@indigoai-us/hq-cli 5.47.17 → 5.48.0

package/.github/workflows/ci.yml

@@ -5,29 +5,25 @@ on:
   push:
     branches: [main]
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   build:
-    runs-on: ubuntu-latest
+    name: build (node ${{ matrix.node-version }})
     strategy:
       fail-fast: false
       matrix:
         # 20 is the declared engines floor (package.json engines.node >=20),
-        # 22 is the current dev/publish baseline. Running the suite on 20
-        # enforces the floor so it stays real, not aspirational.
-        node-version: [20, 22]
-    name: build (node ${{ matrix.node-version }})
-    steps:
-      - uses: actions/checkout@v4
-      - uses: pnpm/action-setup@v4
-        with:
-          version: 10
-      - uses: actions/setup-node@v4
-        with:
-          node-version: ${{ matrix.node-version }}
-          cache: pnpm
-      - run: pnpm install --frozen-lockfile --config.minimumReleaseAge=1440
-      # generate-dsn.mjs only fatals when GITHUB_JOB=publish, so CI builds with
-      # an empty BUNDLED_DSN. That's intentional — the DSN is publish-only.
-      - run: pnpm run build
-      - run: pnpm run typecheck
-      - run: pnpm test
+        # 22 is the current dev/publish baseline.
+        node-version: ["20", "22"]
+    uses: indigoai-us/.github/.github/workflows/_node-ci.yml@main
+    with:
+      package-manager: pnpm
+      pnpm-version: "10"
+      node-version: ${{ matrix.node-version }}
+      run-build: true
+      run-lint: false
+      run-coverage: true
+    secrets: inherit

package/.github/workflows/publish.yml

@@ -2,110 +2,35 @@ name: Publish to npm
 on:
   push:
     tags: ["v*"]
+  # Manual dry-run: validate the build/pack/smoke pipeline without publishing.
+  workflow_dispatch:
+    inputs:
+      dry_run:
+        description: "Dry-run (validate build/pack/smoke; npm publish --dry-run, no Sentry upload)"
+        type: boolean
+        default: true
 
