@indigoai-us/hq-cli 5.313.0 → 5.314.0

package/dist/lib/mesh/api.js

@@ -30,8 +30,6 @@ export async function meshJson(token, path, init = {}) {
         method: init.method,
         body: init.body,
         query: init.query,
-        headers: init.headers,
-        signal: init.signal,
     });
     const text = await res.text();
     let data = {};
@@ -50,40 +48,19 @@ export async function meshJson(token, path, init = {}) {
         // 400 whose body text matched no pattern was retried forever.
         const detail = err.error || err.message || res.statusText || "request failed";
         const code = typeof err.code === "string" && err.code ? `${err.code}: ` : "";
-        const context = [
-            typeof err.stage === "string" && err.stage ? `stage=${err.stage}` : "",
-            typeof err.recovery === "string" && err.recovery ? `recovery=${err.recovery}` : "",
-        ].filter(Boolean);
-        const failure = new Error(`${res.status} ${code}${detail}${context.length ? ` (${context.join("; ")})` : ""}`);
-        failure.status = res.status;
-        if (typeof err.code === "string" && err.code)
-            failure.code = err.code;
-        throw failure;
+        throw new Error(`${res.status} ${code}${detail}`);
     }
     return data;
 }
 export async function resolveMeshCompany(token, company) {
-    const meshOverride = process.env.HQ_WORK_MESH_COMPANY_UID?.trim();
-    const companyOverride = process.env.HQ_COMPANY_UID?.trim();
-    const explicit = meshOverride || companyOverride;
-    const explicitSource = meshOverride ? "HQ_WORK_MESH_COMPANY_UID" : "HQ_COMPANY_UID";
-    if (explicit && explicit.startsWith("cmp_")) {
-        return { companyUid: explicit, companySlug: company || explicit };
+    const explicit = process.env.HQ_WORK_MESH_COMPANY_UID || process.env.HQ_COMPANY_UID;
+    if (explicit?.trim()) {
+        return { companyUid: explicit.trim(), companySlug: company || explicit.trim() };
     }
-    if (explicit) {
-        // hq-pro accepts companyUid only with the cmp_ prefix (flags-resolve.ts:145-150).
-        // Ignore a malformed UID override so it cannot become a request identity.
-        process.stderr.write(`${JSON.stringify({
-            event: "work_mesh.invalid_company_uid_override",
-            source: explicitSource,
-            expected_prefix: "cmp_",
-        })}\n`);
-    }
-    if (company?.startsWith("cmp_")) {
+    if (company && /^(cmp|co)_/.test(company)) {
         return { companyUid: company, companySlug: company };
     }
-    const companySlug = company?.trim();
-    const uid = await getCompanyUid(token, companySlug || undefined);
+    const uid = await getCompanyUid(token, company);
     return { companyUid: uid, companySlug: company || uid };
 }
 /**
@@ -120,25 +97,17 @@ export async function listActiveMembershipCompanies(token) {
  *
  * Lists the caller's active companies via GET /membership/me and matches the
  * requested slug (case-insensitive). Does **not** honour HQ_COMPANY_UID /
- * HQ_WORK_MESH_COMPANY_UID env overrides or treat a raw `cmp_` ref as proof
- * of membership without an active membership row.
+ * HQ_WORK_MESH_COMPANY_UID env overrides or treat a raw `cmp_`/`co_` ref as
+ * proof of membership without an active membership row.
  *
  * Returns null when the caller is not an active member. Throws on transport /
  * auth failures so the caller can surface DEFAULT_COMPANY_UNAVAILABLE.
  */
-export async function resolveActiveMembershipCompany(token, slug, signal) {
+export async function resolveActiveMembershipCompany(token, slug) {
     const trimmed = slug.trim();
     if (!trimmed)
         return null;
-    // An aborted lookup is not "not a member". Throw so callers defer.
