@indigoai-us/hq-cli 5.6.0 → 5.6.2

package/dist/commands/cloud-provision.d.ts

@@ -55,10 +55,12 @@ export interface ProvisionResult {
     manifest_patched: boolean;
     config_written: boolean;
     initial_sync: {
-        ok: boolean;
+        ok?: boolean;
         files_uploaded?: number;
         bytes_uploaded?: number;
         error?: string;
+        /** True if the caller passed --skip-initial-sync; ok/files/bytes will be absent. */
+        skipped?: boolean;
     };
 }
 /** Options for the high-level `provisionCompany` orchestrator. */
@@ -68,6 +70,15 @@ export interface ProvisionCompanyOptions {
     ownerUid?: string;
     hqRoot: string;
     vaultApiUrl: string;
+    /**
+     * Skip the initial-sync step. The vault entity, manifest patch, and
+     * `.hq/config.json` write still happen; the post-provision `share()` call
+     * is no-op'd. Use this when the caller has its own upload pipeline (e.g.
+     * AppBar HQ Sync's `first_push_company` with STS-vended credentials and
+     * Tauri progress events) and would otherwise double-upload the same files.
+     * When true, `initial_sync` in the result is `{ skipped: true }`.
+     */
+    skipInitialSync?: boolean;
     /** Injected vault HTTP client (override for tests). */
     vaultClient?: VaultClient;
     /** Injected access-token resolver (override for tests). */