 jobs:
   publish:
-    runs-on: ubuntu-latest
     permissions:
       contents: read
       id-token: write
-    steps:
-      - uses: actions/checkout@v4
-      - uses: pnpm/action-setup@v4
-        with:
-          version: 10
-      - uses: actions/setup-node@v4
-        with:
-          # Node 24 ships npm 11.x, required for npm's trusted-publisher OIDC
-          # token-exchange flow. See hq-cloud's publish.yml for the full
-          # rationale (npm 10.x produces masked-404 failures on publish PUT).
-          node-version: 24
-          registry-url: https://registry.npmjs.org
-          cache: pnpm
-
-      - run: node --version && npm --version && pnpm --version
-      # Install with pnpm (supply-chain policy); npm publish keeps OIDC.
-      - run: pnpm install --frozen-lockfile --config.minimumReleaseAge=1440
-
-      - name: Build
-        run: pnpm run build
-        env:
-          # generate-dsn.mjs fatals when GITHUB_JOB=publish and this var is
-          # missing. Set this as a repo secret to bundle a Sentry DSN into the
-          # published binary.
-          HQ_CLI_PUBLISH_SENTRY_DSN: ${{ secrets.HQ_CLI_PUBLISH_SENTRY_DSN }}
-
-      # Inject Sentry debug IDs into compiled JS + map files. Must run after
-      # tsc and BEFORE publish so the installed binary carries the same debugId
-      # as the artifacts uploaded to Sentry, enabling debugId-based source-map
-      # resolution for globally-installed CLI users.
-      - name: Inject Sentry source map debug IDs
-        run: npx -y @sentry/cli@^2 sourcemaps inject dist/
-
-      # Pre-publish cross-package smoke test (Bug A guard).
-      #
-      # @indigoai-us/hq-cli depends on @indigoai-us/hq-cloud via a caret range
-      # (^5.1.0). The smoke installs a freshly-packed tarball into an isolated
-      # tmpdir — outside this repo — so transitive @indigoai-us/* deps resolve
-      # from the npm registry, NOT from a local checkout. Booting `hq --version`
-      # then exercises the full module-load graph. If hq-cloud removed or
-      # renamed a symbol hq-cli imports, this catches it BEFORE the publish PUT.
-      #
-      # Bypass: set repo-or-workflow variable WORKFLOW_ALLOW_BROKEN_PUBLISH=1.
-      - name: Pre-publish smoke test
-        if: ${{ vars.WORKFLOW_ALLOW_BROKEN_PUBLISH != '1' }}
-        run: bash .github/workflows/scripts/smoke-test-pkg.sh hq
-
-      - name: WARN — pre-publish smoke bypassed
-        if: ${{ vars.WORKFLOW_ALLOW_BROKEN_PUBLISH == '1' }}
-        run: |
-          echo "::warning::WORKFLOW_ALLOW_BROKEN_PUBLISH=1 — pre-publish cross-package smoke test was BYPASSED. This release may ship a DOA package."
-
-      # Trusted-publisher OIDC; no NODE_AUTH_TOKEN. No --provenance (private
-      # repo limitation since npm 2026-05-10). Pre-release versions (with '-')
-      # get --tag rc to keep latest dist-tag pointing at stable releases only.
-      - name: Publish to npm
-        id: publish
-        run: |
-          NAME=$(jq -r .name package.json)
-          VER=$(jq -r .version package.json)
-          if npm view "$NAME@$VER" version >/dev/null 2>&1; then
-            echo "$NAME@$VER already on npm — skipping"
-          else
-            if echo "$VER" | grep -q '-'; then
-              npm publish --access public --tag rc
-            else
-              npm publish --access public
-            fi
-            echo "published=true" >> "$GITHUB_OUTPUT"
-          fi
-
-      # Sentry sourcemap upload runs on every tag push regardless of whether
-      # this run was the one that actually published to npm. The previous
-      # `if: steps.publish.outputs.published == 'true'` gate made re-runs
-      # useless when only the Sentry upload failed — the publish step's
-      # short-circuit (`npm view @ver already published`) zeroed out the
-      # output, so the upload step was skipped on every re-run. dist/ is
-      # rebuilt by the Build + Inject steps each run, so the upload is
-      # always operating on fresh, debug-id-stamped artifacts.
-      - name: Upload sourcemaps to Sentry
-        run: |
-          # Defang paste-time whitespace in SENTRY_AUTH_TOKEN. Sentry's
-          # auth-header parser returns HTTP 401 "Token string should not
-          # contain spaces" when the secret has a trailing \n or any
-          # embedded whitespace — observed on the v5.25.0 release after a
-          # copy-paste into the GH repo secret carried a literal \n. `tr -d`
-          # is the cheap structural guard so the workflow doesn't blow up
-          # on the next dirty paste.
-          SENTRY_AUTH_TOKEN=$(printf %s "$SENTRY_AUTH_TOKEN" | tr -d '[:space:]')
-          if [ -z "$SENTRY_AUTH_TOKEN" ]; then
-            echo "::error::SENTRY_AUTH_TOKEN secret is empty (or all whitespace) after sanitization — cannot upload sourcemaps"
-            exit 1
-          fi
-          export SENTRY_AUTH_TOKEN
-          VER=$(jq -r .version package.json)
-          npx -y @sentry/cli@^2 sourcemaps upload --release "hq-cli@$VER" dist/ node_modules/@indigoai-us/hq-cloud/dist/
-        env:
-          SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
-          SENTRY_ORG: indigo-d0
-          SENTRY_PROJECT: hq-cli
+    uses: indigoai-us/.github/.github/workflows/_npm-publish.yml@main
+    with:
+      package-manager: pnpm
+      pnpm-version: "10"
+      node-version: "24"
+      build-command: "pnpm run build"
+      dsn-env-name: "HQ_CLI_PUBLISH_SENTRY_DSN"
+      sentry-inject-dir: "dist/"
+      smoke-test-arg: "hq"
+      sentry-release-prefix: "hq-cli"
+      sentry-upload-paths: "dist/ node_modules/@indigoai-us/hq-cloud/dist/"
+      sentry-org: "indigo-d0"
+      sentry-project: "hq-cli"
+      # Prerelease versions (e.g. 5.x.y-rc.0) ship to the rc dist-tag, not latest.
+      prerelease-dist-tag: "rc"
+      dry-run: ${{ github.event_name == 'workflow_dispatch' && inputs.dry_run }}
+    secrets:
+      sentry-dsn: ${{ secrets.HQ_CLI_PUBLISH_SENTRY_DSN }}
+      sentry-auth-token: ${{ secrets.SENTRY_AUTH_TOKEN }}

