@indigoai-us/hq-cli 5.15.0 → 5.16.0

package/dist/commands/cloud-provision.d.ts

@@ -111,7 +111,32 @@ export interface VaultClient {
      * entity.
      */
     listMyPersonEntities(): Promise<VaultEntity[]>;
+    /**
+     * Legacy global-uniqueness lookup. Under the per-user-namespace model
+     * (hq-pro 2026-05-15) this can return any tenant's entity when more
+     * than one user holds the same slug, OR `null` when the caller doesn't
+     * have it but a different user does. Kept on the interface for any
+     * remaining callers, but `provisionCompany` now uses
+     * `checkSlugInMyNamespace` instead — same-slug-different-owner is
+     * legitimate and should NOT trigger reuse of the stranger's entity.
+     */
     findCompanyBySlug(slug: string): Promise<VaultEntity | null>;
+    /**
+     * Caller-scoped slug availability check via
+     * `GET /entity/check-slug/me?type=company&slug=...`. Returns
+     * `{available: true}` when the caller's namespace
+     * (owned ∪ active-member-of, soft-deleted excluded) doesn't hold the
+     * slug, or `{available: false, conflictingCompanyUid}` when it does
+     * — `provisionCompany` reuses the `conflictingCompanyUid` as the
+     * idempotent entity instead of creating a duplicate.
+     */
+    checkSlugInMyNamespace(slug: string): Promise<{
+        available: boolean;
+        conflictingCompanyUid?: string;
+    }>;
+    /** Fetch a company entity by uid. Used to materialize the entity
+     * after `checkSlugInMyNamespace` reports a same-namespace collision. */
+    getCompanyByUid(uid: string): Promise<VaultEntity>;
     createCompanyEntity(input: {
         slug: string;
         name: string;

