@indigoai-us/hq-cli 5.345.142 → 5.345.144

package/dist/commands/storage-offload.js

@@ -119,7 +119,16 @@ export function resolveMinBytes(flag, env) {
         return parseSize(fromEnv);
     return DEFAULT_MIN_BYTES;
 }
-export function renderPointer(p) {
+/** Company-vault key for library bytes: content-addressed by sha256, relative to the company bucket. */
+export function companyOffloadKey(sha256) {
+    return `${OFFLOAD_PREFIX}${sha256}`;
+}
+/**
+ * Render a placeholder. `assetBlock` is the fenced `hq-asset` metadata block
+ * (from hq-cloud's `formatCloudAssetBlock`) that `hq library add` appends after
+ * the footer so the placeholder is a searchable library asset.
+ */
+export function renderPointer(p, assetBlock) {
     const lines = [POINTER_HEADER, `path: ${p.path}`, `size: ${p.size}`, `sha256: ${p.sha256 ?? "unknown"}`];
     if (p.gitBlob)
         lines.push(`git-blob: ${p.gitBlob}`);
@@ -131,6 +140,8 @@ export function renderPointer(p) {
     if (p.orphaned)
         lines.push("orphaned: true");
     lines.push(`retrieve: hq storage fetch "${p.path}"`, POINTER_FOOTER, "");
+    if (assetBlock)
+        lines.push(assetBlock.endsWith("\n") ? assetBlock : `${assetBlock}\n`);
     return lines.join("\n");
 }
 /** ETags compare without the surrounding quotes S3 returns. */
@@ -142,9 +153,11 @@ const HEX64 = /^[0-9a-f]{64}$/;
 /**
  * Parse pointer text. Returns null for anything that is not a valid v1 pointer.
  *
- * Two shapes are valid:
+ * Three shapes are valid:
  *   - an offload copy: `vault: personal`, key = offloadKey(git-blob), with a
  *     git blob id to verify against;
+ *   - a library copy: `vault: company`, key = companyOffloadKey(sha256), with
+ *     the sha256 to verify against (written by `hq library add`);
  *   - a vault object recorded by sync: either vault, a non-offload key, and a
  *     `remote-etag` to verify against (sha256 may be `unknown`).
  */
@@ -191,10 +204,22 @@ export function parsePointer(text) {
     const isOffloadCopy = p.gitBlob !== undefined && p.key === offloadKey(p.gitBlob);
     if (isOffloadCopy)
         return p.vault === "personal" ? p : null;
+    if (isCompanyOffloadCopy(p))
+        return p;
     if (p.key.startsWith(OFFLOAD_PREFIX) || !p.remoteEtag)
         return null;
     return p;
 }
+/**
+ * Library copy in a company vault: content-addressed under
+ * `.hq-offload/blobs/<sha256>`, verified by that sha256 (no git blob, no ETag).
+ */
+export function isCompanyOffloadCopy(p) {
+    return (p.vault === "company" &&
+        p.sha256 !== null &&
+        p.gitBlob === undefined &&
+        p.key === companyOffloadKey(p.sha256));
+}
 /** sha256 and git blob id (sha1 of "blob <size>\0" + bytes) in one pass. */
 export async function digestFile(file) {
     const size = (await fs.promises.stat(file)).size;
@@ -1320,7 +1345,7 @@ async function downloadVerified(download, key, dest, expect) {
 /** Company slug for a company-vault placeholder, checked against its key. */
 export function companyForPointer(pointer) {
     const m = /^companies\/([^/]+)\/(.+)$/.exec(pointer.path);
-    if (!m || m[2] !== pointer.key) {
+    if (!m || (!isCompanyOffloadCopy(pointer) && m[2] !== pointer.key)) {
         throw new Error(`Placeholder for '${pointer.path}' names company vault key '${pointer.key}', which does not match its location. Nothing was changed.`);
     }
     return m[1];
@@ -1377,7 +1402,10 @@ async function fetchPlaceholder(arg, deps, opts) {
         throw new Error(`'${pointer.path}' already exists locally. Move it aside first.`);
     }
     let digest;
-    if (pointer.remoteEtag === undefined) {
+    if (isCompanyOffloadCopy(pointer)) {
+        digest = await fetchCompanyOffload(pointer, target, deps);
+    }
+    else if (pointer.remoteEtag === undefined) {
         // Offload copy in the personal vault, verified by git blob id and sha256.
         const store = await deps.openPersonal();
         digest = await downloadVerified((partial) => store.download(pointer.key, partial), pointer.key, target, {
@@ -1392,6 +1420,29 @@ async function fetchPlaceholder(arg, deps, opts) {
     await fs.promises.rm(placeholder, { force: true });
     return { path: pointer.path, bytes: digest.size, sha256: digest.sha256 };
 }
+/**
+ * Library copy (`hq library add`): download `.hq-offload/blobs/<sha256>` from
+ * the company vault and verify the bytes against that sha256. The object is
+ * content-addressed, so the current ETag is pinned only to keep one download
+ * consistent. Opened only for a company the caller is an active member of.
+ */
+async function fetchCompanyOffload(pointer, target, deps) {
+    if (!deps.openVaultObjects)
+        throw new Error("This HQ build cannot fetch files from a company library.");
+    const slug = companyForPointer(pointer);
+    const active = deps.activeCompanySlugs ? await deps.activeCompanySlugs() : [];
+    if (!active.includes(slug)) {
+        throw new Error(`You are not an active member of '${slug}', so HQ cannot download this file for you.`);
+    }
+    const store = await deps.openVaultObjects({ vault: "company", slug });
+    const head = await store.head(pointer.key);
+    if (!head)
+        throw new Error(`This file is no longer in the cloud (${pointer.key}).`);
+    return downloadVerified((partial) => store.download(pointer.key, partial, head.etag), pointer.key, target, {
+        sha256: pointer.sha256,
+        size: pointer.size,
+    });
+}
 /**
  * Placeholder that sync rewrote to a vault object: download pinned to the
  * recorded ETag and verify size (and sha256 when known). A company vault is