package/dist/commands/meetings.js

@@ -1,5 +1,5 @@
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="e1c09963-744f-5033-9981-1ab6d37956e9")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="f1986062-db39-5448-a8fa-3bb6be32c58b")}catch(e){}}();
 import chalk from "chalk";
 import { ensureCognitoToken } from "../utils/cognito-session.js";
 import { vaultApiFetch, getCompanyUid } from "../utils/vault-api.js";
@@ -207,6 +207,54 @@ export function registerMeetingsCommand(program) {
             process.exit(1);
         }
     });
+    // ── hq meetings set-company <id> ──────────────────────────────────
+    meetings
+        .command("set-company <meetingId>")
+        .description("Set or change the company a meeting is attributed to (use 'unknown' to clear)")
+        .option("--company <slug>", "Target company slug, or 'unknown'/'personal' to clear attribution")
+        .option("--no-series", "Apply only to this occurrence, not the whole recurring series")
+        .action(async (rawId, cmdOpts) => {
+        try {
+            const token = await ensureCognitoToken();
+            // `--company` is shared with the parent `meetings` command, so commander
+            // may bind it to either level depending on position — accept both.
+            const target = cmdOpts.company ?? meetings.opts().company;
+            if (!target) {
+                console.error(chalk.red("Error:"), "a target company is required: --company <slug> (or 'unknown'/'personal' to clear)");
+                process.exit(1);
+            }
+            // The bot record is person-keyed, so no company scope is needed to
+            // resolve the meeting id; pass an empty scope.
+            const meetingId = await resolveShortId(token, rawId, {});
+            const lc = target.toLowerCase();
+            const companyId = lc === "unknown" || lc === "personal"
+                ? "unknown"
+                : await getCompanyUid(token, target);
+            const applyToSeries = cmdOpts.series !== false;
+            const res = await vaultApiFetch({
+                token,
+                method: "POST",
+                path: `/v1/meetings/${encodeURIComponent(meetingId)}/company`,
+                body: { companyId, applyToSeries },
+            });
+            if (!res.ok)
+                await handleApiError(res);
+            const data = (await res.json());
+            if (meetings.opts().json) {
+                console.log(JSON.stringify(data, null, 2));
+                return;
+            }
+            const where = companyId === "unknown" ? "unattributed (personal)" : companyId;
+            console.log(chalk.green(`\n✓ Meeting ${chalk.cyan(meetingId)} attributed to ${chalk.bold(where)}.`));
+            if (data && data.appliedToSeries)
+                console.log(chalk.dim("  Future occurrences of this recurring series will inherit this attribution."));
+            console.log();
+        }
+        catch (err) {
+            console.error(chalk.red("Error:"), err instanceof Error ? err.message : String(err));
+            process.exit(1);
+        }
+    });
     // ── hq meetings search <query> ─────────────────────────────────────
     meetings
         .command("search <query>")
@@ -371,4 +419,4 @@ export function registerMeetingsCommand(program) {
     });
 }
 //# sourceMappingURL=meetings.js.map
-//# debugId=e1c09963-744f-5033-9981-1ab6d37956e9
+//# debugId=f1986062-db39-5448-a8fa-3bb6be32c58b

