@indigoai-us/hq-cli 5.345.133 → 5.345.135

package/dist/utils/person-token-cache.js

@@ -0,0 +1,95 @@
+/**
+ * The person's cached Cognito session, read from disk and the shared Keychain
+ * item without any network call. Split out of cognito-session.ts so offline
+ * callers (lane start and the handoff commits) can read the cached ID token
+ * without bundling the refresh and login clients. cognito-session.ts
+ * re-exports these readers.
+ */
+import * as fs from "node:fs";
+import * as os from "node:os";
+import * as path from "node:path";
+import { accessTokenFingerprint, loadCachedTokens as loadCachedTokensFromFile } from "@indigoai-us/hq-cloud";
+import { pickNewerSession, readKeychainTokens } from "./token-keychain.js";
+/**
+ * On-disk person Cognito cache path for `env` (`HQ_STATE_DIR` or `~/.hq`).
+ * Deliberately does not use hq-cloud's `loadCachedTokens()`: after a machine
+ * mint in this process, that helper returns in-memory machine tokens when the
+ * person file is absent, which would falsely block the fresh-box fallback.
+ */
+export function personTokenCacheFile(home = os.homedir(), env = process.env) {
+    const override = env.HQ_STATE_DIR?.trim();
+    const stateDir = override && override.length > 0 ? override : path.join(home, ".hq");
+    return path.join(stateDir, "cognito-tokens.json");
+}
+export function decodeJwtPayload(token) {
+    if (!token)
+        return null;
+    const parts = token.split(".");
+    if (parts.length < 2 || !parts[1])
+        return null;
+    try {
+        const json = Buffer.from(parts[1], "base64url").toString("utf8");
+        const parsed = JSON.parse(json);
+        if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+            return null;
+        return parsed;
+    }
+    catch {
+        return null;
+    }
+}
+export function readTokenFile(file) {
+    try {
+        if (!fs.existsSync(file))
+            return null;
+        const raw = JSON.parse(fs.readFileSync(file, "utf8"));
+        if (typeof raw.accessToken !== "string" || typeof raw.idToken !== "string")
+            return null;
+        return raw;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * The person session from the shared macOS Keychain item (see
+ * ./token-keychain.ts), or null. Not read when the token file is missing:
+ * no file means signed out. Machine-identity and invalidated tokens are
+ * refused, the same as the file loader.
+ */
+export function personKeychainTokens(file, home, env, keychain = {}) {
+    if (!fs.existsSync(file))
+        return null;
+    const tokens = readKeychainTokens({ env, home, ...keychain });
+    if (!tokens)
+        return null;
+    const claims = decodeJwtPayload(tokens.idToken);
+    const entityType = claims?.["custom:entityType"];
+    if (typeof entityType === "string" && entityType.trim().length > 0)
+        return null;
+    if (fs.existsSync(`${file}.invalid.${accessTokenFingerprint(tokens.accessToken)}`))
+        return null;
+    return tokens;
+}
+/**
+ * Person session for `env`: the Keychain item and the token file, the newer
+ * by `expiresAt` (see ./token-keychain.ts). Does not consult hq-cloud's
+ * in-memory fallback, which can surface a different session when the file
+ * is missing or unreadable.
+ */
+export function readPersonTokenFile(home = os.homedir(), env = process.env, keychain = {}) {
+    const file = personTokenCacheFile(home, env);
+    return pickNewerSession(personKeychainTokens(file, home, env, keychain), readTokenFile(file));
+}
+/**
+ * The person's cached session: the shared Keychain item and hq-cloud's file
+ * loader, the newer by `expiresAt`. Writes still go only to the file in this
+ * step.
+ */
+export function loadCachedTokens(env = process.env, keychain = {}) {
+    const home = os.homedir();
+    const file = personTokenCacheFile(home, env);
+    const fromFile = loadCachedTokensFromFile();
+    return pickNewerSession(personKeychainTokens(file, home, env, keychain), fromFile);
+}
+//# sourceMappingURL=person-token-cache.js.map