package/dist/commands/cloud-provision.js

@@ -25,7 +25,7 @@
  *       `initial_sync.ok=false`). Manifest + config may have been written.
  */
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="301e6769-89c3-53e0-9b81-42840d6d59f7")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="aacb5bf2-8362-5336-b864-43296c30a1d6")}catch(e){}}();
 import chalk from "chalk";
 import * as fs from "node:fs";
 import * as path from "node:path";
@@ -180,7 +180,7 @@ export function createDefaultVaultClient(apiUrl, accessToken) {
     };
     return {
         async findCompanyBySlug(slug) {
-            const url = `${apiUrl.replace(/\/$/, "")}/v1/entities/by-slug/company/${encodeURIComponent(slug)}`;
+            const url = `${apiUrl.replace(/\/$/, "")}/entity/by-slug/company/${encodeURIComponent(slug)}`;
             const res = await fetch(url, { method: "GET", headers });
             if (res.status === 404)
                 return null;
@@ -195,7 +195,7 @@ export function createDefaultVaultClient(apiUrl, accessToken) {
             return data.entity;
         },
         async createCompanyEntity(input) {
-            const url = `${apiUrl.replace(/\/$/, "")}/v1/entities`;
+            const url = `${apiUrl.replace(/\/$/, "")}/entity`;
             const body = {
                 type: "company",
                 slug: input.slug,
@@ -213,11 +213,11 @@ export function createDefaultVaultClient(apiUrl, accessToken) {
                 // 409 means a concurrent client created it between our GET and POST —
                 // surface it as a vault error. The orchestrator is responsible for
                 // retrying GET if it wants idempotency on collisions.
-                throw new ProvisionError(1, `Vault POST /v1/entities failed: ${res.status} ${res.statusText} — ${text}`);
+                throw new ProvisionError(1, `Vault POST /entity failed: ${res.status} ${res.statusText} — ${text}`);
             }
             const data = (await res.json());
             if (!data.entity) {
-                throw new ProvisionError(1, `Vault POST /v1/entities returned ${res.status} with no entity body`);
+                throw new ProvisionError(1, `Vault POST /entity returned ${res.status} with no entity body`);
             }
             return data.entity;
         },
@@ -317,39 +317,47 @@ export async function provisionCompany(options) {
         vaultApiUrl: options.vaultApiUrl,
     });
     log(`wrote companies/${options.slug}/.hq/config.json`);
-    // Step 8: trigger initial sync (failure ⇒ exit 3 with cloud_uid populated)
-    const runner = options.runInitialSync ?? defaultRunInitialSync;
+    // Step 8: trigger initial sync (failure ⇒ exit 3 with cloud_uid populated).
+    // Skipped when caller passed --skip-initial-sync (e.g. AppBar HQ Sync, which
+    // owns its own STS-credentialed upload pipeline + Tauri progress events).
     let initialSync;
-    try {
-        log(`triggering initial sync via share()`);
-        const sync = await runner({
-            slug: options.slug,
-            hqRoot: options.hqRoot,
-            accessToken,
-            vaultApiUrl: options.vaultApiUrl,
-        });
-        initialSync = {
-            ok: true,
-            files_uploaded: sync.filesUploaded,
-            bytes_uploaded: sync.bytesUploaded,
-        };
-        log(`initial sync complete — files=${sync.filesUploaded} bytes=${sync.bytesUploaded}`);
+    if (options.skipInitialSync) {
+        log(`skipping initial sync (--skip-initial-sync)`);
+        initialSync = { skipped: true };
     }
-    catch (err) {
-        const msg = err instanceof Error ? err.message : String(err);
-        log(`initial sync failed: ${msg}`);
-        throw new ProvisionError(3, `Initial sync failed: ${msg}`, {
-            ok: false,
-            company_slug: options.slug,
-            cloud_uid: cloudUid,
-            bucket_name: bucketName,
-            vault_api_url: options.vaultApiUrl,
-            kms_key_id: kmsKeyId,
-            created_entity: createdEntity,
-            manifest_patched: true,
-            config_written: true,
-            initial_sync: { ok: false, error: msg },
-        });
+    else {
+        const runner = options.runInitialSync ?? defaultRunInitialSync;
+        try {
+            log(`triggering initial sync via share()`);
+            const sync = await runner({
+                slug: options.slug,
+                hqRoot: options.hqRoot,
+                accessToken,
+                vaultApiUrl: options.vaultApiUrl,
+            });
+            initialSync = {
+                ok: true,
+                files_uploaded: sync.filesUploaded,
+                bytes_uploaded: sync.bytesUploaded,
+            };
+            log(`initial sync complete — files=${sync.filesUploaded} bytes=${sync.bytesUploaded}`);
+        }
+        catch (err) {
+            const msg = err instanceof Error ? err.message : String(err);
+            log(`initial sync failed: ${msg}`);
+            throw new ProvisionError(3, `Initial sync failed: ${msg}`, {
+                ok: false,
+                company_slug: options.slug,
+                cloud_uid: cloudUid,
+                bucket_name: bucketName,
+                vault_api_url: options.vaultApiUrl,
+                kms_key_id: kmsKeyId,
+                created_entity: createdEntity,
+                manifest_patched: true,
+                config_written: true,
+                initial_sync: { ok: false, error: msg },
+            });
+        }
     }
     return {
         ok: true,
@@ -385,6 +393,9 @@ export function registerCloudProvisionCommands(program) {
         .option("--owner <uid>", "Owner person UID (default: current Cognito user sub)")
         .option("--hq-root <path>", `Local HQ tree root (default: ${DEFAULT_HQ_ROOT})`, DEFAULT_HQ_ROOT)
         .option("--vault-api-url <url>", `Vault API URL (default: ${DEFAULT_VAULT_API_URL})`, DEFAULT_VAULT_API_URL)
+        .option("--skip-initial-sync", "Skip the post-provision share() initial sync. Use when the caller " +
+        "(e.g. AppBar HQ Sync) has its own upload pipeline. Result includes " +
+        "{ initial_sync: { skipped: true } } when set.")
         .action(async (slug, options) => {
         try {
             const result = await provisionCompany({
@@ -393,6 +404,7 @@ export function registerCloudProvisionCommands(program) {
                 ownerUid: options.owner,
                 hqRoot: options.hqRoot,
                 vaultApiUrl: options.vaultApiUrl,
+                skipInitialSync: options.skipInitialSync,
             });
             // Final stdout line — single JSON document for downstream consumers
             process.stdout.write(JSON.stringify(result) + "\n");
@@ -414,4 +426,4 @@ export function registerCloudProvisionCommands(program) {
     });
 }
 //# sourceMappingURL=cloud-provision.js.map
-//# debugId=301e6769-89c3-53e0-9b81-42840d6d59f7
+//# debugId=aacb5bf2-8362-5336-b864-43296c30a1d6

