@indigoai-us/hq-cli 5.47.7 → 5.47.8

package/dist/commands/signals.js

@@ -20,11 +20,11 @@
  * --type flag parsing.
  */
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="2088e3af-a005-57eb-b642-90aca198460b")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="395fa417-375a-55e7-b881-e65431742835")}catch(e){}}();
 import * as fs from "node:fs";
 import * as path from "node:path";
 import chalk from "chalk";
-import { SIGNAL_TYPES, assertSignalType, resolveEntity, listAvailableEntities, listSignals, getSignal, } from "@indigoai-us/hq-cloud";
+import { SIGNAL_TYPES, assertSignalType, resolveEntity, listAvailableEntities, listSignals, getSignal, VaultClient, } from "@indigoai-us/hq-cloud";
 import { ensureCognitoToken, buildVaultConfig, DEFAULT_HQ_ROOT, } from "../utils/cognito-session.js";
 import { Sentry } from "../sentry.js";
 // ---------------------------------------------------------------------------
@@ -110,6 +110,9 @@ async function runList(options) {
         limit,
         continuationToken: options.pageToken,
         includeFrontmatter: options.includeFrontmatter,
+        // HQ-59: route company (cmp_) reads through the ACL-filtered presign
+        // transport (no direct S3). Personal vaults / no-client stay on S3.
+        vault: new VaultClient(vaultConfig),
     });
     if (format === "json") {
         process.stdout.write(JSON.stringify(result, null, 2) + "\n");
@@ -138,6 +141,8 @@ async function runGet(options) {
         entity,
         signalType,
         signalId: options.id,
+        // HQ-59: company (cmp_) reads over presign; personal/no-client stay on S3.
+        vault: new VaultClient(vaultConfig),
     });
     if (format === "json") {
         process.stdout.write(JSON.stringify(doc, null, 2) + "\n");
@@ -237,4 +242,4 @@ export function registerSignalsCommand(program) {
         .action(withErrorHandling(async (options) => runEntities(options)));
 }
 //# sourceMappingURL=signals.js.map
-//# debugId=2088e3af-a005-57eb-b642-90aca198460b
+//# debugId=395fa417-375a-55e7-b881-e65431742835

package/dist/commands/sources.js

@@ -18,11 +18,11 @@
  *   --limit    50.
  */
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="df18b298-4724-5557-a579-edfa0f468361")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="1123e933-4c37-5679-ae51-84cffd42e31b")}catch(e){}}();
 import * as fs from "node:fs";
 import * as path from "node:path";
 import chalk from "chalk";
-import { SOURCE_CHANNELS, assertSourceChannel, resolveEntity, listAvailableEntities, listSources, getSource, } from "@indigoai-us/hq-cloud";
+import { SOURCE_CHANNELS, assertSourceChannel, resolveEntity, listAvailableEntities, listSources, getSource, VaultClient, } from "@indigoai-us/hq-cloud";
 import { ensureCognitoToken, buildVaultConfig, DEFAULT_HQ_ROOT, } from "../utils/cognito-session.js";
 import { Sentry } from "../sentry.js";
 // ---------------------------------------------------------------------------
@@ -118,6 +118,9 @@ async function runList(options) {
         limit,
         continuationToken: options.pageToken,
         includeFrontmatter: options.includeFrontmatter,
+        // HQ-59: route company (cmp_) reads through the ACL-filtered presign
+        // transport (no direct S3). Personal vaults / no-client stay on S3.
+        vault: new VaultClient(vaultConfig),
     });
     if (format === "json") {
         process.stdout.write(JSON.stringify(result, null, 2) + "\n");
@@ -147,6 +150,8 @@ async function runGet(options) {
         channel,
         sourceId: options.id,
         includeRaw: options.includeRaw,
+        // HQ-59: company (cmp_) reads over presign; personal/no-client stay on S3.
+        vault: new VaultClient(vaultConfig),
     });
     if (format === "json") {
         process.stdout.write(JSON.stringify(doc, null, 2) + "\n");
@@ -247,4 +252,4 @@ export function registerSourcesCommand(program) {
         .action(withErrorHandling(async (options) => runEntities(options)));
 }
 //# sourceMappingURL=sources.js.map
-//# debugId=df18b298-4724-5557-a579-edfa0f468361
+//# debugId=1123e933-4c37-5679-ae51-84cffd42e31b