package/dist/sentry.js

@@ -1,16 +1,20 @@
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="508ac88d-5683-5d1f-9857-80a8a74e03e2")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="80ca2b2d-c649-5e88-9bc6-69a20fa4aa51")}catch(e){}}();
 import * as Sentry from "@sentry/node";
 import { BUNDLED_DSN } from "./sentry-dsn.generated.js";
 import { beforeSend } from "./sentry-before-send.js";
 import { beforeBreadcrumb } from "./utils/breadcrumb-buffer.js";
+import { CLI_VERSION } from "./cli-version.js";
 export function initSentry() {
     const dsn = BUNDLED_DSN || process.env.SENTRY_DSN;
     if (!dsn)
         return;
     Sentry.init({
         dsn,
-        release: `hq-cli@${process.env.npm_package_version ?? "0.0.0"}`,
+        // CLI_VERSION reads package.json at runtime; npm_package_version is only
+        // set under `npm run`, so an installed `hq` binary would always report
+        // 0.0.0 and never match the uploaded source maps.
+        release: `hq-cli@${CLI_VERSION}`,
         environment: process.env.HQ_CLI_ENV ?? "production",
         initialScope: {
             tags: { repo: "hq-cli" },
@@ -21,4 +25,4 @@ export function initSentry() {
 }
 export { Sentry };
 //# sourceMappingURL=sentry.js.map
-//# debugId=508ac88d-5683-5d1f-9857-80a8a74e03e2
+//# debugId=80ca2b2d-c649-5e88-9bc6-69a20fa4aa51

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.47.17",
+  "version": "5.48.0",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {
@@ -11,11 +11,12 @@
     "build": "node scripts/generate-dsn.mjs && tsc",
     "typecheck": "tsc --noEmit",
     "test": "vitest run",
+    "coverage": "vitest run --coverage --coverage.reporter=text-summary --coverage.reporter=json-summary",
     "vitest": "vitest",
     "clean": "rm -rf dist"
   },
   "dependencies": {
-    "@indigoai-us/hq-cloud": "^6.11.7",
+    "@indigoai-us/hq-cloud": "^6.11.14",
     "@indigoai-us/hq-onboarding": "^0.1.0",
     "@sentry/node": "^10.49.0",
     "chalk": "^5.3.0",
@@ -31,6 +32,7 @@
     "@types/js-yaml": "^4.0.9",
     "@types/node": "^22.0.0",
     "@types/semver": "^7.5.8",
+    "@vitest/coverage-v8": "4.1.6",
     "typescript": "^5.7.0",
     "vitest": "^4.1.2"
   },

