@indigoai-us/hq-cli 5.47.6 → 5.47.8

package/dist/commands/files-browse.d.ts

@@ -98,6 +98,15 @@ export type S3ClientFactory = (input: {
         sessionToken: string;
     };
 }) => FilesBrowseS3Client;
+/**
+ * Factory for the COMPANY-mode browse client. Injectable for tests; the
+ * production implementation is `createCompanyPresignClient`. Keyed by
+ * `companyUid` (resolved by the orchestrator) — the access token is captured
+ * by the closure at the CLI layer.
+ */
+export type CompanyBrowseClientFactory = (input: {
+    companyUid: string;
+}) => FilesBrowseS3Client;
 /**
  * ACL provenance for a single listed key.
  *   - `shared-with-you`: an explicit grant the caller holds covers the key.
@@ -190,12 +199,23 @@ export interface RunBrowseInput {
      */
     personalUid?: string;
     vaultClient: FilesBrowseVaultClient;
-    s3Factory: S3ClientFactory;
+    /** PERSONAL mode: builds a direct-S3 client from vended creds. */
+    s3Factory?: S3ClientFactory;
+    /**
+     * COMPANY mode (HQ-59): builds the presign/list-backed client. Company
+     * browse no longer talks to S3 directly and does not vend STS creds.
+     */
+    companyClient?: CompanyBrowseClientFactory;
     region: string;
 }
 export interface RunBrowseResult {
     rows: BrowseRow[];
-    vend: BrowseVendResult;
+    /**
+     * Present ONLY for the PERSONAL (vendSelf + direct S3) path. Company mode
+     * goes through the presign/list API and does not vend, so this is undefined
+     * there.
+     */
+    vend?: BrowseVendResult;
 }
 /**
  * `hq files browse <path>` orchestrator.
@@ -230,7 +250,10 @@ export interface RunCatInput {
     /** Canonical person-entity UID; required when `personalMode: true`. */
     personalUid?: string;
     vaultClient: FilesBrowseVaultClient;
-    s3Factory: S3ClientFactory;
+    /** PERSONAL mode: builds a direct-S3 client from vended creds. */
+    s3Factory?: S3ClientFactory;
+    /** COMPANY mode (HQ-59): builds the presign/list-backed client. */
+    companyClient?: CompanyBrowseClientFactory;
     region: string;
     /** Destination stream for the stdout path. Injectable for tests. */
     stdout?: NodeJS.WritableStream;
@@ -243,7 +266,8 @@ export interface RunCatResult {
         kind: "file";
         absPath: string;
     };
-    vend: BrowseVendResult;
+    /** Present ONLY for the PERSONAL (vendSelf + direct S3) path. */
+    vend?: BrowseVendResult;
 }
 /**
  * `hq files cat <path>` orchestrator. Vends with `purpose: 'browse'`, then
@@ -308,7 +332,10 @@ export interface RunSearchInput {
     personalMode?: boolean;
     personalUid?: string;
     vaultClient: FilesBrowseVaultClient;
-    s3Factory: S3ClientFactory;
+    /** PERSONAL mode: direct-S3 client factory. */
+    s3Factory?: S3ClientFactory;
+    /** COMPANY mode (HQ-59): presign/list client factory. */
+    companyClient?: CompanyBrowseClientFactory;
     region: string;
 }
 /**
@@ -348,7 +375,11 @@ export interface RunGetInput {
     hqRoot: string;
     companySlug?: string;
     vaultClient: FilesBrowseVaultClient;
-    s3Factory: S3ClientFactory;
+    /**
+     * COMPANY mode (HQ-59): presign/list client factory. `get` is company-only,
+     * so it always goes through the API — no direct S3, no STS vend.
+     */
+    companyClient?: CompanyBrowseClientFactory;
     region: string;
 }
 export interface RunGetResult {
@@ -372,6 +403,15 @@ export interface RunGetResult {
  * HQ root itself, which is too broad to do implicitly.