-    if (signal?.aborted) {
-        throw new Error("membership lookup aborted");
-    }
-    const payload = asRecord(await meshJson(token, "/membership/me", { signal }));
-    if (!payload || !Array.isArray(payload.memberships)) {
-        throw new Error("Malformed membership response: expected memberships array");
-    }
-    const rows = activeMembershipCompanies(payload.memberships);
+    const rows = await listActiveMembershipCompanies(token);
     const needle = trimmed.toLowerCase();
     const matches = rows.filter((c) => c.companySlug.toLowerCase() === needle ||
         c.companyUid.toLowerCase() === needle);
@@ -149,29 +118,7 @@ export async function resolveActiveMembershipCompany(token, slug, signal) {
     // Ambiguous slug across memberships — refuse rather than guess.
     return null;
 }
-function activeMembershipCompanies(rows) {
-    const out = [];
-    const seen = new Set();
-    for (const row of rows) {
-        const rec = asRecord(row);
-        if (!rec)
-            continue;
-        if (String(rec.status || "").toLowerCase() !== "active")
-            continue;
-        const companyUid = typeof rec.companyUid === "string" ? rec.companyUid : "";
-        if (!companyUid || seen.has(companyUid))
-            continue;
-        const companySlug = typeof rec.companySlug === "string"
-            ? rec.companySlug
-            : typeof rec.companyFolderSlug === "string"
-                ? rec.companyFolderSlug
-                : companyUid;
-        seen.add(companyUid);
-        out.push({ companyUid, companySlug: companySlug || companyUid });
-    }
-    return out;
-}
-export async function requireToken(opts = {}) {
+export async function requireToken() {
     // Agent/machine boxes must authenticate the way the mesh daemon does:
     // an agent's identity claims (custom:entityType=agent, custom:entityUid)
     // ride the ID token ONLY; a person-cache ACCESS token on the box carries
@@ -182,122 +129,48 @@ export async function requireToken(opts = {}) {
     // hard policy indigo-agent-caller-resolution-id-token, agent claims ride
     // the ID token only; the server is correct to require it. Humans keep the
     // person access token (unchanged).
-    const interactive = opts.interactive ?? true;
     if (isMachineIdentity()) {
-        return ensureCognitoToken({ tokenSource: "machine", interactive });
+        return ensureCognitoToken({ tokenSource: "machine" });
     }
-    return ensureCognitoToken({ interactive });
+    return ensureCognitoToken();
 }
 function asRecord(value) {
     return value && typeof value === "object" && !Array.isArray(value)
         ? value
         : null;
 }
-function threadRows(data) {
-    const rows = Array.isArray(data?.threads)
-        ? data.threads
-        : Array.isArray(data?.items)
-            ? data.items
-            : [];
-    const out = [];
-    for (const row of rows) {
-        const rec = asRecord(row);
-        if (!rec)
-            continue;
-        out.push(rec);
-    }
-    return out;
-}
-function sortThreadsByActivity(threads) {
-    return [...threads].sort((a, b) => String(b.lastActivityAt || b.createdAt || "").localeCompare(String(a.lastActivityAt || a.createdAt || "")));
-}
-function isActiveThread(thread) {
-    const status = String(thread.threadStatus || "").toLowerCase();
-    return !status || ACTIVE_STATUSES.has(status);
-}
-function threadKey(thread) {
-    const id = typeof thread.threadId === "string" ? thread.threadId.trim() : "";
-    return id || undefined;
-}
-async function listThreadsByQuery(token, query) {
-    const collected = [];
-    let cursor = "";
-    for (let page = 0; page < 10; page += 1) {
-        const pageQuery = { ...query, limit: "100" };
-        if (cursor)
-            pageQuery.cursor = cursor;
-        const data = asRecord(await meshJson(token, "/v1/work-mesh/threads", { query: pageQuery }));
-        collected.push(...threadRows(data));
-        cursor = typeof data?.nextCursor === "string" ? data.nextCursor : "";
-        if (!cursor)
-            break;
-    }
-    return collected;
-}
-async function listThreadsByStatus(token, companyUid) {
+export async function listActiveThreads(token, companyUid, projectId) {
     const collected = [];
     for (const status of ACTIVE_STATUSES) {
-        collected.push(...(await listThreadsByQuery(token, { companyUid, status })));
-    }
-    return collected;
-}
-/**
- * Project facets contain all project-owned threads, including terminal lane
- * threads that have been removed from the active-status index.
