@indigoai-us/hq-cli 5.12.3 → 5.12.4

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## [5.12.4] — 2026-05-12
+
+### Changed
+
+- **`hq files acl <prefix>` now uses a single round-trip.** Previously the
+  command issued `GET /acl` and `GET /acl/tree` in parallel to gather the
+  prefix's own row metadata (creator, open/restricted, effective permission)
+  alongside inherited/descendant grants. The server now folds `directRow`
+  and `effectivePermission` into the `/acl/tree` response, so the CLI makes
+  a single request and dedupes the company-ACL fetch on the server side.
+  Output formatting is unchanged.
+
 ## [5.12.3] — 2026-05-12
 
 ### Added

package/dist/commands/files.js

@@ -1,5 +1,5 @@
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="50b160eb-d996-5ac2-8efc-b1791b469f3a")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="7a4bfaa9-c578-5cd8-8955-ec965faada13")}catch(e){}}();
 import chalk from "chalk";
 import open from "open";
 import { ensureCognitoToken } from "../utils/cognito-session.js";
@@ -205,64 +205,49 @@ export function registerFilesCommand(program) {
             const token = await ensureCognitoToken();
             const companySlug = files.opts().company;
             const companyUid = await getCompanyUid(token, companySlug);
-            // Fetch the prefix's own ACL row (creator, open flag, effective
-            // permission) and the inherited/descendant tree in parallel so the
-            // user sees every grant that affects this prefix in one shot.
-            const [aclRes, treeRes] = await Promise.all([
-                vaultApiFetch({
-                    token,
-                    path: `/files/${encodeURIComponent(companyUid)}/acl`,
-                    query: { prefix: canonicalPrefix },
-                }),
-                vaultApiFetch({
-                    token,
-                    path: `/files/${encodeURIComponent(companyUid)}/acl/tree`,
-                    query: { prefix: canonicalPrefix },
-                }),
-            ]);
-            async function readErrorBody(res) {
-                return (await res.json().catch(() => ({})));
-            }
-            // Auth/server failures from either call are treated identically — bail
-            // out with a single message rather than printing a half-rendered view.
-            for (const res of [aclRes, treeRes]) {
-                if (res.ok || res.status === 404)
-                    continue;
-                const body = await readErrorBody(res);
-                if (res.status === 401) {
+            // `/acl/tree` carries the prefix's own row metadata (directRow) and the
+            // caller's effectivePermission alongside direct/inherited/children, so
+            // a single request returns everything the "files acl" view needs.
+            const treeRes = await vaultApiFetch({
+                token,
+                path: `/files/${encodeURIComponent(companyUid)}/acl/tree`,
+                query: { prefix: canonicalPrefix },
+            });
+            if (!treeRes.ok) {
+                const body = (await treeRes.json().catch(() => ({})));
+                if (treeRes.status === 401) {
                     console.error(chalk.red("Not authenticated — please run `hq login`"));
                 }
-                else if (res.status === 403) {
+                else if (treeRes.status === 403) {
                     console.error(chalk.red("Not authorized to view this file prefix's ACL"));
                 }
-                else if (res.status >= 500) {
-                    console.error(chalk.red(`Server error: ${body.error ?? res.statusText}`));
+                else if (treeRes.status >= 500) {
+                    console.error(chalk.red(`Server error: ${body.error ?? treeRes.statusText}`));
                 }
                 else {
                     console.error(chalk.red(body.message ?? body.error ?? "Invalid request"));
                 }
                 process.exit(1);
             }
-            const acl = aclRes.ok ? (await aclRes.json()).acl : null;
-            const tree = treeRes.ok ? (await treeRes.json()) : null;
-            // No own row AND nothing inherited or granted below — original
-            // "no ACL record" exit path.
-            if (!acl && (!tree || (tree.inherited.length === 0 && tree.children.length === 0))) {
+            const tree = (await treeRes.json());
+            const row = tree.directRow;
+            // No own row AND nothing inherited or granted below — preserve the
+            // original "no ACL record" exit path.
+            if (!row && tree.inherited.length === 0 && tree.children.length === 0) {
                 console.error(chalk.red(`No ACL record exists for '${canonicalPrefix}'`));
                 process.exit(1);
             }
-            const aclPrefix = acl?.path ?? acl?.prefix ?? tree?.prefix ?? canonicalPrefix;
-            const aclStatus = acl?.open ? "open" : "restricted";
-            console.log(chalk.green(`ACL for ${aclPrefix} (${aclStatus})`));
-            if (acl) {
-                console.log(`Creator: ${acl.creatorUid}`);
-                if (acl.effectivePermission) {
-                    console.log(`Your effective permission: ${acl.effectivePermission}`);
-                }
+            const aclStatus = row?.open ? "open" : "restricted";
+            console.log(chalk.green(`ACL for ${tree.prefix} (${aclStatus})`));
+            if (row) {
+                console.log(`Creator: ${row.creatorUid}`);
             }
             else {
                 console.log(chalk.gray("No direct ACL row — access flows from the inherited/descendant grants below."));
             }
+            if (tree.effectivePermission) {
+                console.log(`Your effective permission: ${tree.effectivePermission}`);
+            }
             // Display labels for grantee identifiers — `company-wide` entries
             // store `granteeId === ""` on the wire, but a blank cell is confusing
             // in tabular output, so we render a human-readable phrase instead.
@@ -303,12 +288,12 @@ export function registerFilesCommand(program) {
                     console.log(cols.join("  "));
                 }
             }
-            const directEntries = acl?.entries ?? tree?.direct ?? [];
+            const directEntries = tree.direct;
             if (directEntries.length === 0) {
-                if (acl?.open) {
+                if (row?.open) {
                     console.log(chalk.gray("Open ACL — all active members have read access."));
                 }
-                else if (acl) {
+                else if (row) {
                     console.log(chalk.gray("No explicit grants on this prefix — only creator has access."));
                 }
             }
@@ -316,11 +301,11 @@ export function registerFilesCommand(program) {
                 console.log("\nDirect entries (granted on this prefix):");
                 printEntryTable(directEntries, false);
             }
-            if (tree && tree.inherited.length > 0) {
+            if (tree.inherited.length > 0) {
                 console.log("\nInherited (granted on an ancestor prefix):");
                 printEntryTable(tree.inherited, true);
             }
-            if (tree && tree.children.length > 0) {
+            if (tree.children.length > 0) {
                 console.log("\nGranted on descendant prefixes (do not affect this prefix's access):");
                 printEntryTable(tree.children, true);
             }
@@ -471,4 +456,4 @@ async function runShareSession(params) {
     }
 }
 //# sourceMappingURL=files.js.map
-//# debugId=50b160eb-d996-5ac2-8efc-b1791b469f3a
+//# debugId=7a4bfaa9-c578-5cd8-8955-ec965faada13