  */
 export declare function runGet(input: RunGetInput): Promise<RunGetResult>;
+/**
+ * Build a COMPANY-mode browse client backed by the list + presign API. The
+ * access token + companyUid are captured here; the orchestrator just calls
+ * `send(...)` as if it held an S3 client.
+ */
+export declare function createCompanyPresignClient(input: {
+    token: string;
+    companyUid: string;
+}): FilesBrowseS3Client;
 /**
  * Wire `hq files browse` + `hq files cat` onto an existing `files`
  * Commander group. `registerFilesCommand` in files.ts builds the group

package/dist/commands/files-browse.js

@@ -34,15 +34,16 @@
  * methods and `grantPathToPrefix` from hq-cloud.
  */
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="cad165f9-6445-5434-969b-e0705274aa56")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="76062756-52c6-58a0-a647-9fcc95550911")}catch(e){}}();
 import chalk from "chalk";
 import * as fs from "node:fs";
 import * as path from "node:path";
+import { Readable } from "node:stream";
 import { pipeline } from "node:stream/promises";
 import { S3Client, ListObjectsV2Command, GetObjectCommand, } from "@aws-sdk/client-s3";
 import { VaultClient, grantPathToPrefix, } from "@indigoai-us/hq-cloud";
 import { DEFAULT_HQ_ROOT, DEFAULT_COGNITO, ensureCognitoToken, buildVaultConfig, } from "../utils/cognito-session.js";
-import { getCompanyUid } from "../utils/vault-api.js";
+import { getCompanyUid, vaultApiFetch } from "../utils/vault-api.js";
 import { resolveCanonicalPersonUid } from "./cloud.js";
 // ── Pure helpers ────────────────────────────────────────────────────────────
 /**
@@ -142,6 +143,20 @@ export function formatBrowseTable(rows) {
     ];
     return lines.join("\n");
 }
+/** Guard: the personal path needs an S3 factory. */
+function requirePersonalS3Factory(f) {
+    if (!f) {
+        throw new Error("Personal-vault browse requires an s3Factory (direct-S3 client).");
+    }
+    return f;
+}
+/** Guard: the company path needs the presign/list client factory. */
+function requireCompanyClient(f) {
+    if (!f) {
+        throw new Error("Company browse requires a companyClient (presign/list client).");
+    }
+    return f;
+}
 /**
  * `hq files browse <path>` orchestrator.
  *
@@ -156,7 +171,7 @@ export function formatBrowseTable(rows) {
  * Pure-ish: no console output, no process.exit — caller renders + exits.
  */
 export async function runBrowse(input) {
-    const { pathPrefix, vaultClient, s3Factory, region, personalMode } = input;
+    const { pathPrefix, vaultClient, region, personalMode } = input;
     // Branch by mode. Company mode parses slug from path and looks up by
     // namespace; personal mode resolves the entity directly by the supplied
     // person UID and skips the slug + grants machinery (a person bucket has
@@ -165,6 +180,7 @@ export async function runBrowse(input) {
     let entityUid;
     let slug;
     let vend;
+    let s3;
     if (personalMode) {
         if (!input.personalUid) {
             throw new Error("runBrowse: personalMode requires personalUid. Resolve via " +
@@ -176,7 +192,17 @@ export async function runBrowse(input) {
         }
         entityUid = entity.uid;
         bucket = entity.bucketName;
+        // Personal vault keeps the direct-S3 path: vend self creds, build an S3
+        // client. (HQ-59 scopes the migration to COMPANY mode.)
         vend = await vaultClient.sts.vendSelf({ personUid: entityUid });
+        s3 = requirePersonalS3Factory(input.s3Factory)({
+            region,
+            credentials: {
+                accessKeyId: vend.credentials.accessKeyId,
+                secretAccessKey: vend.credentials.secretAccessKey,
+                sessionToken: vend.credentials.sessionToken,
+            },
+        });
     }
     else {
         slug = input.companySlug ?? parseCompanySlugFromPath(pathPrefix);
@@ -189,19 +215,10 @@ export async function runBrowse(input) {
         }
         entityUid = entity.uid;
         bucket = entity.bucketName;
-        // Multi-tenant vend: the server resolves this company's bucket + applies
-        // owner/admin role-bypass (full access) or member/guest ACL scoping. The
-        // legacy `POST /vend` is unused here — see FilesBrowseVaultClient docs.