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.47.7",
+  "version": "5.47.8",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {
@@ -15,7 +15,7 @@
     "clean": "rm -rf dist"
   },
   "dependencies": {
-    "@indigoai-us/hq-cloud": "^6.11.5",
+    "@indigoai-us/hq-cloud": "^6.11.6",
     "@indigoai-us/hq-onboarding": "^0.1.0",
     "@sentry/node": "^10.49.0",
     "chalk": "^5.3.0",

package/src/commands/signals.ts

@@ -31,6 +31,7 @@ import {
   listAvailableEntities,
   listSignals,
   getSignal,
+  VaultClient,
   type SignalType,
   type SignalSummary,
   type SignalDocument,
@@ -164,6 +165,9 @@ async function runList(options: ListOptions): Promise<void> {
     limit,
     continuationToken: options.pageToken,
     includeFrontmatter: options.includeFrontmatter,
+    // HQ-59: route company (cmp_) reads through the ACL-filtered presign
+    // transport (no direct S3). Personal vaults / no-client stay on S3.
+    vault: new VaultClient(vaultConfig),
   });
 
   if (format === "json") {
@@ -212,6 +216,8 @@ async function runGet(options: GetOptions): Promise<void> {
     entity,
     signalType,
     signalId: options.id,
+    // HQ-59: company (cmp_) reads over presign; personal/no-client stay on S3.
+    vault: new VaultClient(vaultConfig),
   });
 
   if (format === "json") {

package/src/commands/sources.ts

@@ -29,6 +29,7 @@ import {
   listAvailableEntities,
   listSources,
   getSource,
+  VaultClient,
   type SourceChannel,
   type SourceSummary,
   type SourceDocument,
@@ -172,6 +173,9 @@ async function runList(options: ListOptions): Promise<void> {
     limit,
     continuationToken: options.pageToken,
     includeFrontmatter: options.includeFrontmatter,
+    // HQ-59: route company (cmp_) reads through the ACL-filtered presign
+    // transport (no direct S3). Personal vaults / no-client stay on S3.
+    vault: new VaultClient(vaultConfig),
   });
 
   if (format === "json") {
@@ -222,6 +226,8 @@ async function runGet(options: GetOptions): Promise<void> {
     channel,
     sourceId: options.id,
     includeRaw: options.includeRaw,
+    // HQ-59: company (cmp_) reads over presign; personal/no-client stay on S3.
+    vault: new VaultClient(vaultConfig),
   });
 
   if (format === "json") {

package/test/commands/signals.test.ts

@@ -24,7 +24,6 @@ import {
   _setSignalsS3Factory,
   _resetSignalsS3Factory,
 } from "@indigoai-us/hq-cloud";
-import { mockS3WithEntries } from "../helpers/s3-list-mock.js";
 import { mockVaultService } from "../helpers/vault-service-mock.js";
 import { runCli } from "../helpers/cli-runner.js";
 
@@ -62,8 +61,21 @@ beforeEach(() => {
 
   tmpHqRoot = mkdtempSync(join(tmpdir(), "hq-signals-test-"));
 