package/dist/commands/cloud-provision.js

@@ -28,7 +28,7 @@
  *       `initial_sync.ok=false`). Manifest + config may have been written.
  */
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="3c9e69f3-8137-5db1-8692-e38774558f61")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="925baddc-7b12-5ad4-b64f-d7e20bd0daab")}catch(e){}}();
 import chalk from "chalk";
 import * as fs from "node:fs";
 import * as path from "node:path";
@@ -295,6 +295,28 @@ export function createDefaultVaultClient(apiUrl, accessToken) {
             }
             return data.entity;
         },
+        async checkSlugInMyNamespace(slug) {
+            const url = `${apiUrl.replace(/\/$/, "")}/entity/check-slug/me?type=company&slug=${encodeURIComponent(slug)}`;
+            const res = await fetch(url, { method: "GET", headers });
+            if (!res.ok) {
+                const body = await safeBody(res);
+                throw new ProvisionError(1, `Vault GET /entity/check-slug/me failed: ${res.status} ${res.statusText} — ${body}`);
+            }
+            return (await res.json());
+        },
+        async getCompanyByUid(uid) {
+            const url = `${apiUrl.replace(/\/$/, "")}/entity/${encodeURIComponent(uid)}`;
+            const res = await fetch(url, { method: "GET", headers });
+            if (!res.ok) {
+                const body = await safeBody(res);
+                throw new ProvisionError(1, `Vault GET /entity/${uid} failed: ${res.status} ${res.statusText} — ${body}`);
+            }
+            const data = (await res.json());
+            if (!data.entity) {
+                throw new ProvisionError(1, `Vault GET /entity/${uid} returned 200 with no entity body`);
+            }
+            return data.entity;
+        },
         async createCompanyEntity(input) {
             const url = `${apiUrl.replace(/\/$/, "")}/entity`;
             const body = {
@@ -311,9 +333,15 @@ export function createDefaultVaultClient(apiUrl, accessToken) {
             });
             if (!res.ok) {
                 const text = await safeBody(res);
-                // 409 means a concurrent client created it between our GET and POST —
-                // surface it as a vault error. The orchestrator is responsible for
-                // retrying GET if it wants idempotency on collisions.
+                // 409 SLUG_IN_USE_FOR_PERSON: the caller already has the slug
+                // in their namespace (owned ∪ active-member-of). Under the
+                // per-user-namespace model this is the new same-user-collision
+                // signal — distinct from the legacy global EntityAlreadyExists.
+                // The CLI normally reaches `createCompanyEntity` only after
+                // `checkSlugInMyNamespace` reported `available: true`, so a
+                // 409 here means a race between the pre-check and the POST.
+                // Surface the response body verbatim so the caller can see the
+                // `code` + `conflictingCompanyUid` and resolve / retry.
                 throw new ProvisionError(1, `Vault POST /entity failed: ${res.status} ${res.statusText} — ${text}`);
             }
             const data = (await res.json());
@@ -393,13 +421,51 @@ export async function provisionCompany(options) {
         throw new ProvisionError(2, 'No person entity found for this Cognito identity. Run `hq onboard` first to create your HQ identity, then re-run `hq cloud provision company`. (Provision was halted before any cloud-side resources were created.)');
     }
     log(`pre-flight ok — caller has ${persons.length} person entity(ies)`);
-    let entity = await vaultClient.findCompanyBySlug(options.slug);
+    // Per-user-namespace-aware reuse-or-create. Replaces the legacy
+    // global `findCompanyBySlug` lookup, which under the per-user model
+    // (hq-pro 2026-05-15) returns ANY tenant's entity when more than one
+    // user holds the same slug, OR null when a different user has it —
+    // both wrong for the CLI's "reuse mine, or create" intent.
+    //
+    // `--owner` override: `options.ownerUid`, when set, lets a caller
+    // create the entity under a DIFFERENT person's ownership (e.g. an
+    // admin provisioning on behalf of someone). `/entity/check-slug/me`
+    // answers about the CALLER's namespace, not the target owner's, so
+    // the pre-check is meaningless in that case. Codex P2 on PR 7
+    // flagged this. The gate: only run the namespace check when the
+    // owner is the caller (or defaulted to the caller — i.e. no
+    // --owner supplied). On override, fall through to
+    // `createCompanyEntity` and let the server's authoritative 409
+    // (which IS scoped to the target's namespace, per the
+    // callerIsOwner gate on POST /entity in hq-pro PR 67) surface any
+    // real conflict.
+    //
+    // `callerIsOwner` is `true` whenever `options.ownerUid` is unset
+    // (defaults to caller server-side) OR — when set — happens to
+    // match the caller's own person UID(s) from `listMyPersonEntities`.
+    const callerOwnedUids = new Set(persons.map((p) => p.uid));
+    const callerIsOwner = !options.ownerUid || callerOwnedUids.has(options.ownerUid);
+    let entity;
     let createdEntity = false;
-    if (entity) {
-        log(`reusing existing vault entity uid=${entity.uid}`);
+    if (callerIsOwner) {
+        const slugCheck = await vaultClient.checkSlugInMyNamespace(options.slug);
+        if (!slugCheck.available && slugCheck.conflictingCompanyUid) {
+            log(`reusing existing vault entity uid=${slugCheck.conflictingCompanyUid} (slug already in caller's namespace)`);
+            entity = await vaultClient.getCompanyByUid(slugCheck.conflictingCompanyUid);
+        }
+        else {
+            log(`slug available in caller's namespace — creating vault entity`);
+            entity = await vaultClient.createCompanyEntity({
+                slug: options.slug,
+                name: options.name ?? options.slug,
+                ownerUid: options.ownerUid,
+            });
+            createdEntity = true;
+            log(`created vault entity uid=${entity.uid}`);
+        }
     }
     else {
-        log(`vault entity not found — creating`);
+        log(`--owner ${options.ownerUid} differs from caller's person(s); skipping namespace pre-check (server authoritatively gates per-target-namespace)`);
         entity = await vaultClient.createCompanyEntity({
             slug: options.slug,
             name: options.name ?? options.slug,
@@ -549,4 +615,4 @@ export function registerCloudProvisionCommands(program) {
     });
 }
 //# sourceMappingURL=cloud-provision.js.map
-//# debugId=3c9e69f3-8137-5db1-8692-e38774558f61
+//# debugId=925baddc-7b12-5ad4-b64f-d7e20bd0daab

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.15.0",
+  "version": "5.16.0",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {

package/src/commands/cloud-provision.test.ts

@@ -582,6 +582,20 @@ describe("provisionCompany", () => {
       listMyPersonEntities: vi.fn().mockResolvedValue([
         { uid: "prs_01H", type: "person", slug: "test-user", name: "Test User" },
       ]),
+      // Default to "slug available in caller's namespace" so happy-path
+      // tests fall through to createCompanyEntity. Reuse-path tests
+      // override with {available: false, conflictingCompanyUid: ...}
+      // and supply a getCompanyByUid that returns the existing entity.
+      checkSlugInMyNamespace: vi
+        .fn()
+        .mockResolvedValue({ available: true }),
+      getCompanyByUid: vi
+        .fn()
+        .mockRejectedValue(
+          new Error(
+            "getCompanyByUid called without an explicit per-test mock — happy path should never hit it",
+          ),
+        ),
       findCompanyBySlug: vi.fn().mockResolvedValue(null),
       createCompanyEntity: vi.fn(),
       ...overrides,
@@ -716,7 +730,13 @@ describe("provisionCompany", () => {
       kmsKeyId: null,
     };
     const vaultClient = makeVaultClient({
-      findCompanyBySlug: vi.fn().mockResolvedValue(entity),
+      // Reuse path under the per-user-namespace model: checkSlugInMyNamespace
+      // reports `available: false` with the existing entity's uid, and
+      // getCompanyByUid materializes the full entity for downstream use.
+      checkSlugInMyNamespace: vi
+        .fn()
+        .mockResolvedValue({ available: false, conflictingCompanyUid: entity.uid }),
+      getCompanyByUid: vi.fn().mockResolvedValue(entity),
       createCompanyEntity: vi.fn(),
     });
     const result = await provisionCompany({
@@ -731,6 +751,7 @@ describe("provisionCompany", () => {
     expect(result.created_entity).toBe(false);
     expect(result.kms_key_id).toBeNull();
     expect(vaultClient.createCompanyEntity).not.toHaveBeenCalled();
+    expect(vaultClient.getCompanyByUid).toHaveBeenCalledWith(entity.uid);
   });
 
   it("throws code 1 when entity has no bucketName (incomplete provisioning)", async () => {
@@ -743,7 +764,11 @@ describe("provisionCompany", () => {
       // bucketName intentionally absent
     };
     const vaultClient = makeVaultClient({
-      findCompanyBySlug: vi.fn().mockResolvedValue(entity),
+      // Same reuse-path mock shape as the idempotent-path test above.
+      checkSlugInMyNamespace: vi
+        .fn()
+        .mockResolvedValue({ available: false, conflictingCompanyUid: entity.uid }),
+      getCompanyByUid: vi.fn().mockResolvedValue(entity),
     });
     try {
       await provisionCompany({

package/src/commands/cloud-provision.ts

@@ -133,7 +133,32 @@ export interface VaultClient {
    * entity.
    */
   listMyPersonEntities(): Promise<VaultEntity[]>;
+  /**
+   * Legacy global-uniqueness lookup. Under the per-user-namespace model
+   * (hq-pro 2026-05-15) this can return any tenant's entity when more
+   * than one user holds the same slug, OR `null` when the caller doesn't
+   * have it but a different user does. Kept on the interface for any
+   * remaining callers, but `provisionCompany` now uses
+   * `checkSlugInMyNamespace` instead — same-slug-different-owner is
+   * legitimate and should NOT trigger reuse of the stranger's entity.
+   */
   findCompanyBySlug(slug: string): Promise<VaultEntity | null>;
+  /**
+   * Caller-scoped slug availability check via
+   * `GET /entity/check-slug/me?type=company&slug=...`. Returns
+   * `{available: true}` when the caller's namespace
+   * (owned ∪ active-member-of, soft-deleted excluded) doesn't hold the
+   * slug, or `{available: false, conflictingCompanyUid}` when it does
+   * — `provisionCompany` reuses the `conflictingCompanyUid` as the
+   * idempotent entity instead of creating a duplicate.
+   */
+  checkSlugInMyNamespace(slug: string): Promise<{
+    available: boolean;
+    conflictingCompanyUid?: string;
+  }>;
+  /** Fetch a company entity by uid. Used to materialize the entity
+   * after `checkSlugInMyNamespace` reports a same-namespace collision. */
+  getCompanyByUid(uid: string): Promise<VaultEntity>;
   createCompanyEntity(input: {
     slug: string;
     name: string;
@@ -475,6 +500,45 @@ export function createDefaultVaultClient(
       }
       return data.entity;
     },
+    async checkSlugInMyNamespace(slug: string): Promise<{
+      available: boolean;
+      conflictingCompanyUid?: string;
+    }> {
+      const url = `${apiUrl.replace(/\/$/, "")}/entity/check-slug/me?type=company&slug=${encodeURIComponent(
+        slug,
+      )}`;
+      const res = await fetch(url, { method: "GET", headers });
+      if (!res.ok) {
+        const body = await safeBody(res);
+        throw new ProvisionError(
+          1,
+          `Vault GET /entity/check-slug/me failed: ${res.status} ${res.statusText} — ${body}`,
+        );
+      }
+      return (await res.json()) as {
+        available: boolean;
+        conflictingCompanyUid?: string;
+      };
+    },
+    async getCompanyByUid(uid: string): Promise<VaultEntity> {
+      const url = `${apiUrl.replace(/\/$/, "")}/entity/${encodeURIComponent(uid)}`;
+      const res = await fetch(url, { method: "GET", headers });
+      if (!res.ok) {
+        const body = await safeBody(res);
+        throw new ProvisionError(
+          1,
+          `Vault GET /entity/${uid} failed: ${res.status} ${res.statusText} — ${body}`,
+        );
+      }
+      const data = (await res.json()) as { entity?: VaultEntity };
+      if (!data.entity) {
+        throw new ProvisionError(
+          1,
+          `Vault GET /entity/${uid} returned 200 with no entity body`,
+        );
+      }
+      return data.entity;
+    },
     async createCompanyEntity(input: {
       slug: string;
       name: string;
@@ -494,9 +558,15 @@ export function createDefaultVaultClient(
       });
       if (!res.ok) {
         const text = await safeBody(res);
-        // 409 means a concurrent client created it between our GET and POST —
-        // surface it as a vault error. The orchestrator is responsible for
-        // retrying GET if it wants idempotency on collisions.
+        // 409 SLUG_IN_USE_FOR_PERSON: the caller already has the slug
+        // in their namespace (owned ∪ active-member-of). Under the
+        // per-user-namespace model this is the new same-user-collision
+        // signal — distinct from the legacy global EntityAlreadyExists.
+        // The CLI normally reaches `createCompanyEntity` only after
+        // `checkSlugInMyNamespace` reported `available: true`, so a
+        // 409 here means a race between the pre-check and the POST.
+        // Surface the response body verbatim so the caller can see the
+        // `code` + `conflictingCompanyUid` and resolve / retry.
         throw new ProvisionError(
           1,
           `Vault POST /entity failed: ${res.status} ${res.statusText} — ${text}`,
@@ -600,12 +670,57 @@ export async function provisionCompany(
   }
   log(`pre-flight ok — caller has ${persons.length} person entity(ies)`);
 