-        vend = await vaultClient.sts.vend({ companyUid: entityUid });
+        // COMPANY mode (HQ-59): list/get go through the presign/list API, which
+        // enforces the same per-file ACLs server-side. No STS vend, no direct S3.
+        s3 = requireCompanyClient(input.companyClient)({ companyUid: entityUid });
     }
-    const s3 = s3Factory({
-        region,
-        credentials: {
-            accessKeyId: vend.credentials.accessKeyId,
-            secretAccessKey: vend.credentials.secretAccessKey,
-            sessionToken: vend.credentials.sessionToken,
-        },
-    });
     // Company vault keys are company-relative (no `companies/<slug>/` prefix), so
     // translate the CLI's anchored prefix into the bucket-relative form before
     // listing. Personal-mode paths are already bucket-relative.
@@ -253,7 +270,7 @@ export async function runBrowse(input) {
  * containment guard). Refuses ahead of any I/O when `--out` is unsafe.
  */
 export async function runCat(input) {
-    const { key, vaultClient, s3Factory, region, hqRoot, personalMode } = input;
+    const { key, vaultClient, region, hqRoot, personalMode } = input;
     // Acceptance 5: refuse BEFORE vending — no point pulling credentials
     // for a request we're already going to abort.
     let absOut;
@@ -265,6 +282,7 @@ export async function runCat(input) {
     let bucket;
     let s3Key;
     let vend;
+    let s3;
     if (personalMode) {
         if (!input.personalUid) {
             throw new Error("runCat: personalMode requires personalUid. Resolve via " +
@@ -277,6 +295,14 @@ export async function runCat(input) {
         bucket = entity.bucketName;
         s3Key = key; // personal-mode keys are already bucket-relative
         vend = await vaultClient.sts.vendSelf({ personUid: entity.uid });
+        s3 = requirePersonalS3Factory(input.s3Factory)({
+            region,
+            credentials: {
+                accessKeyId: vend.credentials.accessKeyId,
+                secretAccessKey: vend.credentials.secretAccessKey,
+                sessionToken: vend.credentials.sessionToken,
+            },
+        });
     }
     else {
         const slug = input.companySlug ?? parseCompanySlugFromPath(key);
@@ -290,16 +316,9 @@ export async function runCat(input) {
         bucket = entity.bucketName;
         // Translate the anchored CLI key into the company-relative bucket key.
         s3Key = toBucketRelative(key, slug);
-        vend = await vaultClient.sts.vend({ companyUid: entity.uid });
+        // COMPANY mode (HQ-59): GetObject → presign GET. No STS vend, no direct S3.
+        s3 = requireCompanyClient(input.companyClient)({ companyUid: entity.uid });
     }
-    const s3 = s3Factory({
-        region,
-        credentials: {
-            accessKeyId: vend.credentials.accessKeyId,
-            secretAccessKey: vend.credentials.secretAccessKey,
-            sessionToken: vend.credentials.sessionToken,
-        },
-    });
     const resp = (await s3.send(new GetObjectCommand({ Bucket: bucket, Key: s3Key })));
     if (!resp.Body) {
         throw new Error(`GetObject for '${key}' returned no body.`);
@@ -417,6 +436,7 @@ export async function runSearch(input) {
         personalUid: input.personalUid,
         vaultClient: input.vaultClient,
         s3Factory: input.s3Factory,
+        companyClient: input.companyClient,
         region: input.region,
     });
     const q = input.query.toLowerCase();
@@ -467,7 +487,7 @@ export function addPin(hqRoot, companySlug, prefix) {
  * HQ root itself, which is too broad to do implicitly.