- */
-async function listProjectThreads(token, companyUid, projectId) {
-    try {
-        return await listThreadsByQuery(token, {
-            companyUid,
-            projectId,
-        });
-    }
-    catch {
-        try {
-            return await listThreadsByQuery(token, {
+        let cursor = "";
+        for (let page = 0; page < 10; page += 1) {
+            const query = {
                 companyUid,
-                projectId,
-                status: "open",
-            });
-        }
-        catch {
-            return [];
+                status,
+                limit: "100",
+            };
+            if (cursor)
+                query.cursor = cursor;
+            const data = asRecord(await meshJson(token, "/v1/work-mesh/threads", { query }));
+            const rows = Array.isArray(data?.threads)
+                ? data.threads
+                : Array.isArray(data?.items)
+                    ? data.items
+                    : [];
+            for (const row of rows) {
+                const rec = asRecord(row);
+                if (!rec)
+                    continue;
+                collected.push(rec);
+            }
+            cursor = typeof data?.nextCursor === "string" ? data.nextCursor : "";
+            if (!cursor)
+                break;
         }
     }
-}
-function mergeProjectAndStatusThreads(projectThreads, statusThreads, projectId) {
-    const seen = new Set();
-    const merged = [];
-    for (const thread of sortThreadsByActivity(projectThreads.filter((t) => (!t.projectId || t.projectId === projectId) &&
-        (isActiveThread(t) ||
-            (t.kind === "lane" &&
-                ["done", "failed", "interrupted", "cancelled", "killed"].includes(String(t.laneStatus))))))) {
-        const key = threadKey(thread);
-        if (key) {
-            if (seen.has(key))
-                continue;
-            seen.add(key);
-        }
-        merged.push(thread);
-    }
-    for (const thread of sortThreadsByActivity(statusThreads.filter((t) => t.projectId === projectId && isActiveThread(t)))) {
-        const key = threadKey(thread);
-        if (key) {
-            if (seen.has(key))
-                continue;
-            seen.add(key);
-        }
-        merged.push(thread);
-    }
-    return merged;
-}
-export async function listActiveThreads(token, companyUid, projectId) {
-    const statusListed = await listThreadsByStatus(token, companyUid);
-    if (!projectId) {
-        return sortThreadsByActivity(statusListed);
-    }
-    const projectListed = await listProjectThreads(token, companyUid, projectId);
-    return mergeProjectAndStatusThreads(projectListed, statusListed, projectId);
+    return collected
+        .filter((thread) => !projectId || thread.projectId === projectId)
+        .sort((a, b) => String(b.lastActivityAt || b.createdAt || "").localeCompare(String(a.lastActivityAt || a.createdAt || "")));
 }
 export function clamp(value, max) {
     return value.length <= max ? value : value.slice(0, max);
@@ -330,7 +203,7 @@ export function eventPayload(kind, opts, claimedBy) {
 export async function ensureProjectThread(token, company, projectId, opts) {
     if (opts.threadId)
         return { threadId: opts.threadId, created: false };
-    const existing = (await listActiveThreads(token, company.companyUid, projectId)).find((thread) => (thread.kind ?? "project") === "project" && !!thread.threadId);
+    const existing = (await listActiveThreads(token, company.companyUid, projectId))[0];
     if (existing?.threadId)
         return { threadId: existing.threadId, created: false };
     const created = asRecord(await meshJson(token, "/v1/work-mesh/threads", {
@@ -350,57 +223,20 @@ export async function ensureProjectThread(token, company, projectId, opts) {
         throw new Error("Work mesh did not return a threadId");
     return { threadId, created: true };
 }
-/** Ensure the server-owned, stable Work Mesh thread for one lane. */
-export async function ensureLaneMeshThread(token, company, projectId, lane, laneStatus, signal) {
-    const result = asRecord(await meshJson(token, "/v1/work-mesh/threads", {
-        method: "POST",
-        body: {
-            companyUid: company.companyUid,
-            projectId,
-            routing: {
-                priority: "normal",
-                tags: ["hq-lane", `project:${projectId}`, `lane:${lane.laneId}`],
-            },
-            lane,
-            laneStatus,
-        },
-        signal,
-    }));
-    const threadId = typeof result?.threadId === "string" ? result.threadId.trim() : "";
-    if (!threadId)
-        throw new Error("Work mesh lane registration did not return a threadId");
-    return { threadId };
-}
-export async function appendThreadEvent(token, companyUid, threadId, eventKind, payload, signal) {
+export async function appendThreadEvent(token, companyUid, threadId, eventKind, payload) {
     const data = asRecord(await meshJson(token, `/v1/work-mesh/threads/${encodeURIComponent(threadId)}/events`, {
         method: "POST",
         body: { companyUid, eventKind, payload },
-        signal,
     }));
     return {
         eventId: typeof data?.eventId === "string" ? data.eventId : undefined,
         createdAt: typeof data?.createdAt === "string" ? data.createdAt : undefined,
     };
 }
-/**
- * PATCH one Board story. The server derives the actor from the request
- * credential. This body never includes actorUid.