-  let entity = await vaultClient.findCompanyBySlug(options.slug);
+  // Per-user-namespace-aware reuse-or-create. Replaces the legacy
+  // global `findCompanyBySlug` lookup, which under the per-user model
+  // (hq-pro 2026-05-15) returns ANY tenant's entity when more than one
+  // user holds the same slug, OR null when a different user has it —
+  // both wrong for the CLI's "reuse mine, or create" intent.
+  //
+  // `--owner` override: `options.ownerUid`, when set, lets a caller
+  // create the entity under a DIFFERENT person's ownership (e.g. an
+  // admin provisioning on behalf of someone). `/entity/check-slug/me`
+  // answers about the CALLER's namespace, not the target owner's, so
+  // the pre-check is meaningless in that case. Codex P2 on PR 7
+  // flagged this. The gate: only run the namespace check when the
+  // owner is the caller (or defaulted to the caller — i.e. no
+  // --owner supplied). On override, fall through to
+  // `createCompanyEntity` and let the server's authoritative 409
+  // (which IS scoped to the target's namespace, per the
+  // callerIsOwner gate on POST /entity in hq-pro PR 67) surface any
+  // real conflict.
+  //
+  // `callerIsOwner` is `true` whenever `options.ownerUid` is unset
+  // (defaults to caller server-side) OR — when set — happens to
+  // match the caller's own person UID(s) from `listMyPersonEntities`.
+  const callerOwnedUids = new Set(persons.map((p) => p.uid));
+  const callerIsOwner =
+    !options.ownerUid || callerOwnedUids.has(options.ownerUid);
+
+  let entity: VaultEntity;
   let createdEntity = false;
-  if (entity) {
-    log(`reusing existing vault entity uid=${entity.uid}`);
+  if (callerIsOwner) {
+    const slugCheck = await vaultClient.checkSlugInMyNamespace(options.slug);
+    if (!slugCheck.available && slugCheck.conflictingCompanyUid) {
+      log(
+        `reusing existing vault entity uid=${slugCheck.conflictingCompanyUid} (slug already in caller's namespace)`,
+      );
+      entity = await vaultClient.getCompanyByUid(
+        slugCheck.conflictingCompanyUid,
+      );
+    } else {
+      log(`slug available in caller's namespace — creating vault entity`);
+      entity = await vaultClient.createCompanyEntity({
+        slug: options.slug,
+        name: options.name ?? options.slug,
+        ownerUid: options.ownerUid,
+      });
+      createdEntity = true;
+      log(`created vault entity uid=${entity.uid}`);
+    }
   } else {
-    log(`vault entity not found — creating`);
+    log(
+      `--owner ${options.ownerUid} differs from caller's person(s); skipping namespace pre-check (server authoritatively gates per-target-namespace)`,
+    );
     entity = await vaultClient.createCompanyEntity({
       slug: options.slug,
       name: options.name ?? options.slug,