  */
 export async function runGet(input) {
-    const { path: vaultPath, vaultClient, s3Factory, region, hqRoot } = input;
+    const { path: vaultPath, vaultClient, hqRoot } = input;
     const slug = input.companySlug ?? parseCompanySlugFromPath(vaultPath);
     const entity = await vaultClient.entity.findInMyNamespace("company", slug);
     if (!entity) {
@@ -477,15 +497,9 @@ export async function runGet(input) {
         throw new Error(`Company '${slug}' (${entity.uid}) has no provisioned bucket.`);
     }
     const bucket = entity.bucketName;
-    const vend = await vaultClient.sts.vend({ companyUid: entity.uid });
-    const s3 = s3Factory({
-        region,
-        credentials: {
-            accessKeyId: vend.credentials.accessKeyId,
-            secretAccessKey: vend.credentials.secretAccessKey,
-            sessionToken: vend.credentials.sessionToken,
-        },
-    });
+    // COMPANY mode (HQ-59): list + get through the presign/list API. No STS vend,
+    // no direct S3 — the server enforces the same per-file read ACLs.
+    const s3 = requireCompanyClient(input.companyClient)({ companyUid: entity.uid });
     // Company-relative prefix to list/fetch (bucket keys carry no anchor).
     const bucketPrefix = toBucketRelative(vaultPath, slug);
     const keys = [];
@@ -544,6 +558,86 @@ export async function runGet(input) {
 }
 // ── CLI registration ────────────────────────────────────────────────────────
 const defaultS3Factory = ({ region, credentials }) => new S3Client({ region, credentials });
+/**
+ * Build a COMPANY-mode browse client backed by the list + presign API. The
+ * access token + companyUid are captured here; the orchestrator just calls
+ * `send(...)` as if it held an S3 client.
+ */
+export function createCompanyPresignClient(input) {
+    const { token, companyUid } = input;
+    async function listObjects(cmd) {
+        const prefix = cmd.input.Prefix ?? "";
+        const query = { company: companyUid };
+        if (prefix.length > 0)
+            query.prefix = prefix;
+        if (cmd.input.ContinuationToken)
+            query.cursor = cmd.input.ContinuationToken;
+        const res = await vaultApiFetch({ token, path: "/v1/files/list", query });
+        if (!res.ok) {
+            const body = (await res.json().catch(() => ({})));
+            throw new Error(body.message ?? body.error ?? `files list failed (${res.status})`);
+        }
+        const body = (await res.json());
+        return {
+            // Map the API's company-relative objects onto the ListObjectsV2 shape the
+            // orchestrators read (Key / Size / LastModified / ETag). Re-quote the
+            // etag to match S3's quoted form, in case any caller compares it.
+            Contents: (body.objects ?? []).map((o) => ({
+                Key: o.key,
+                Size: o.size,
+                LastModified: o.lastModified ? new Date(o.lastModified) : undefined,
+                ETag: o.etag != null ? `"${o.etag}"` : undefined,
+            })),
+            NextContinuationToken: body.cursor ?? undefined,
+            IsTruncated: Boolean(body.truncated),
+            // $metadata is required by the SDK output type; the orchestrators never
+            // read it, so a minimal stub is sufficient.
+            $metadata: {},
+        };
+    }
+    async function getObject(cmd) {
+        const key = cmd.input.Key;
+        const res = await vaultApiFetch({
+            token,
+            path: "/v1/files/presign",
+            method: "POST",
+            body: { company: companyUid, key, op: "get" },
+        });
+        if (!res.ok) {
+            const body = (await res.json().catch(() => ({})));
+            throw new Error(body.message ?? body.error ?? `presign failed (${res.status})`);
+        }
+        const body = (await res.json());
+        const first = body.results?.[0];
+        if (!first || !first.url) {
+            // Per-key denial/validation surfaces here (e.g. FILES_PRESIGN_FORBIDDEN).