package/dist/index.js

@@ -37,7 +37,7 @@ const program = new Command();
 program
     .name("hq")
     .description("HQ management CLI — modules, packages, and cloud sync")
-    .version("5.12.3");
+    .version("5.12.4");
 // Module management subcommand group
 const modulesCmd = program
     .command("modules")

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.12.3",
+  "version": "5.12.4",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {

package/src/commands/files.ts

@@ -271,37 +271,23 @@ export function registerFilesCommand(program: Command): void {
         const companySlug = files.opts().company as string | undefined;
         const companyUid = await getCompanyUid(token, companySlug);
 
-        // Fetch the prefix's own ACL row (creator, open flag, effective
-        // permission) and the inherited/descendant tree in parallel so the
-        // user sees every grant that affects this prefix in one shot.
-        const [aclRes, treeRes] = await Promise.all([
-          vaultApiFetch({
-            token,
-            path: `/files/${encodeURIComponent(companyUid)}/acl`,
-            query: { prefix: canonicalPrefix },
-          }),
-          vaultApiFetch({
-            token,
-            path: `/files/${encodeURIComponent(companyUid)}/acl/tree`,
-            query: { prefix: canonicalPrefix },
-          }),
-        ]);
-
-        async function readErrorBody(res: Response): Promise<Record<string, string>> {
-          return (await res.json().catch(() => ({}))) as Record<string, string>;
-        }
+        // `/acl/tree` carries the prefix's own row metadata (directRow) and the
+        // caller's effectivePermission alongside direct/inherited/children, so
+        // a single request returns everything the "files acl" view needs.
+        const treeRes = await vaultApiFetch({
+          token,
+          path: `/files/${encodeURIComponent(companyUid)}/acl/tree`,
+          query: { prefix: canonicalPrefix },
+        });
 
