@indigoai-us/hq-cli 5.345.143 → 5.345.145

package/dist/commands/members.js

@@ -237,6 +237,30 @@ export async function listPendingInvites(token, companyUid) {
     const data = (await res.json());
     return data?.pending ?? data?.invites ?? [];
 }
+/** JSON row for `hq members list --json`. `person_id` is the prs_/agt_ id grants use. */
+export function activeMemberJson(m) {
+    return {
+        person_id: m.personUid,
+        email: m.personEmail ?? null,
+        name: m.personName ?? null,
+        slug: m.personSlug ?? null,
+        role: m.role,
+        status: m.status,
+        membership_key: m.membershipKey,
+    };
+}
+/** JSON row for `hq members list --pending --json`. */
+export function pendingInviteJson(inv) {
+    return {
+        person_id: inv.personUid ?? null,
+        email: inv.inviteeEmail ?? null,
+        role: inv.role,
+        status: inv.status,
+        invited_by: inv.invitedBy,
+        invited_at: inv.invitedAt,
+        membership_key: inv.membershipKey,
+    };
+}
 export async function listActiveMembers(token, companyUid) {
     const res = await vaultApiFetch({
         token,
@@ -750,6 +774,8 @@ export function registerMembersCommand(program) {
         .command("list")
         .description("List the company's active members (use --pending for pending invites)")
         .option("--pending", "List pending invites instead of active members")
+        .option("--ids", "Add a PERSON_ID column (the prs_ id used in grants and membership keys)")
+        .option("--json", "Print machine-readable JSON, including each person id")
         .action(async (opts) => {
         try {
             const token = (await resolveVaultCredential()).token;
@@ -758,6 +784,13 @@ export function registerMembersCommand(program) {
             if (opts.pending) {
                 // --pending: preserve the original pending-invites view verbatim.
                 const invites = await listPendingInvites(token, companyUid);
+                if (opts.json) {
+                    console.log(JSON.stringify({
+                        company_uid: companyUid,
+                        pending: invites.map(pendingInviteJson),
+                    }, null, 2));
+                    return;
+                }
                 if (invites.length === 0) {
                     console.log(chalk.gray("No pending invites for this company."));
                     return;
@@ -788,17 +821,33 @@ export function registerMembersCommand(program) {
             // Default: list ACTIVE members so their emails drop straight into
             // `hq secrets share <path> --with <email>`.
             const activeMembers = await listActiveMembers(token, companyUid);
+            if (opts.json) {
+                console.log(JSON.stringify({
+                    company_uid: companyUid,
+                    members: activeMembers.map(activeMemberJson),
+                }, null, 2));
+                return;
+            }
             if (activeMembers.length === 0) {
                 console.log(chalk.gray("No active members found for this company."));
                 return;
             }
             const emailW = Math.max(5, ...activeMembers.map((m) => (m.personEmail ?? m.personUid).length));
             const roleW = Math.max(4, ...activeMembers.map((m) => m.role.length));
-            console.log(chalk.bold(["EMAIL".padEnd(emailW), "ROLE".padEnd(roleW), "NAME"].join("  ")));
+            const idW = Math.max(9, ...activeMembers.map((m) => m.personUid.length));
+            const header = ["EMAIL".padEnd(emailW), "ROLE".padEnd(roleW)];
+            if (opts.ids)
+                header.push("PERSON_ID".padEnd(idW));
+            header.push("NAME");
+            console.log(chalk.bold(header.join("  ")));
             for (const m of activeMembers) {
                 const email = m.personEmail ?? m.personUid;
                 const name = m.personName ?? m.personSlug ?? "";
-                console.log([email.padEnd(emailW), m.role.padEnd(roleW), name].join("  "));
+                const row = [email.padEnd(emailW), m.role.padEnd(roleW)];
+                if (opts.ids)
+                    row.push(m.personUid.padEnd(idW));
+                row.push(name);
+                console.log(row.join("  "));
             }
         }
         catch (err) {

package/dist/commands/storage-offload.d.ts

@@ -96,19 +96,33 @@ export interface Pointer {
     /** Set by sync when a teammate deleted the remote file. */
     orphaned?: boolean;
 }
-export declare function renderPointer(p: Pointer): string;
+/** Company-vault key for library bytes: content-addressed by sha256, relative to the company bucket. */
+export declare function companyOffloadKey(sha256: string): string;
+/**
+ * Render a placeholder. `assetBlock` is the fenced `hq-asset` metadata block
+ * (from hq-cloud's `formatCloudAssetBlock`) that `hq library add` appends after
+ * the footer so the placeholder is a searchable library asset.
+ */
+export declare function renderPointer(p: Pointer, assetBlock?: string): string;
 /** ETags compare without the surrounding quotes S3 returns. */
 export declare function normalizeEtag(etag: string | undefined): string;
 /**
  * Parse pointer text. Returns null for anything that is not a valid v1 pointer.
  *
- * Two shapes are valid:
+ * Three shapes are valid:
  *   - an offload copy: `vault: personal`, key = offloadKey(git-blob), with a
  *     git blob id to verify against;
+ *   - a library copy: `vault: company`, key = companyOffloadKey(sha256), with
+ *     the sha256 to verify against (written by `hq library add`);
  *   - a vault object recorded by sync: either vault, a non-offload key, and a
  *     `remote-etag` to verify against (sha256 may be `unknown`).
  */
 export declare function parsePointer(text: string): Pointer | null;
+/**
+ * Library copy in a company vault: content-addressed under
+ * `.hq-offload/blobs/<sha256>`, verified by that sha256 (no git blob, no ETag).
+ */
+export declare function isCompanyOffloadCopy(p: Pointer): boolean;
 export interface FileDigest {
     size: number;
     sha256: string;

package/dist/commands/storage-offload.js

@@ -119,7 +119,16 @@ export function resolveMinBytes(flag, env) {
         return parseSize(fromEnv);
     return DEFAULT_MIN_BYTES;
 }
-export function renderPointer(p) {
+/** Company-vault key for library bytes: content-addressed by sha256, relative to the company bucket. */
+export function companyOffloadKey(sha256) {
+    return `${OFFLOAD_PREFIX}${sha256}`;
+}
+/**
+ * Render a placeholder. `assetBlock` is the fenced `hq-asset` metadata block
+ * (from hq-cloud's `formatCloudAssetBlock`) that `hq library add` appends after
+ * the footer so the placeholder is a searchable library asset.
+ */
+export function renderPointer(p, assetBlock) {
     const lines = [POINTER_HEADER, `path: ${p.path}`, `size: ${p.size}`, `sha256: ${p.sha256 ?? "unknown"}`];
     if (p.gitBlob)
         lines.push(`git-blob: ${p.gitBlob}`);
@@ -131,6 +140,8 @@ export function renderPointer(p) {
     if (p.orphaned)
         lines.push("orphaned: true");
     lines.push(`retrieve: hq storage fetch "${p.path}"`, POINTER_FOOTER, "");
+    if (assetBlock)
+        lines.push(assetBlock.endsWith("\n") ? assetBlock : `${assetBlock}\n`);
     return lines.join("\n");
 }
 /** ETags compare without the surrounding quotes S3 returns. */
@@ -142,9 +153,11 @@ const HEX64 = /^[0-9a-f]{64}$/;
 /**
  * Parse pointer text. Returns null for anything that is not a valid v1 pointer.
  *
- * Two shapes are valid:
+ * Three shapes are valid:
  *   - an offload copy: `vault: personal`, key = offloadKey(git-blob), with a
  *     git blob id to verify against;
+ *   - a library copy: `vault: company`, key = companyOffloadKey(sha256), with
+ *     the sha256 to verify against (written by `hq library add`);
  *   - a vault object recorded by sync: either vault, a non-offload key, and a
  *     `remote-etag` to verify against (sha256 may be `unknown`).
  */
@@ -191,10 +204,22 @@ export function parsePointer(text) {
     const isOffloadCopy = p.gitBlob !== undefined && p.key === offloadKey(p.gitBlob);
     if (isOffloadCopy)
         return p.vault === "personal" ? p : null;
+    if (isCompanyOffloadCopy(p))
+        return p;
     if (p.key.startsWith(OFFLOAD_PREFIX) || !p.remoteEtag)
         return null;
     return p;
 }
+/**
+ * Library copy in a company vault: content-addressed under
+ * `.hq-offload/blobs/<sha256>`, verified by that sha256 (no git blob, no ETag).
+ */
+export function isCompanyOffloadCopy(p) {
+    return (p.vault === "company" &&
+        p.sha256 !== null &&
+        p.gitBlob === undefined &&
+        p.key === companyOffloadKey(p.sha256));
+}
 /** sha256 and git blob id (sha1 of "blob <size>\0" + bytes) in one pass. */
 export async function digestFile(file) {
     const size = (await fs.promises.stat(file)).size;
@@ -1320,7 +1345,7 @@ async function downloadVerified(download, key, dest, expect) {
 /** Company slug for a company-vault placeholder, checked against its key. */
 export function companyForPointer(pointer) {
     const m = /^companies\/([^/]+)\/(.+)$/.exec(pointer.path);
-    if (!m || m[2] !== pointer.key) {
+    if (!m || (!isCompanyOffloadCopy(pointer) && m[2] !== pointer.key)) {
         throw new Error(`Placeholder for '${pointer.path}' names company vault key '${pointer.key}', which does not match its location. Nothing was changed.`);
     }
     return m[1];
@@ -1377,7 +1402,10 @@ async function fetchPlaceholder(arg, deps, opts) {
         throw new Error(`'${pointer.path}' already exists locally. Move it aside first.`);
     }
     let digest;
-    if (pointer.remoteEtag === undefined) {
+    if (isCompanyOffloadCopy(pointer)) {
+        digest = await fetchCompanyOffload(pointer, target, deps);
+    }
+    else if (pointer.remoteEtag === undefined) {
         // Offload copy in the personal vault, verified by git blob id and sha256.
         const store = await deps.openPersonal();
         digest = await downloadVerified((partial) => store.download(pointer.key, partial), pointer.key, target, {
@@ -1392,6 +1420,29 @@ async function fetchPlaceholder(arg, deps, opts) {
     await fs.promises.rm(placeholder, { force: true });
     return { path: pointer.path, bytes: digest.size, sha256: digest.sha256 };
 }
+/**
+ * Library copy (`hq library add`): download `.hq-offload/blobs/<sha256>` from
+ * the company vault and verify the bytes against that sha256. The object is
+ * content-addressed, so the current ETag is pinned only to keep one download
+ * consistent. Opened only for a company the caller is an active member of.
+ */
+async function fetchCompanyOffload(pointer, target, deps) {
+    if (!deps.openVaultObjects)
+        throw new Error("This HQ build cannot fetch files from a company library.");
+    const slug = companyForPointer(pointer);
+    const active = deps.activeCompanySlugs ? await deps.activeCompanySlugs() : [];
+    if (!active.includes(slug)) {
+        throw new Error(`You are not an active member of '${slug}', so HQ cannot download this file for you.`);
+    }
+    const store = await deps.openVaultObjects({ vault: "company", slug });
+    const head = await store.head(pointer.key);
+    if (!head)
+        throw new Error(`This file is no longer in the cloud (${pointer.key}).`);
+    return downloadVerified((partial) => store.download(pointer.key, partial, head.etag), pointer.key, target, {
+        sha256: pointer.sha256,
+        size: pointer.size,
+    });
+}
 /**
  * Placeholder that sync rewrote to a vault object: download pinned to the
  * recorded ETag and verify size (and sha256 when known). A company vault is

package/dist/commands/storage.d.ts

@@ -36,7 +36,7 @@
 import { Command } from "commander";
 import { type ReclaimReport } from "./storage-core.js";
 import { S3Client, ListObjectVersionsCommand, DeleteObjectsCommand, type ListObjectVersionsCommandOutput, type DeleteObjectsCommandOutput } from "@aws-sdk/client-s3";
-import { type OffloadResult, type OffloadStatus } from "./storage-offload.js";
+import { type OffloadDeps, type OffloadResult, type OffloadStatus } from "./storage-offload.js";
 export type TrancheId = "7d" | "30d" | "90d" | "365d" | "older";
 export declare const TRANCHES: readonly {
     id: TrancheId;
@@ -265,6 +265,11 @@ export declare const NEEDS_YES = "No terminal to confirm in. Re-run with --yes t
 export declare function confirmOnTty(message: string, input?: NodeJS.ReadableStream & {
     isTTY?: boolean;
 }, output?: NodeJS.WritableStream): Promise<boolean>;
+/**
+ * Deps for offload/fetch. The only store is the caller's personal vault,
+ * resolved from their canonical person entity and vended with `/sts/vend-self`.
+ */
+export declare function buildOffloadDeps(): Promise<OffloadDeps>;
 /**
  * An S3 client for one vault whose credentials are re-vended before they
  * expire, plus `revend`, which vends now and returns a client on the new
@@ -296,5 +301,7 @@ export declare function refreshingVendedCredentials(vend: () => Promise<VendedCr
     sessionToken: string;
     expiration?: Date;
 }>;
+/** Production deps. Exported for `hq billing usage`, which reads cloud status only. */
+export declare function buildStorageDeps(): Promise<StorageDeps>;
 export declare function registerStorageCommand(program: Command): Command;
 //# sourceMappingURL=storage.d.ts.map

package/dist/commands/storage.js

@@ -1003,7 +1003,7 @@ async function signedInVault() {
  * Deps for offload/fetch. The only store is the caller's personal vault,
  * resolved from their canonical person entity and vended with `/sts/vend-self`.
  */
-async function buildOffloadDeps() {
+export async function buildOffloadDeps() {
     const hqRoot = findHqRoot();
     const personalVault = async () => {
         const { vault } = await signedInVault();
@@ -1189,6 +1189,10 @@ export function refreshingVendedCredentials(vend, now = Date.now, marginMs = 5 *
         return pending;
     };
 }
+/** Production deps. Exported for `hq billing usage`, which reads cloud status only. */
+export async function buildStorageDeps() {
+    return buildDeps();
+}
 async function buildDeps() {
     // Sign-in is lazy so `status` can still report local sections when signed out,
     // and it is resolved again for every cloud call (never once at the start): the
@@ -1323,7 +1327,7 @@ export function registerStorageCommand(program) {
                 paths: Array.isArray(opts.current) ? opts.current : undefined,
                 dryRun: Boolean(opts.dryRun),
                 yes: Boolean(opts.yes),
-            }, await buildOffloadDeps());
+            }, { ...(await buildOffloadDeps()), log: (line) => (opts.json ? console.error(line) : console.log(line)) });
             if (!result)
                 return;
             console.log(opts.json ? JSON.stringify(result, null, 2) : formatOffload(result));

package/dist/commands/whoami.js

@@ -153,6 +153,15 @@ export function registerWhoamiCommand(program) {
                     authenticated: machine ? Boolean(machineCreds) : Boolean(cached && !isExpiring(cached, 0)),
                     tokenSource: machine ? 'machine' : 'person',
                     email: machine ? null : displayedIdentity.email ?? null,
+                    // Cognito subject of the person shown in `email` (null for machine
+                    // identities). Outpost jobs record owners by this id.
+                    sub: machine ? null : displayedIdentity.sub ?? null,
+                    // The human an Outpost session acts for, from the token's
+                    // delegated claims, for machine and person sources alike.
+                    delegatedEmail: identity.delegatedEmail !== undefined && identity.delegatedSub !== undefined
+                        ? identity.delegatedEmail : null,
+                    delegatedSub: identity.delegatedEmail !== undefined && identity.delegatedSub !== undefined
+                        ? identity.delegatedSub : null,
                     personUid: !machine && identity.entityType === 'person' ? identity.entityUid ?? null : null,
                     agentUid,
                     username: machineCreds?.username ?? null,