+            throw new Error(first?.error ?? `No presigned URL returned for '${key}'`);
+        }
+        const dl = await fetch(first.url);
+        if (!dl.ok) {
+            throw new Error(`Failed to download '${key}' (HTTP ${dl.status})`);
+        }
+        // fetch() yields a web ReadableStream; the orchestrators consume Body as a
+        // Node Readable (body.on('data') + stream pipeline), so adapt it. An empty
+        // body (no stream) becomes an empty Readable.
+        const nodeBody = dl.body
+            ? Readable.fromWeb(dl.body)
+            : Readable.from([]);
+        return { Body: nodeBody, $metadata: {} };
+    }
+    function send(cmd) {
+        if (cmd instanceof ListObjectsV2Command)
+            return listObjects(cmd);
+        if (cmd instanceof GetObjectCommand)
+            return getObject(cmd);
+        throw new Error("createCompanyPresignClient: unsupported S3 command");
+    }
+    return { send };
+}
+/** Production company-mode client factory — closes over the caller's token. */
+function makeCompanyPresignFactory(token) {
+    return ({ companyUid }) => createCompanyPresignClient({ token, companyUid });
+}
 /**
  * Wire `hq files browse` + `hq files cat` onto an existing `files`
  * Commander group. `registerFilesCommand` in files.ts builds the group
@@ -622,7 +716,7 @@ export function registerFilesBrowseCommands(filesCmd) {
                 pathPrefix: pathArg,
                 companySlug: slug,
                 vaultClient: client,
-                s3Factory: defaultS3Factory,
+                companyClient: makeCompanyPresignFactory(accessToken),
                 region: DEFAULT_COGNITO.region,
             });
             console.log(formatBrowseTable(result.rows));
@@ -699,7 +793,7 @@ export function registerFilesBrowseCommands(filesCmd) {
                 hqRoot: options.hqRoot,
                 companySlug: slug,
                 vaultClient: client,
-                s3Factory: defaultS3Factory,
+                companyClient: makeCompanyPresignFactory(accessToken),
                 region: DEFAULT_COGNITO.region,
             });
             if (result.destination.kind === "file") {
@@ -781,7 +875,7 @@ export function registerFilesBrowseCommands(filesCmd) {
                 query,
                 companySlug: company,
                 vaultClient: client,
-                s3Factory: defaultS3Factory,
+                companyClient: makeCompanyPresignFactory(accessToken),
                 region: DEFAULT_COGNITO.region,
             });
             console.log(formatBrowseTable(rows));
@@ -824,7 +918,7 @@ export function registerFilesBrowseCommands(filesCmd) {
                 hqRoot: options.hqRoot,
                 companySlug: slug,
                 vaultClient: client,
-                s3Factory: defaultS3Factory,
+                companyClient: makeCompanyPresignFactory(accessToken),
                 region: DEFAULT_COGNITO.region,
             });
             console.error(chalk.green("✓"), `Materialized ${result.filesWritten} file(s), ${result.bytesWritten} bytes.`);
@@ -839,4 +933,4 @@ export function registerFilesBrowseCommands(filesCmd) {
     });
 }
 //# sourceMappingURL=files-browse.js.map
-//# debugId=cad165f9-6445-5434-969b-e0705274aa56
+//# debugId=76062756-52c6-58a0-a647-9fcc95550911

package/dist/commands/signals.js

@@ -20,11 +20,11 @@
  * --type flag parsing.
  */
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="2088e3af-a005-57eb-b642-90aca198460b")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="395fa417-375a-55e7-b881-e65431742835")}catch(e){}}();
 import * as fs from "node:fs";
 import * as path from "node:path";
 import chalk from "chalk";
-import { SIGNAL_TYPES, assertSignalType, resolveEntity, listAvailableEntities, listSignals, getSignal, } from "@indigoai-us/hq-cloud";
+import { SIGNAL_TYPES, assertSignalType, resolveEntity, listAvailableEntities, listSignals, getSignal, VaultClient, } from "@indigoai-us/hq-cloud";
 import { ensureCognitoToken, buildVaultConfig, DEFAULT_HQ_ROOT, } from "../utils/cognito-session.js";
 import { Sentry } from "../sentry.js";
 // ---------------------------------------------------------------------------
@@ -110,6 +110,9 @@ async function runList(options) {
         limit,
         continuationToken: options.pageToken,
         includeFrontmatter: options.includeFrontmatter,
+        // HQ-59: route company (cmp_) reads through the ACL-filtered presign
+        // transport (no direct S3). Personal vaults / no-client stay on S3.