- */
-export async function patchStory(token, companyUid, projectId, storyId, patch) {
-    if (typeof projectId !== "string" || projectId.trim() === "" ||
-        typeof storyId !== "string" || storyId.trim() === "") {
-        throw new TypeError("Work Mesh projectId and storyId must be non-empty strings");
-    }
-    const body = { companyUid };
-    if (patch.status)
-        body.status = patch.status;
-    if (patch.assigneeUid)
-        body.assigneeUid = patch.assigneeUid;
-    if (patch.clearAssignee)
-        body.clearAssignee = true;
+export async function patchStoryStatus(token, companyUid, projectId, storyId, status) {
     const view = asRecord(await meshJson(token, `/v1/work-mesh/projects/${encodeURIComponent(projectId)}/stories/${encodeURIComponent(storyId)}`, {
         method: "PATCH",
-        body,
+        body: { companyUid, status },
     }));
     if (view && typeof view.projectId === "string" && typeof view.companyUid === "string") {
         writeMeshCacheFile(["projects", view.companyUid, `${view.projectId}.json`], view);
@@ -409,99 +245,10 @@ export async function patchStory(token, companyUid, projectId, storyId, patch) {
     const patched = stories
         .map(asRecord)
         .find((row) => row && row.id === storyId);
-    const assigneeUid = patch.clearAssignee
-        ? typeof patched?.assigneeUid === "string"
-            ? patched.assigneeUid
-            : null
-        : typeof patched?.assigneeUid === "string"
-            ? patched.assigneeUid
-            : patch.assigneeUid ?? null;
     return {
         projectId: String(view?.projectId || projectId),
-        status: typeof patched?.status === "string" ? patched.status : patch.status || "",
+        status: typeof patched?.status === "string" ? patched.status : status,
         version: typeof view?.version === "number" ? view.version : undefined,
-        assigneeUid,
-    };
-}
-export async function patchStoryStatus(token, companyUid, projectId, storyId, status) {
-    const patched = await patchStory(token, companyUid, projectId, storyId, { status });
-    return {
-        projectId: patched.projectId,
-        status: patched.status,
-        version: patched.version,
-    };
-}
-function projectViewFromResponse(view, companyUid, projectId) {
-    const returnedProjectId = String(view.projectId || projectId).trim();
-    const returnedCompanyUid = String(view.companyUid || companyUid).trim();
-    const stories = Array.isArray(view.stories)
-        ? view.stories.filter((story) => asRecord(story))
-        : [];
-    const repos = Array.isArray(view.repos)
-        ? view.repos.flatMap((repo) => {
-            const row = asRecord(repo);
-            const path = typeof row?.path === "string" ? row.path.trim() : "";
-            if (!path)
-                return [];
-            return [{ path, branch: typeof row?.branch === "string" ? row.branch.trim() : "" }];
-        })
-        : [];
-    return {
-        companyUid: returnedCompanyUid,
-        projectId: returnedProjectId,
-        name: String(view.name || returnedProjectId),
-        description: typeof view.description === "string" ? view.description : "",
-        stories,
-        repos,
-        version: typeof view.version === "number" ? view.version : undefined,
-    };
-}
-/** Read the full durable Board view before preparing a replacement PUT. */
-export async function getProjectView(token, companyUid, projectId) {
-    const view = asRecord(await meshJson(token, `/v1/work-mesh/projects/${encodeURIComponent(projectId)}`, {
-        query: { companyUid },
-    }));