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.6.0",
+  "version": "5.6.2",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {

package/src/commands/cloud-provision.test.ts

@@ -374,7 +374,7 @@ describe("createDefaultVaultClient", () => {
     expect(out).toEqual(entity);
     // Verify request shape
     const call = fetchSpy.mock.calls[0];
-    expect(call[0]).toBe(`${apiUrl}/v1/entities`);
+    expect(call[0]).toBe(`${apiUrl}/entity`);
     expect((call[1] as RequestInit)?.method).toBe("POST");
     const body = JSON.parse(((call[1] as RequestInit)?.body as string) ?? "{}");
     expect(body).toEqual({ type: "company", slug: "indigo", name: "Indigo" });
@@ -649,4 +649,75 @@ describe("provisionCompany", () => {
       ownerUid: undefined,
     });
   });
+
+  it("skipInitialSync=true — runner is NOT called; result has initial_sync.skipped", async () => {
+    setupValid();
+    const entity: VaultEntity = {
+      uid: "cmp_01H",
+      type: "company",
+      slug: "indigo",
+      name: "Indigo",
+      bucketName: "hq-vault-cmp-01H",
+    };
+    const vaultClient = makeVaultClient({
+      findCompanyBySlug: vi.fn().mockResolvedValue(null),
+      createCompanyEntity: vi.fn().mockResolvedValue(entity),
+    });
+    const runInitialSync = vi.fn();
+
+    const result = await provisionCompany({
+      slug: "indigo",
+      hqRoot: tmpRoot,
+      vaultApiUrl,
+      vaultClient,
+      resolveAccessToken: async () => accessToken,
+      runInitialSync,
+      skipInitialSync: true,
+      log: () => {},
+    });
+
+    expect(runInitialSync).not.toHaveBeenCalled();
+    expect(result.initial_sync).toEqual({ skipped: true });
+    expect(result.ok).toBe(true);
+    expect(result.cloud_uid).toBe("cmp_01H");
+    expect(result.manifest_patched).toBe(true);
+    expect(result.config_written).toBe(true);
+  });
+
+  it("skipInitialSync=true — manifest + .hq/config.json are STILL written", async () => {
+    setupValid();
+    const entity: VaultEntity = {
+      uid: "cmp_SKIP",
+      type: "company",
+      slug: "indigo",
+      name: "Indigo",
+      bucketName: "hq-vault-cmp-SKIP",
+    };
+    const vaultClient = makeVaultClient({
+      findCompanyBySlug: vi.fn().mockResolvedValue(null),
+      createCompanyEntity: vi.fn().mockResolvedValue(entity),
+    });
+    await provisionCompany({
+      slug: "indigo",
+      hqRoot: tmpRoot,
+      vaultApiUrl,
+      vaultClient,
+      resolveAccessToken: async () => accessToken,
+      runInitialSync: vi.fn(),
+      skipInitialSync: true,
+      log: () => {},
+    });
+    // Manifest patched on disk
+    const m = yaml.load(fs.readFileSync(manifestPath(tmpRoot), "utf-8")) as {
+      companies: Record<string, Record<string, unknown>>;
+    };
+    expect(m.companies.indigo.cloud_uid).toBe("cmp_SKIP");
+    expect(m.companies.indigo.bucket_name).toBe("hq-vault-cmp-SKIP");
+    // .hq/config.json written
+    const c = JSON.parse(
+      fs.readFileSync(companyConfigPath(tmpRoot, "indigo"), "utf-8"),
+    );
+    expect(c.companyUid).toBe("cmp_SKIP");
+    expect(c.bucketName).toBe("hq-vault-cmp-SKIP");
+  });
 });