package/src/commands/meetings.test.ts

@@ -0,0 +1,163 @@
+import { Command } from "commander";
+import {
+  afterEach,
+  beforeEach,
+  describe,
+  expect,
+  it,
+  vi,
+  type MockInstance,
+} from "vitest";
+
+vi.mock("../utils/cognito-session.js", async (importOriginal) => {
+  const original = (await importOriginal()) as Record<string, unknown>;
+  return {
+    ...original,
+    ensureCognitoToken: vi.fn(async () => "test-token"),
+  };
+});
+
+vi.mock("../utils/vault-api.js", async (importOriginal) => {
+  const original = (await importOriginal()) as Record<string, unknown>;
+  return {
+    ...original,
+    getCompanyUid: vi.fn(async (_token: string, slug: string) => `cmp_${slug}`),
+    vaultApiFetch: vi.fn(async () =>
+      new Response(JSON.stringify({ appliedToSeries: true }), {
+        status: 200,
+        headers: { "Content-Type": "application/json" },
+      }),
+    ),
+  };
+});
+
+import { registerMeetingsCommand } from "./meetings.js";
+import { getCompanyUid, vaultApiFetch } from "../utils/vault-api.js";
+
+let logSpy: MockInstance<typeof console.log>;
+let errSpy: MockInstance<typeof console.error>;
+
+beforeEach(() => {
+  vi.clearAllMocks();
+  logSpy = vi.spyOn(console, "log").mockImplementation(() => undefined);
+  errSpy = vi.spyOn(console, "error").mockImplementation(() => undefined);
+});
+
+afterEach(() => {
+  vi.restoreAllMocks();
+});
+
+function buildProgram(): Command {
+  const program = new Command();
+  program.exitOverride();
+  program.configureOutput({
+    writeOut: () => undefined,
+    writeErr: () => undefined,
+  });
+  registerMeetingsCommand(program);
+  return program;
+}
+
+function jsonRes(body: unknown, status = 200): Response {
+  return new Response(JSON.stringify(body), {
+    status,
+    headers: { "Content-Type": "application/json" },
+  });
+}
+
+describe("meetings set-company", () => {
+  it("POSTs the resolved company id and applies to the recurring series by default", async () => {
+    vi.mocked(vaultApiFetch).mockResolvedValueOnce(
+      jsonRes({ appliedToSeries: true }),
+    );
+
+    const program = buildProgram();
+    await program.parseAsync([
+      "node",
+      "hq",
+      "meetings",
+      "set-company",
+      "meeting-123456",
+      "--company",
+      "acme",
+    ]);
+
+    expect(getCompanyUid).toHaveBeenCalledWith("test-token", "acme");
+    expect(vaultApiFetch).toHaveBeenCalledWith({
+      token: "test-token",
+      method: "POST",
+      path: "/v1/meetings/meeting-123456/company",
+      body: { companyId: "cmp_acme", applyToSeries: true },
+    });
+    expect(errSpy).not.toHaveBeenCalled();
+  });
+
+  it("sends unknown without resolving a target company", async () => {
+    vi.mocked(vaultApiFetch).mockResolvedValueOnce(
+      jsonRes({ appliedToSeries: true }),
+    );
+
+    const program = buildProgram();
+    await program.parseAsync([
+      "node",
+      "hq",
+      "meetings",
+      "set-company",
+      "meeting-123456",
+      "--company",
+      "unknown",
+    ]);
+
+    expect(getCompanyUid).not.toHaveBeenCalled();
+    expect(vaultApiFetch).toHaveBeenCalledWith({
+      token: "test-token",
+      method: "POST",
+      path: "/v1/meetings/meeting-123456/company",
+      body: { companyId: "unknown", applyToSeries: true },
+    });
+  });
+
+  it("sends applyToSeries false when --no-series is passed", async () => {
+    vi.mocked(vaultApiFetch).mockResolvedValueOnce(
+      jsonRes({ appliedToSeries: false }),
+    );
+
+    const program = buildProgram();
+    await program.parseAsync([
+      "node",
+      "hq",
+      "meetings",
+      "set-company",
+      "meeting-123456",
+      "--company",
+      "acme",
+      "--no-series",
+    ]);
+
+    expect(vaultApiFetch).toHaveBeenCalledWith({
+      token: "test-token",
+      method: "POST",
+      path: "/v1/meetings/meeting-123456/company",
+      body: { companyId: "cmp_acme", applyToSeries: false },
+    });
+  });
+
+  it("prints the raw response when --json is passed", async () => {
+    const body = { meetingId: "meeting-123456", companyId: "cmp_acme" };
+    vi.mocked(vaultApiFetch).mockResolvedValueOnce(jsonRes(body));
+
+    const program = buildProgram();
+    await program.parseAsync([
+      "node",
+      "hq",
+      "meetings",
+      "--json",
+      "set-company",
+      "meeting-123456",
+      "--company",
+      "acme",
+    ]);
+
+    expect(logSpy).toHaveBeenCalledWith(JSON.stringify(body, null, 2));
+  });
+});

package/src/commands/meetings.ts

@@ -299,6 +299,66 @@ export function registerMeetingsCommand(program: Command): void {
       }
     });
 