-    if (!view)
-        throw new Error("Work mesh returned an invalid project view");
-    return projectViewFromResponse(view, companyUid, projectId);
-}
-/** Replace a project's durable Board view and keep the local project cache current. */
-export async function putProjectView(token, companyUid, projectId, input) {
-    const { expectedVersion, ...document } = input;
-    const view = asRecord(await meshJson(token, `/v1/work-mesh/projects/${encodeURIComponent(projectId)}`, {
-        method: "PUT",
-        body: {
-            companyUid,
-            ...document,
-            ...(expectedVersion !== undefined ? { expectedVersion } : {}),
-        },
-        ...(expectedVersion !== undefined
-            ? { headers: { "If-Match": String(expectedVersion) } }
-            : {}),
-    }));
-    if (!view)
-        throw new Error("Work mesh returned an invalid project view");
-    const result = projectViewFromResponse(view, companyUid, projectId);
-    writeMeshCacheFile(["projects", result.companyUid, `${result.projectId}.json`], view);
-    return result;
-}
-/** Register the project genesis thread and deterministic project channel. */
-export async function registerMeshProject(token, companyUid, projectId, channelId) {
-    if (channelId !== undefined && !channelId.trim()) {
-        throw new Error("PROJECT_CHANNEL_INVALID: channelId must be non-empty");
-    }
-    const result = asRecord(await meshJson(token, `/v1/work-mesh/projects/${encodeURIComponent(projectId)}/register`, { method: "POST", body: { companyUid, ...(channelId ? { channelId: channelId.trim() } : {}) } }));
-    const threadId = String(result?.threadId || "").trim();
-    const registeredChannelId = String(result?.channelId || "").trim();
-    if (!threadId || !registeredChannelId) {
-        throw new Error("Work mesh registration did not return a threadId and channelId");
-    }
-    return {
-        companyUid: String(result?.companyUid || companyUid).trim(),
-        projectId: String(result?.projectId || projectId).trim(),
-        threadId,
-        channelId: registeredChannelId,
-        channelCreated: result?.channelCreated === true,
     };
 }
 export function pairDmUidsFromInbox(inbox) {
@@ -608,43 +355,15 @@ export function meshCachePrincipalUid(tokens, fallbackToken) {
     }
     return "session";
 }
-function tokensIdentifySamePrincipal(token, candidate) {
-    if (token === candidate)
-        return true;
-    const tokenClaims = peekIdToken(token);
-    const candidateClaims = peekIdToken(candidate);
-    const tokenEntityUid = entityUidFromJwt(token);
-    const candidateEntityUid = entityUidFromJwt(candidate);
-    if (tokenEntityUid && candidateEntityUid && tokenEntityUid !== candidateEntityUid) {
-        return false;
-    }
-    for (const claim of ["sub", "cognito:username", "username", "email"]) {
-        const tokenValue = tokenClaims[claim];
-        const candidateValue = candidateClaims[claim];
-        if (typeof tokenValue === "string" &&
-            tokenValue.length > 0 &&
-            tokenValue === candidateValue) {
-            return true;
-        }
-    }
-    return false;
-}
 /**
- * Resolve the authenticated request principal. The request token is the source
- * of truth; cached credentials may contribute an entity uid only when they
- * identify the same caller. Only the uid is kept — credentials are discarded.
+ * Resolve the cache principal. JWT first; if the human access/id tokens have
+ * no entityUid, ask `/v1/realtime/credentials` (same fallback as the pack
+ * doctor). Only the uid is kept — credentials are discarded.