package/dist/commands/storage.d.ts

@@ -36,7 +36,7 @@
 import { Command } from "commander";
 import { type ReclaimReport } from "./storage-core.js";
 import { S3Client, ListObjectVersionsCommand, DeleteObjectsCommand, type ListObjectVersionsCommandOutput, type DeleteObjectsCommandOutput } from "@aws-sdk/client-s3";
-import { type OffloadResult, type OffloadStatus } from "./storage-offload.js";
+import { type OffloadDeps, type OffloadResult, type OffloadStatus } from "./storage-offload.js";
 export type TrancheId = "7d" | "30d" | "90d" | "365d" | "older";
 export declare const TRANCHES: readonly {
     id: TrancheId;
@@ -265,6 +265,11 @@ export declare const NEEDS_YES = "No terminal to confirm in. Re-run with --yes t
 export declare function confirmOnTty(message: string, input?: NodeJS.ReadableStream & {
     isTTY?: boolean;
 }, output?: NodeJS.WritableStream): Promise<boolean>;
+/**
+ * Deps for offload/fetch. The only store is the caller's personal vault,
+ * resolved from their canonical person entity and vended with `/sts/vend-self`.
+ */
+export declare function buildOffloadDeps(): Promise<OffloadDeps>;
 /**
  * An S3 client for one vault whose credentials are re-vended before they
  * expire, plus `revend`, which vends now and returns a client on the new
@@ -296,5 +301,7 @@ export declare function refreshingVendedCredentials(vend: () => Promise<VendedCr
     sessionToken: string;
     expiration?: Date;
 }>;
+/** Production deps. Exported for `hq billing usage`, which reads cloud status only. */
+export declare function buildStorageDeps(): Promise<StorageDeps>;
 export declare function registerStorageCommand(program: Command): Command;
 //# sourceMappingURL=storage.d.ts.map

package/dist/commands/storage.js

@@ -1003,7 +1003,7 @@ async function signedInVault() {
  * Deps for offload/fetch. The only store is the caller's personal vault,
  * resolved from their canonical person entity and vended with `/sts/vend-self`.
  */
-async function buildOffloadDeps() {
+export async function buildOffloadDeps() {
     const hqRoot = findHqRoot();
     const personalVault = async () => {
         const { vault } = await signedInVault();
@@ -1189,6 +1189,10 @@ export function refreshingVendedCredentials(vend, now = Date.now, marginMs = 5 *
         return pending;
     };
 }
+/** Production deps. Exported for `hq billing usage`, which reads cloud status only. */
+export async function buildStorageDeps() {
+    return buildDeps();
+}
 async function buildDeps() {
     // Sign-in is lazy so `status` can still report local sections when signed out,
     // and it is resolved again for every cloud call (never once at the start): the
@@ -1323,7 +1327,7 @@ export function registerStorageCommand(program) {
                 paths: Array.isArray(opts.current) ? opts.current : undefined,
                 dryRun: Boolean(opts.dryRun),
                 yes: Boolean(opts.yes),
-            }, await buildOffloadDeps());
+            }, { ...(await buildOffloadDeps()), log: (line) => (opts.json ? console.error(line) : console.log(line)) });
             if (!result)
                 return;
             console.log(opts.json ? JSON.stringify(result, null, 2) : formatOffload(result));