+  // ── hq meetings set-company <id> ──────────────────────────────────
+
+  meetings
+    .command("set-company <meetingId>")
+    .description("Set or change the company a meeting is attributed to (use 'unknown' to clear)")
+    .option("--company <slug>", "Target company slug, or 'unknown'/'personal' to clear attribution")
+    .option("--no-series", "Apply only to this occurrence, not the whole recurring series")
+    .action(async (rawId: string, cmdOpts: { company?: string; series?: boolean }) => {
+      try {
+        const token = await ensureCognitoToken();
+        // `--company` is shared with the parent `meetings` command, so commander
+        // may bind it to either level depending on position — accept both.
+        const target = cmdOpts.company ?? (meetings.opts().company as string | undefined);
+        if (!target) {
+          console.error(
+            chalk.red("Error:"),
+            "a target company is required: --company <slug> (or 'unknown'/'personal' to clear)",
+          );
+          process.exit(1);
+        }
+
+        // The bot record is person-keyed, so no company scope is needed to
+        // resolve the meeting id; pass an empty scope.
+        const meetingId = await resolveShortId(token, rawId, {});
+
+        const lc = target.toLowerCase();
+        const companyId =
+          lc === "unknown" || lc === "personal"
+            ? "unknown"
+            : await getCompanyUid(token, target);
+
+        const applyToSeries = cmdOpts.series !== false;
+
+        const res = await vaultApiFetch({
+          token,
+          method: "POST",
+          path: `/v1/meetings/${encodeURIComponent(meetingId)}/company`,
+          body: { companyId, applyToSeries },
+        });
+        if (!res.ok) await handleApiError(res);
+        const data = (await res.json()) as {
+          appliedToSeries?: boolean;
+          [key: string]: unknown;
+        };
+
+        if (meetings.opts().json) {
+          console.log(JSON.stringify(data, null, 2));
+          return;
+        }
+
+        const where = companyId === "unknown" ? "unattributed (personal)" : companyId;
+        console.log(chalk.green(`\n✓ Meeting ${chalk.cyan(meetingId)} attributed to ${chalk.bold(where)}.`));
+        if (data && data.appliedToSeries) console.log(chalk.dim("  Future occurrences of this recurring series will inherit this attribution."));
+        console.log();
+      } catch (err) {
+        console.error(chalk.red("Error:"), err instanceof Error ? err.message : String(err));
+        process.exit(1);
+      }
+    });
+
   // ── hq meetings search <query> ─────────────────────────────────────
 
   meetings

package/src/sentry.ts

@@ -2,13 +2,17 @@ import * as Sentry from "@sentry/node";
 import { BUNDLED_DSN } from "./sentry-dsn.generated.js";
 import { beforeSend } from "./sentry-before-send.js";
 import { beforeBreadcrumb } from "./utils/breadcrumb-buffer.js";
+import { CLI_VERSION } from "./cli-version.js";
 
 export function initSentry(): void {
   const dsn = BUNDLED_DSN || process.env.SENTRY_DSN;
   if (!dsn) return;
   Sentry.init({
     dsn,
-    release: `hq-cli@${process.env.npm_package_version ?? "0.0.0"}`,
+    // CLI_VERSION reads package.json at runtime; npm_package_version is only
+    // set under `npm run`, so an installed `hq` binary would always report
+    // 0.0.0 and never match the uploaded source maps.
+    release: `hq-cli@${CLI_VERSION}`,
     environment: process.env.HQ_CLI_ENV ?? "production",
     initialScope: {
       tags: { repo: "hq-cli" },

package/test/helpers/vault-service-mock.ts

@@ -126,11 +126,15 @@ export function mockVaultService(opts: MockVaultOptions): () => void {
     // 404s, which the reader normalizes to NoSuchKey (the not-found path).
     if (method === "POST" && /\/v1\/files\/presign$/.test(url)) {
       const body = init?.body ? JSON.parse(init.body.toString()) : {};
-      const keys = (body.keys ?? []) as Array<{ key: string }>;
+      const keys = (body.keys ?? []) as Array<{ key: string; op?: string }>;
+      // Echo the requested op and omit `error` on success. hq-cloud >=6.11.x
+      // validates each presign result with a strict schema (op ∈ get|put|delete;
+      // error must be a string when present), so the older `error: null` +
+      // missing-op shape no longer passes.
       const results = keys.map((k) => ({
         key: k.key,
+        op: k.op ?? "get",
         url: `${PRESIGN_URL_HOST}/obj?key=${encodeURIComponent(k.key)}`,
-        error: null,
       }));
       return json({
         results,