package/dist/utils/vault-api.d.ts

@@ -109,7 +109,17 @@ export type CallerIdentity = {
  * {@link resolveCallerPersonUid} does. Use this where the server accepts an
  * agent principal; use `resolveCallerPersonUid` where only a person can act.
  */
-export declare function resolveCallerUid(token: string, baseUrl?: string): Promise<CallerIdentity>;
+export declare function resolveCallerUid(token: string, baseUrl?: string, opts?: {
+    signal?: AbortSignal;
+}): Promise<CallerIdentity>;
+/**
+ * Thrown when the person lookup succeeds but the caller has no person entity.
+ * This is a definitive answer, unlike a network or HTTP failure, so callers
+ * that cache lookups may remember it.
+ */
+export declare class NoPersonEntityError extends Error {
+    constructor();
+}
 /** Thrown when a person-only command runs under an agent machine identity. */
 export declare function agentIdentityUnsupportedError(agentUid: string, command?: string): Error;
 /**
@@ -120,6 +130,16 @@ export declare function agentIdentityUnsupportedError(agentUid: string, command?
 export declare function resolveCallerPersonUid(token: string, baseUrl?: string, opts?: {
     command?: string;
 }): Promise<string>;
+/**
+ * A signal that aborts when any input signal aborts, with that signal's
+ * reason. It stands in for `AbortSignal.any`, which Node only added in 20.3,
+ * so the CLI keeps working on Node 20.0. Call `dispose` once the guarded work
+ * settles to remove the listeners from the inputs.
+ */
+export declare function anySignal(signals: AbortSignal[]): {
+    signal: AbortSignal;
+    dispose: () => void;
+};
 export declare function getEntityUid(token: string, opts: {
     personal?: boolean;
     companySlug?: string;

package/dist/utils/vault-api.js

@@ -735,11 +735,22 @@ export function agentUidFromToken(token) {
  * {@link resolveCallerPersonUid} does. Use this where the server accepts an
  * agent principal; use `resolveCallerPersonUid` where only a person can act.
  */
-export async function resolveCallerUid(token, baseUrl) {
+export async function resolveCallerUid(token, baseUrl, opts = {}) {
     const agentUid = agentUidFromToken(token);
     if (agentUid)
         return { kind: 'agent', uid: agentUid };
-    return { kind: 'person', uid: await lookupCallerPersonUid(token, baseUrl) };
+    return { kind: 'person', uid: await lookupCallerPersonUid(token, baseUrl, opts.signal) };
+}
+/**
+ * Thrown when the person lookup succeeds but the caller has no person entity.
+ * This is a definitive answer, unlike a network or HTTP failure, so callers
+ * that cache lookups may remember it.
+ */
+export class NoPersonEntityError extends Error {
+    constructor() {
+        super('No person entity found for the caller. Sign in to HQ once to provision one.');
+        this.name = 'NoPersonEntityError';
+    }
 }
 /** Thrown when a person-only command runs under an agent machine identity. */
 export function agentIdentityUnsupportedError(agentUid, command) {
@@ -758,14 +769,52 @@ export async function resolveCallerPersonUid(token, baseUrl, opts = {}) {
         throw agentIdentityUnsupportedError(agentUid, opts.command);
     return lookupCallerPersonUid(token, baseUrl);
 }
+/**
+ * A signal that aborts when any input signal aborts, with that signal's
+ * reason. It stands in for `AbortSignal.any`, which Node only added in 20.3,
+ * so the CLI keeps working on Node 20.0. Call `dispose` once the guarded work
+ * settles to remove the listeners from the inputs.
+ */
+export function anySignal(signals) {
+    const controller = new AbortController();
+    const listeners = [];
+    const dispose = () => {
+        for (const [input, listener] of listeners.splice(0))
+            input.removeEventListener('abort', listener);
+    };
+    for (const input of signals) {
+        if (input.aborted) {
+            dispose();
+            controller.abort(input.reason);
+            break;
+        }
+        const listener = () => {
+            dispose();
+            controller.abort(input.reason);
+        };
+        input.addEventListener('abort', listener, { once: true });
+        listeners.push([input, listener]);
+    }
+    return { signal: controller.signal, dispose };
+}
 // Same selection rule as the backend's `resolveCallerPersonUid`: ascending by
 // createdAt, tie-break by uid ascending. Returns the `prs_*` UID.
-async function lookupCallerPersonUid(token, baseUrl) {
+async function lookupCallerPersonUid(token, baseUrl, signal) {
+    const timeout = AbortSignal.timeout(identityLookupTimeoutMs());
+    const combined = signal ? anySignal([timeout, signal]) : { signal: timeout, dispose: () => { } };
+    try {
+        return await lookupCallerPersonUidWith(token, baseUrl, combined.signal);
+    }
+    finally {
+        combined.dispose();
+    }
+}
+async function lookupCallerPersonUidWith(token, baseUrl, signal) {
     const res = await vaultApiFetch({
         token,
         path: '/entity/by-type/person',
         baseUrl,
-        signal: AbortSignal.timeout(identityLookupTimeoutMs()),
+        signal,
     });
     if (!res.ok) {
         if (isUnavailableSecretLoadHttpStatus(res.status)) {
@@ -776,7 +825,7 @@ async function lookupCallerPersonUid(token, baseUrl) {
     const data = (await res.json());
     const persons = (data.entities ?? []).filter((e) => e.type === 'person');
     if (persons.length === 0) {
-        throw new Error('No person entity found for the caller. Sign in to HQ once to provision one.');
+        throw new NoPersonEntityError();
     }
     persons.sort((a, b) => {
         const ac = a.createdAt ?? '';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.345.133",
+  "version": "5.345.135",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {