@indigoai-us/hq-cli 5.345.154 → 5.345.156

package/dist/commands/library-link.js

@@ -6,7 +6,8 @@
  * Runs on a Cognito session or on an `HQ_API_KEY` with `files:read` (the
  * library-agent preset). Under a key, vaultApiFetch rewrites /v1/files/presign
  * to /v1/keys/files/presign; the key is company-bound, so the company comes
- * from --company <cmp_uid>, HQ_COMPANY_UID, or the key's own membership.
+ * from --company (a cmp_ uid, or a slug mapped through companies/manifest.yaml),
+ * HQ_COMPANY_UID, or the placeholder's companies/<slug>/ via the manifest.
  *
  * Wire contract (hq-pro files-presign):
  *   POST /v1/files/presign
@@ -44,6 +45,7 @@ export async function runLibraryLink(target, options, deps) {
     let key;
     let placeholderPath;
     let companyRef = options.company;
+    let placeholderSlug;
     if (isVaultKey(target)) {
         key = target;
     }
@@ -63,14 +65,18 @@ export async function runLibraryLink(target, options, deps) {
         }
         key = placeholder.key;
         // On a session the placeholder's companies/<slug>/ names the company. A
-        // key is company-bound and cannot resolve slugs, so it uses its own.
+        // key is company-bound: its resolver prefers HQ_COMPANY_UID and gets the
+        // slug only as a fallback.
+        placeholderSlug = /^companies\/([^/]+)\//.exec(placeholderPath)?.[1];
         if (companyRef === undefined && !deps.apiKey) {
-            companyRef = /^companies\/([^/]+)\//.exec(placeholderPath)?.[1];
+            companyRef = placeholderSlug;
             if (!companyRef)
                 throw new Error(`'${placeholderPath}' is not inside companies/<slug>/; pass --company.`);
         }
     }
-    const company = await deps.resolveCompany(companyRef);
+    const company = deps.apiKey && placeholderSlug !== undefined
+        ? await deps.resolveCompany(companyRef, placeholderSlug)
+        : await deps.resolveCompany(companyRef);
     const res = await deps.presign({ company, key, op: "get", expiresIn });
     const body = (await res.json().catch(() => ({})));
     if (!res.ok) {

package/dist/commands/library-remove.d.ts

@@ -0,0 +1,122 @@
+import { Command } from "commander";
+export interface LibraryRemoveOptions {
+    /** Company slug (or cmp_ uid); every target must be in this company. */
+    company?: string;
+    purge?: boolean;
+    dryRun?: boolean;
+    yes?: boolean;
+}
+/** Server reply for POST /v1/files/delete (the fields rm reads). */
+export interface VaultDeleteReply {
+    matched: number;
+    deleted: number;
+}
+export interface LibraryRemoveDeps {
+    hqRoot: string;
+    /** Company slug → cmp_ uid. */
+    resolveCompany: (slug: string) => Promise<string>;
+    /**
+     * POST /v1/files/delete for one exact key. Throws an Error whose message is
+     * ready to show (permission and auth errors included).
+     */
+    deleteKey: (companyUid: string, key: string, dryRun: boolean) => Promise<VaultDeleteReply>;
+    /** POST /v1/search. Only called for `--purge`. */
+    searchAssets: (body: Record<string, unknown>) => Promise<Response>;
+    /** Every key in the company vault (company-relative). Only called for `--purge`. */
+    listVaultKeys: (companyUid: string) => Promise<string[]>;
+    /** Text of small vault objects; null for one that cannot be read. Only called for `--purge`. */
+    readVaultObjects: (companyUid: string, keys: readonly string[]) => Promise<Map<string, string | null>>;
+    /** Ask a yes/no question. Only called without --yes and --dry-run. */
+    confirm: (message: string) => Promise<boolean>;
+    /** Preview and progress lines. */
+    log: (line: string) => void;
+    /** sha256 of a local file. */
+    hashFile?: (file: string) => Promise<string>;
+    /** Delete one local file. */
+    removeFile?: (file: string) => Promise<void>;
+}
+export type StepState = "removed" | "would-remove" | "absent" | "kept" | "failed" | "not-run";
+export interface LibraryRemoveItem {
+    /** HQ-relative placeholder path. */
+    placeholderPath: string;
+    /** HQ-relative original path (the file the placeholder stands in for). */
+    originalPath: string;
+    /** Company-relative vault key of the synced placeholder. */
+    vaultKey: string;
+    /** The blob the placeholder points at. */
+    blobKey: string;
+    original: StepState;
+    placeholder: StepState;
+    vault: StepState;
+    error?: string;
+}
+export interface LibraryRemoveBlob {
+    key: string;
+    state: StepState;
+    error?: string;
+}
+export interface LibraryRemoveResult {
+    company: string;
+    companyUid: string;
+    dryRun: boolean;
+    purge: boolean;
+    /** False when the confirmation was declined. */
+    confirmed: boolean;
+    items: LibraryRemoveItem[];
+    blobs: LibraryRemoveBlob[];
+    /** Commands that undo the vault side. */
+    undo: string[];
+}
+/** Local company placeholders, other than `exclude`, that point at `blobKey`. */
+export declare function localBlobReferences(hqRoot: string, slug: string, blobKey: string, exclude: ReadonlySet<string>): string[];
+/**
+ * Placeholders in the company vault, other than `exclude` (company-relative
+ * keys), that point at any of `blobKeys`. Returns blob key → placeholder keys.
+ *
+ * Two passes:
+ *   1. a quick asset search (`kind: "asset"`, query "hqcloud", which every
+ *      placeholder path carries). Each hit returns its vaultKey, so a shared
+ *      blob is usually found in one call. This pass cannot prove a blob is
+ *      unused: hq-pro does not index the hashes and keys in a placeholder,
+ *      caps a search at 50 hits with no paging, and may lag a fresh upload.
+ *      Its errors are ignored; pass 2 decides.
+ *   2. when pass 1 finds nothing, every `.hqcloud` key the caller can list
+ *      (GET /v1/files/list, as `hq files search` does), read in one batched
+ *      presign and parsed. This lists the whole company vault, so it can take
+ *      minutes on a large one. Any listing or read failure throws: a purge
+ *      must not go ahead on a guess.
+ */
+export declare function cloudBlobReferences(blobKeys: readonly string[], slug: string, companyUid: string, exclude: ReadonlySet<string>, deps: Pick<LibraryRemoveDeps, "searchAssets" | "listVaultKeys" | "readVaultObjects" | "log">): Promise<Map<string, string[]>>;
+/** GET /v1/files/list for every key in the company vault, following the cursor. */
+export declare function listAllVaultKeys(companyUid: string, list: (query: Record<string, string>) => Promise<Response>): Promise<string[]>;
+/**
+ * Read small vault objects: one batched presign (op "get") per 1000 keys, then
+ * a GET per URL. A key that cannot be presigned or read maps to null. Errors
+ * never include a URL, which carries a signature.
+ */
+export declare function readSmallVaultObjects(companyUid: string, keys: readonly string[], presign: (body: Record<string, unknown>) => Promise<Response>, get?: (url: string) => Promise<Response>): Promise<Map<string, string | null>>;
+/**
+ * Testable core. Checks every target, previews, confirms, then removes in the
+ * order described at the top of this file.
+ */
+export declare function runLibraryRemove(targets: readonly string[], options: LibraryRemoveOptions, deps: LibraryRemoveDeps): Promise<LibraryRemoveResult>;
+export declare function formatLibraryRemoveResult(result: LibraryRemoveResult): string;
+/**
+ * User-facing message for a failed POST /v1/files/delete. `err` is duck-typed
+ * on `status` (files.ts's FilesDeleteHttpError) so this module does not load
+ * files.ts at startup.
+ */
+export declare function vaultDeleteErrorMessage(err: unknown, key: string, apiKey: boolean, format: (err: never, key: string) => string): string;
+/**
+ * Company resolver for rm. A session resolves slugs through the API. An
+ * HQ_API_KEY cannot (hq-pro serves no keyed membership lookup), so it maps the
+ * placeholder folder's slug, or an explicit `--company` slug or uid, through
+ * companies/manifest.yaml with library.ts's libraryCompanyForApiKey; hq-pro
+ * still checks the uid against the key on every delete.
+ */
+export declare function removeCompanyResolver(credential: {
+    kind: "api-key" | "cognito";
+    token: string;
+}, hqRoot: string, explicit: string | undefined): Promise<(slug: string) => Promise<string>>;
+export declare function registerLibraryRemoveCommand(library: Command): void;
+//# sourceMappingURL=library-remove.d.ts.map