-        // Auth/server failures from either call are treated identically — bail
-        // out with a single message rather than printing a half-rendered view.
-        for (const res of [aclRes, treeRes]) {
-          if (res.ok || res.status === 404) continue;
-          const body = await readErrorBody(res);
-          if (res.status === 401) {
+        if (!treeRes.ok) {
+          const body = (await treeRes.json().catch(() => ({}))) as Record<string, string>;
+          if (treeRes.status === 401) {
             console.error(chalk.red("Not authenticated — please run `hq login`"));
-          } else if (res.status === 403) {
+          } else if (treeRes.status === 403) {
             console.error(chalk.red("Not authorized to view this file prefix's ACL"));
-          } else if (res.status >= 500) {
-            console.error(chalk.red(`Server error: ${body.error ?? res.statusText}`));
+          } else if (treeRes.status >= 500) {
+            console.error(chalk.red(`Server error: ${body.error ?? treeRes.statusText}`));
           } else {
             console.error(chalk.red(body.message ?? body.error ?? "Invalid request"));
           }
@@ -315,53 +301,43 @@ export function registerFilesCommand(program: Command): void {
           grantedBy: string;
           grantedAt: string;
         };
-        type AclResponse = {
-          acl: {
-            itemType: string;
-            companyUid: string;
-            // Server returns `path` (the FileAcl field name); older builds
-            // used `prefix`. Read both so the CLI works against either.
-            path?: string;
-            prefix?: string;
-            creatorUid: string;
-            open?: boolean;
-            entries: AclEntry[];
-            effectivePermission?: string | null;
-            createdAt: string;
-            updatedAt: string;
-          };
-        };
         type TreeResponse = {
           prefix: string;
           direct: AclEntry[];
           inherited: Array<AclEntry & { sourcePrefix: string }>;
           children: Array<AclEntry & { sourcePrefix: string }>;
+          directRow: {
+            creatorUid: string;
+            open: boolean;
+            createdAt: string;
+            updatedAt: string;
+          } | null;
+          effectivePermission: string | null;
         };
 
-        const acl = aclRes.ok ? (await aclRes.json() as AclResponse).acl : null;
-        const tree = treeRes.ok ? (await treeRes.json()) as TreeResponse : null;
+        const tree = (await treeRes.json()) as TreeResponse;
+        const row = tree.directRow;
 
-        // No own row AND nothing inherited or granted below — original
-        // "no ACL record" exit path.
-        if (!acl && (!tree || (tree.inherited.length === 0 && tree.children.length === 0))) {
+        // No own row AND nothing inherited or granted below — preserve the
+        // original "no ACL record" exit path.
+        if (!row && tree.inherited.length === 0 && tree.children.length === 0) {
           console.error(chalk.red(`No ACL record exists for '${canonicalPrefix}'`));
           process.exit(1);
         }
 
-        const aclPrefix = acl?.path ?? acl?.prefix ?? tree?.prefix ?? canonicalPrefix;
-        const aclStatus = acl?.open ? "open" : "restricted";
+        const aclStatus = row?.open ? "open" : "restricted";
 
-        console.log(chalk.green(`ACL for ${aclPrefix} (${aclStatus})`));
-        if (acl) {
-          console.log(`Creator: ${acl.creatorUid}`);
-          if (acl.effectivePermission) {
-            console.log(`Your effective permission: ${acl.effectivePermission}`);
-          }
+        console.log(chalk.green(`ACL for ${tree.prefix} (${aclStatus})`));
+        if (row) {
+          console.log(`Creator: ${row.creatorUid}`);
         } else {
           console.log(chalk.gray(
             "No direct ACL row — access flows from the inherited/descendant grants below.",
           ));
         }
+        if (tree.effectivePermission) {
+          console.log(`Your effective permission: ${tree.effectivePermission}`);
+        }
 
         // Display labels for grantee identifiers — `company-wide` entries
         // store `granteeId === ""` on the wire, but a blank cell is confusing
@@ -405,11 +381,11 @@ export function registerFilesCommand(program: Command): void {
           }
         }
 
-        const directEntries = acl?.entries ?? tree?.direct ?? [];
+        const directEntries = tree.direct;
         if (directEntries.length === 0) {
-          if (acl?.open) {
+          if (row?.open) {
             console.log(chalk.gray("Open ACL — all active members have read access."));
-          } else if (acl) {
+          } else if (row) {
             console.log(chalk.gray("No explicit grants on this prefix — only creator has access."));
           }
         } else {
@@ -417,12 +393,12 @@ export function registerFilesCommand(program: Command): void {
           printEntryTable(directEntries, false);
         }
 
-        if (tree && tree.inherited.length > 0) {
+        if (tree.inherited.length > 0) {
           console.log("\nInherited (granted on an ancestor prefix):");
           printEntryTable(tree.inherited, true);
         }
 
-        if (tree && tree.children.length > 0) {
+        if (tree.children.length > 0) {
           console.log("\nGranted on descendant prefixes (do not affect this prefix's access):");
           printEntryTable(tree.children, true);
         }

package/src/index.ts

@@ -43,7 +43,7 @@ const program = new Command();
 program
   .name("hq")
   .description("HQ management CLI — modules, packages, and cloud sync")
-  .version("5.12.3");
+  .version("5.12.4");
 
 // Module management subcommand group
 const modulesCmd = program