-  const s3 = mockS3WithEntries({
-    entries: [
+  // Transport-switch proof: every read in this suite targets a COMPANY (cmp_)
+  // entity, which routes through presign as of HQ-59. The direct-S3 factory is
+  // wired to THROW so any read accidentally falling back to S3 fails loudly
+  // (mirrors hq-cloud's #88 "S3 stub throws if touched" tests).
+  _setSignalsS3Factory(() => {
+    throw new Error(
+      "S3 transport must not be used for a company (cmp_) read — HQ-59 routes these through presign",
+    );
+  });
+
+  // `files` serves the fixture over the presigned-URL transport (the path
+  // company reads take).
+  restoreFetch = mockVaultService({
+    entities: [{ uid: "cmp_indigo_001", slug: "indigo", bucketName: "hq-indigo-bucket" }],
+    files: [
       {
         key: "signals/action_item/xyz.md",
         content: ACTION_ITEM_MD,
@@ -71,11 +83,6 @@ beforeEach(() => {
       },
     ],
   });
-  _setSignalsS3Factory(() => s3);
-
-  restoreFetch = mockVaultService({
-    entities: [{ uid: "cmp_indigo_001", slug: "indigo", bucketName: "hq-indigo-bucket" }],
-  });
 });
 
 afterEach(() => {

package/test/commands/sources.test.ts

@@ -26,7 +26,6 @@ import {
   _setSourcesS3Factory,
   _resetSourcesS3Factory,
 } from "@indigoai-us/hq-cloud";
-import { mockS3WithEntries } from "../helpers/s3-list-mock.js";
 import { mockVaultService } from "../helpers/vault-service-mock.js";
 import { runCli } from "../helpers/cli-runner.js";
 
@@ -72,9 +71,21 @@ beforeEach(() => {
   // test writes config.json into it.
   tmpHqRoot = mkdtempSync(join(tmpdir(), "hq-sources-test-"));
 
-  // Default S3 stub returns the one meeting source.
-  const s3 = mockS3WithEntries({
-    entries: [
+  // Transport-switch proof: every read in this suite targets a COMPANY (cmp_)
+  // entity, which routes through presign as of HQ-59. The direct-S3 factory is
+  // wired to THROW so that any read accidentally falling back to S3 fails the
+  // test loudly (mirrors hq-cloud's #88 "S3 stub throws if touched" tests).
+  _setSourcesS3Factory(() => {
+    throw new Error(
+      "S3 transport must not be used for a company (cmp_) read — HQ-59 routes these through presign",
+    );
+  });
+
+  // Default vault-service mock with one entity 'indigo'. `files` serves the
+  // fixture over the presigned-URL transport (the path company reads take).
+  restoreFetch = mockVaultService({
+    entities: [{ uid: "cmp_indigo_001", slug: "indigo", bucketName: "hq-indigo-bucket" }],
+    files: [
       {
         key: "sources/meetings/abc.md",
         content: MEETING_MD,
@@ -82,12 +93,6 @@ beforeEach(() => {
       },
     ],
   });
-  _setSourcesS3Factory(() => s3);
-
-  // Default vault-service mock with one entity 'indigo'.
-  restoreFetch = mockVaultService({
-    entities: [{ uid: "cmp_indigo_001", slug: "indigo", bucketName: "hq-indigo-bucket" }],
-  });
 });
 
 afterEach(() => {

package/test/helpers/vault-service-mock.ts

@@ -33,12 +33,33 @@ export interface MockStsCredentials {
   sessionToken: string;
 }
 
+/** A file served over the presigned-URL transport (HQ-59 company reads). */
+export interface MockVaultFile {
+  /** Object key (e.g. "sources/meetings/abc.md") */
+  key: string;
+  /** Full file content as UTF-8 string */
+  content: string;
+  /** Optional override; defaults to 2026-01-01T00:00:00Z */
+  lastModified?: Date;
+}
+
 export interface MockVaultOptions {
   entities: MockEntity[];
   /** STS credentials returned for every POST /entities/{uid}/sts; defaults to test creds */
   stsCredentials?: MockStsCredentials;
+  /**
+   * Files served over the presigned-URL transport (`GET /v1/files/list`,
+   * `POST /v1/files/presign`, then a GET against the minted URL). Supplied so
+   * company (cmp_) reads — which route through presign as of HQ-59 — resolve
+   * without touching real S3. Absent → those endpoints return empty/404.
+   */
+  files?: MockVaultFile[];
 }
 
+/** Host for mock presigned URLs minted by POST /v1/files/presign. */
+const PRESIGN_URL_HOST = "https://presigned.test";
+const DEFAULT_FILE_DATE = new Date("2026-01-01T00:00:00Z");
+
 const DEFAULT_STS: MockStsCredentials = {
   accessKeyId: "ASIAMOCK000000000001",
   secretAccessKey: "mockSecretAccessKey",
@@ -51,7 +72,7 @@ const DEFAULT_STS: MockStsCredentials = {
  * @returns A restore function — call it in afterEach to un-install the stub.
  */
 export function mockVaultService(opts: MockVaultOptions): () => void {
-  const { entities, stsCredentials = DEFAULT_STS } = opts;
+  const { entities, stsCredentials = DEFAULT_STS, files = [] } = opts;
   const originalFetch = globalThis.fetch as typeof fetch | undefined;
 
   globalThis.fetch = async (
@@ -67,6 +88,56 @@ export function mockVaultService(opts: MockVaultOptions): () => void {
     const method =
       (init?.method ?? (input instanceof Request ? input.method : "GET")).toUpperCase();
 
+    // ── Presigned-URL transport (HQ-59 company reads) ──────────────────────
+    // A GET against a URL minted by POST /v1/files/presign below. Serve the
+    // file body (or 404) so PresignObjectIO.getObject resolves like real S3.
+    if (url.startsWith(`${PRESIGN_URL_HOST}/`)) {
+      const key = new URL(url).searchParams.get("key") ?? "";
+      const file = files.find((f) => f.key === key);
+      if (!file) return new Response("", { status: 404 });
+      return new Response(file.content, {
+        status: 200,
+        headers: {
+          "Content-Type": "text/markdown",
+          "Content-Length": String(Buffer.byteLength(file.content, "utf-8")),
+          "Last-Modified": (file.lastModified ?? DEFAULT_FILE_DATE).toUTCString(),
+          ETag: '"mock-etag"',
+        },
+      });
+    }
+
+    // GET /v1/files/list?company=<uid>&prefix=<p>&cursor=<c>  (VaultClient.listFiles)
+    if (method === "GET" && /\/v1\/files\/list(\?|$)/.test(url)) {
+      const prefix = new URL(url).searchParams.get("prefix") ?? "";
+      const objects = files
+        .filter((f) => f.key.startsWith(prefix))
+        .map((f) => ({
+          key: f.key,
+          size: Buffer.byteLength(f.content, "utf-8"),
+          lastModified: (f.lastModified ?? DEFAULT_FILE_DATE).toISOString(),
+          etag: "mock-etag",
+          permission: "read",
+        }));
+      return json({ objects, cursor: null, truncated: false });
+    }
+
+    // POST /v1/files/presign  (VaultClient.presign) — mint a per-key URL that
+    // the GET handler above resolves. Unknown keys still get a URL → that GET
+    // 404s, which the reader normalizes to NoSuchKey (the not-found path).
+    if (method === "POST" && /\/v1\/files\/presign$/.test(url)) {
+      const body = init?.body ? JSON.parse(init.body.toString()) : {};
+      const keys = (body.keys ?? []) as Array<{ key: string }>;
+      const results = keys.map((k) => ({
+        key: k.key,
+        url: `${PRESIGN_URL_HOST}/obj?key=${encodeURIComponent(k.key)}`,
+        error: null,
+      }));
+      return json({
+        results,
+        expiresAt: new Date(Date.now() + 3600 * 1000).toISOString(),
+      });
+    }
+
     // GET /membership/me
     if (method === "GET" && /\/membership\/me(\?.*)?$/.test(url)) {
       const memberships: Partial<Membership>[] = entities.map((e) => ({