@indigoai-us/hq-cli 5.345.136 → 5.345.138

package/dist/commands/storage.js

@@ -838,12 +838,16 @@ export function formatOffload(r) {
 const CURRENT_ACTION_LABEL = {
     "point-at-vault": "point at vault",
     upload: "upload",
+    "upload+offload": "upload+offload",
     skip: "skip",
 };
 /** One `--current` plan line: path, size, owning vault, sync state, action. */
 function formatCurrentFile(f) {
     const vault = f.vault === "company" ? `company ${f.company ?? "?"}` : "personal vault";
     const parts = [f.path, formatBytes(f.bytes), vault, f.synced ? "synced" : "not synced", CURRENT_ACTION_LABEL[f.action]];
+    if (f.action === "upload+offload") {
+        parts.push(`(${f.bytes} bytes to the company ${f.company ?? "?"} vault at ${f.vault_key ?? f.path})`);
+    }
     if (f.action === "skip" && f.reason)
         parts.push(`(${f.reason})`);
     return parts.join("  ");
@@ -1026,6 +1030,24 @@ async function buildOffloadDeps() {
         return companiesFromMemberships(await res.json());
     };
     const journals = new Map();
+    const journalSlug = (target) => target.vault === "company" ? target.slug : hqCloud.PERSONAL_VAULT_JOURNAL_SLUG;
+    const companyVault = async (slug) => {
+        const company = (await activeCompanies()).find((c) => c.slug === slug);
+        if (!company)
+            throw new Error(`You are not an active member of '${slug}'.`);
+        const { vault } = await signedInVault();
+        const entity = await vault.entity.get(company.uid);
+        return { company, bucket: entity.bucketName ?? `hq-vault-cmp-${company.slug}` };
+    };
+    // Company upload, the ignore explainer and the cloud-only journal row ship
+    // in a newer @indigoai-us/hq-cloud. Until the bundled one exports them,
+    // company files over the sync limit report "update HQ sync".
+    const cloud = hqCloud;
+    const explainIgnore = cloud.createIgnoreExplainer;
+    const uploadLarge = cloud.uploadLargeObjectVerified;
+    const multipartClient = cloud.s3MultipartClient;
+    const recordOffloaded = cloud.recordOffloadedObject;
+    let explainer;
     return {
         hqRoot,
         now: () => new Date(),
@@ -1047,9 +1069,9 @@ async function buildOffloadDeps() {
         syncHoldsPlaceholders: () => hqCloud.CLOUD_PLACEHOLDER_HOLDS_ANY_SIBLING === true,
         // What HQ sync last stored for a file, read from its local journal.
         // Company journal keys are relative to the company folder; personal keys
-        // are relative to the HQ root. Read-only: offload never writes a journal.
+        // are relative to the HQ root. The only journal write is recordCloudOnly.
         syncRecord: async (target) => {
-            const slug = target.vault === "company" ? target.slug : hqCloud.PERSONAL_VAULT_JOURNAL_SLUG;
+            const slug = journalSlug(target);
             let journal = journals.get(slug);
             if (!journal) {
                 journal = hqCloud.readJournal(slug);
@@ -1067,15 +1089,48 @@ async function buildOffloadDeps() {
                 const { bucket, credentials } = await personalVault();
                 return s3VaultObjectStore(bucket, new S3Client({ region: DEFAULT_COGNITO.region, credentials }));
             }
-            const company = (await activeCompanies()).find((c) => c.slug === target.slug);
-            if (!company)
-                throw new Error(`You are not an active member of '${target.slug}'.`);
+            const { company, bucket } = await companyVault(target.slug);
             const { vault } = await signedInVault();
             const vend = await vault.sts.vend({ companyUid: company.uid });
-            const entity = await vault.entity.get(company.uid);
-            const bucket = entity.bucketName ?? `hq-vault-cmp-${company.slug}`;
             return s3VaultObjectStore(bucket, new S3Client({ region: DEFAULT_COGNITO.region, credentials: vend.credentials }));
         },
+        syncMaxFileBytes: typeof cloud.SYNC_MAX_FILE_BYTES === "number" ? cloud.SYNC_MAX_FILE_BYTES : undefined,
+        syncExclusion: explainIgnore
+            ? (rel) => {
+                explainer ??= explainIgnore(hqRoot);
+                return explainer(rel);
+            }
+            : undefined,
+        // Multipart upload into the company vault, through the caller's
+        // membership-scoped /sts/vend credentials (re-vended before they expire,
+        // since a multi-GB upload can outlast one STS session).
+        openCompanyUploader: uploadLarge && multipartClient && recordOffloaded
+            ? async (slug) => {
+                const { company, bucket } = await companyVault(slug);
+                if (bucket.startsWith("hq-vault-prs-")) {
+                    throw new Error(`'${bucket}' is a personal vault, not the company vault for '${slug}'.`);
+                }
+                const credentials = refreshingVendedCredentials(async () => {
+                    const { vault } = await signedInVault();
+                    const vend = await vault.sts.vend({ companyUid: company.uid });
+                    return { ...vend.credentials, expiresAt: vend.expiresAt };
+                });
+                const client = multipartClient(new S3Client({ region: DEFAULT_COGNITO.region, credentials }), bucket);
+                return {
+                    slug: company.slug,
+                    bucket,
+                    upload: ({ key, file, stateFile }) => uploadLarge({ client, key, filePath: file, stateFile }),
+                };
+            }
+            : undefined,
+        recordCloudOnly: recordOffloaded
+            ? async (target, object) => {
+                const slug = journalSlug(target);
+                recordOffloaded({ journalSlug: slug, key: target.key, ...object });
+                // The cached journal is stale now; reread it on the next lookup.
+                journals.delete(slug);
+            }
+            : undefined,
     };
 }
 /**