete topics[k];
+    }
+    const expiresAt = (typeof r.expiresAt === "string" && r.expiresAt) ||
+        (typeof creds.expiration === "string" && creds.expiration) ||
+        "";
+    if (!expiresAt)
+        throw new Error("contract-2 vend missing expiresAt");
+    return {
+        contractVersion: 2,
+        credentials: {
+            accessKeyId: creds.accessKeyId,
+            secretAccessKey: creds.secretAccessKey,
+            sessionToken: creds.sessionToken,
+            expiration: expiresAt,
+        },
+        iotEndpoint: r.iotEndpoint,
+        region: r.region,
+        clientId: r.clientId,
+        actorUid,
+        topics,
+        expiresAt,
+    };
+}
+export function createPersonalRealtimeFetcher(opts) {
+    return async () => {
+        if (opts.post) {
+            const res = await opts.post(REALTIME_CREDENTIALS_PATH, { contractVersion: 2 });
+            if (res.status < 200 || res.status >= 300) {
+                throw classifyCredentialVendFailure(res.status, res.body, headerGet(res.headers, "Retry-After"));
+            }
+            return normalizePersonalRealtimeBundle(res.body);
+        }
+        const res = await vaultApiFetch({
+            token: opts.token,
+            path: REALTIME_CREDENTIALS_PATH,
+            method: "POST",
+            body: { contractVersion: 2 },
+            baseUrl: opts.baseUrl ?? DEFAULT_VAULT_API_URL,
+        });
+        const text = await res.text();
+        let body = {};
+        if (text) {
+            try {
+                body = JSON.parse(text);
+            }
+            catch {
+                body = { raw: text.slice(0, 200) };
+            }
+        }
+        if (!res.ok) {
+            throw classifyCredentialVendFailure(res.status, body, res.headers.get("Retry-After"));
+        }
+        return normalizePersonalRealtimeBundle(body);
+    };
+}
 //# sourceMappingURL=credentials.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.117.0",
+  "version": "5.117.1",
   "description": "HQ by Indigo management CLI \u2014 modules and cloud sync",
   "main": "dist/index.js",
   "bin": {