+        vault: new VaultClient(vaultConfig),
     });
     if (format === "json") {
         process.stdout.write(JSON.stringify(result, null, 2) + "\n");
@@ -138,6 +141,8 @@ async function runGet(options) {
         entity,
         signalType,
         signalId: options.id,
+        // HQ-59: company (cmp_) reads over presign; personal/no-client stay on S3.
+        vault: new VaultClient(vaultConfig),
     });
     if (format === "json") {
         process.stdout.write(JSON.stringify(doc, null, 2) + "\n");
@@ -237,4 +242,4 @@ export function registerSignalsCommand(program) {
         .action(withErrorHandling(async (options) => runEntities(options)));
 }
 //# sourceMappingURL=signals.js.map
-//# debugId=2088e3af-a005-57eb-b642-90aca198460b
+//# debugId=395fa417-375a-55e7-b881-e65431742835

package/dist/commands/sources.js

@@ -18,11 +18,11 @@
  *   --limit    50.
  */
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="df18b298-4724-5557-a579-edfa0f468361")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="1123e933-4c37-5679-ae51-84cffd42e31b")}catch(e){}}();
 import * as fs from "node:fs";
 import * as path from "node:path";
 import chalk from "chalk";
-import { SOURCE_CHANNELS, assertSourceChannel, resolveEntity, listAvailableEntities, listSources, getSource, } from "@indigoai-us/hq-cloud";
+import { SOURCE_CHANNELS, assertSourceChannel, resolveEntity, listAvailableEntities, listSources, getSource, VaultClient, } from "@indigoai-us/hq-cloud";
 import { ensureCognitoToken, buildVaultConfig, DEFAULT_HQ_ROOT, } from "../utils/cognito-session.js";
 import { Sentry } from "../sentry.js";
 // ---------------------------------------------------------------------------
@@ -118,6 +118,9 @@ async function runList(options) {
         limit,
         continuationToken: options.pageToken,
         includeFrontmatter: options.includeFrontmatter,
+        // HQ-59: route company (cmp_) reads through the ACL-filtered presign
+        // transport (no direct S3). Personal vaults / no-client stay on S3.
+        vault: new VaultClient(vaultConfig),
     });
     if (format === "json") {
         process.stdout.write(JSON.stringify(result, null, 2) + "\n");
@@ -147,6 +150,8 @@ async function runGet(options) {
         channel,
         sourceId: options.id,
         includeRaw: options.includeRaw,
+        // HQ-59: company (cmp_) reads over presign; personal/no-client stay on S3.
+        vault: new VaultClient(vaultConfig),
     });
     if (format === "json") {
         process.stdout.write(JSON.stringify(doc, null, 2) + "\n");
@@ -247,4 +252,4 @@ export function registerSourcesCommand(program) {
         .action(withErrorHandling(async (options) => runEntities(options)));
 }
 //# sourceMappingURL=sources.js.map
-//# debugId=df18b298-4724-5557-a579-edfa0f468361
+//# debugId=1123e933-4c37-5679-ae51-84cffd42e31b

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.47.6",
+  "version": "5.47.8",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {
@@ -15,7 +15,7 @@
     "clean": "rm -rf dist"
   },
   "dependencies": {
-    "@indigoai-us/hq-cloud": "^6.11.4",
+    "@indigoai-us/hq-cloud": "^6.11.6",
     "@indigoai-us/hq-onboarding": "^0.1.0",
     "@sentry/node": "^10.49.0",
     "chalk": "^5.3.0",