  */
 export async function resolveMeshPrincipalUid(token, tokens) {
-    const fromRequestToken = entityUidFromJwt(token);
-    if (fromRequestToken)
-        return fromRequestToken;
-    for (const candidate of [tokens?.idToken, tokens?.accessToken]) {
-        if (!candidate || !tokensIdentifySamePrincipal(token, candidate))
-            continue;
-        const uid = entityUidFromJwt(candidate);
-        if (uid)
-            return uid;
-    }
+    const fromJwt = meshCachePrincipalUid(tokens, token);
+    if (fromJwt !== "session")
+        return fromJwt;
     try {
         const data = await meshJson(token, "/v1/realtime/credentials", {
             method: "POST",
@@ -655,8 +374,19 @@ export async function resolveMeshPrincipalUid(token, tokens) {
             return uid;
     }
     catch {
-        // Best-effort; callers must fail rather than claim work as "session".
+        // best-effort; session.json is worse than failing doctor
     }
-    return undefined;
+    return "session";
+}
+export function callerLabelFromToken(token) {
+    const claims = peekIdToken(token);
+    const entityUid = claims["custom:entityUid"];
+    if (typeof entityUid === "string" && entityUid)
+        return entityUid;
+    if (typeof claims.email === "string" && claims.email)
+        return claims.email;
+    if (typeof claims.sub === "string" && claims.sub)
+        return claims.sub;
+    return "hq-cli";
 }
 //# sourceMappingURL=api.js.map

package/dist/lib/mesh/client.d.ts

@@ -73,9 +73,8 @@ export interface MigrationCapabilityProbe {
     companies: MigrationCapabilityCompanyResult[];
 }
 /**
- * Diagnostic probe for migration capability across active memberships. The
- * result is recorded and warned on, but does not gate a verified member from
- * choosing a device-local default company.
+ * Unlock rule for default-company mode (US-017B): migration must be true for
+ * EVERY company the caller belongs to. Offline / empty memberships → locked.
  */
 export declare function probeMigrationCapabilityForMemberships(token: string, opts?: {
     listCompanies?: (token: string) => Promise<MeshCompany[]>;

package/dist/lib/mesh/client.js

@@ -4,7 +4,6 @@
  * vault HTTP + receipt-shaped responses (US-007A / US-007B).
  */
 import { listActiveMembershipCompanies, meshJson, requireToken, resolveMeshCompany, } from "./api.js";
-import { isWorkSessionDenialCode } from "./denial-codes.js";
 export { meshJson, requireToken, resolveMeshCompany, listActiveMembershipCompanies };
 export async function openMeshTransport(opts) {
     const token = await requireToken();
@@ -51,28 +50,11 @@ export function createWorkSessionDeliverer(opts) {
             const message = err instanceof Error ? err.message : String(err);
             // meshJson throws on !ok with error text; classify by leading status when present.
             const statusMatch = /^(\d{3})\b/.exec(message);
-            const errorFields = err && typeof err === "object"
-                ? err
-                : {};
-            const status = typeof errorFields.status === "number" &&
-                Number.isInteger(errorFields.status)
-                ? errorFields.status
-                : statusMatch
-                    ? Number(statusMatch[1])
-                    : undefined;
-            if (status === 401 || status === 403) {
-                const serverCode = isWorkSessionDenialCode(errorFields.code)
-                    ? errorFields.code
-                    : undefined;
-                return {
-                    ok: false,
-                    retryable: false,
-                    code: "AUTH_DENIED",
-                    httpStatus: status,
-                    ...(serverCode ? { serverCode } : {}),
-                };
-            }
-            if (status !== undefined) {
+            if (statusMatch) {
+                const status = Number(statusMatch[1]);
+                if (status === 401 || status === 403) {
+                    return { ok: false, retryable: false, code: "AUTH_DENIED" };
+                }
                 if (status === 400 || status === 422) {
                     return { ok: false, retryable: false, code: "VALIDATION_FAILED" };
                 }
@@ -137,9 +119,8 @@ export async function fetchMigrationCapability(token, companyUid) {
     }
 }
 /**
- * Diagnostic probe for migration capability across active memberships. The
- * result is recorded and warned on, but does not gate a verified member from
- * choosing a device-local default company.
+ * Unlock rule for default-company mode (US-017B): migration must be true for
+ * EVERY company the caller belongs to. Offline / empty memberships → locked.
  */
 export async function probeMigrationCapabilityForMemberships(token, opts) {
     const now = (opts?.now ?? (() => new Date()))().toISOString();