package/src/commands/cloud-provision.ts

@@ -74,10 +74,12 @@ export interface ProvisionResult {
   manifest_patched: boolean;
   config_written: boolean;
   initial_sync: {
-    ok: boolean;
+    ok?: boolean;
     files_uploaded?: number;
     bytes_uploaded?: number;
     error?: string;
+    /** True if the caller passed --skip-initial-sync; ok/files/bytes will be absent. */
+    skipped?: boolean;
   };
 }
 
@@ -88,6 +90,15 @@ export interface ProvisionCompanyOptions {
   ownerUid?: string;
   hqRoot: string;
   vaultApiUrl: string;
+  /**
+   * Skip the initial-sync step. The vault entity, manifest patch, and
+   * `.hq/config.json` write still happen; the post-provision `share()` call
+   * is no-op'd. Use this when the caller has its own upload pipeline (e.g.
+   * AppBar HQ Sync's `first_push_company` with STS-vended credentials and
+   * Tauri progress events) and would otherwise double-upload the same files.
+   * When true, `initial_sync` in the result is `{ skipped: true }`.
+   */
+  skipInitialSync?: boolean;
   /** Injected vault HTTP client (override for tests). */
   vaultClient?: VaultClient;
   /** Injected access-token resolver (override for tests). */
@@ -335,7 +346,7 @@ export function createDefaultVaultClient(
   };
   return {
     async findCompanyBySlug(slug: string): Promise<VaultEntity | null> {
-      const url = `${apiUrl.replace(/\/$/, "")}/v1/entities/by-slug/company/${encodeURIComponent(
+      const url = `${apiUrl.replace(/\/$/, "")}/entity/by-slug/company/${encodeURIComponent(
         slug,
       )}`;
       const res = await fetch(url, { method: "GET", headers });
@@ -361,7 +372,7 @@ export function createDefaultVaultClient(
       name: string;
       ownerUid?: string;
     }): Promise<VaultEntity> {
-      const url = `${apiUrl.replace(/\/$/, "")}/v1/entities`;
+      const url = `${apiUrl.replace(/\/$/, "")}/entity`;
       const body: Record<string, unknown> = {
         type: "company",
         slug: input.slug,
@@ -380,14 +391,14 @@ export function createDefaultVaultClient(
         // retrying GET if it wants idempotency on collisions.
         throw new ProvisionError(
           1,
-          `Vault POST /v1/entities failed: ${res.status} ${res.statusText} — ${text}`,
+          `Vault POST /entity failed: ${res.status} ${res.statusText} — ${text}`,
         );
       }
       const data = (await res.json()) as { entity?: VaultEntity };
       if (!data.entity) {
         throw new ProvisionError(
           1,
-          `Vault POST /v1/entities returned ${res.status} with no entity body`,
+          `Vault POST /entity returned ${res.status} with no entity body`,
         );
       }
       return data.entity;
@@ -510,40 +521,47 @@ export async function provisionCompany(
   });
   log(`wrote companies/${options.slug}/.hq/config.json`);
 
-  // Step 8: trigger initial sync (failure ⇒ exit 3 with cloud_uid populated)
-  const runner = options.runInitialSync ?? defaultRunInitialSync;
+  // Step 8: trigger initial sync (failure ⇒ exit 3 with cloud_uid populated).
+  // Skipped when caller passed --skip-initial-sync (e.g. AppBar HQ Sync, which
+  // owns its own STS-credentialed upload pipeline + Tauri progress events).
   let initialSync: ProvisionResult["initial_sync"];
-  try {
-    log(`triggering initial sync via share()`);
-    const sync = await runner({
-      slug: options.slug,
-      hqRoot: options.hqRoot,
-      accessToken,
-      vaultApiUrl: options.vaultApiUrl,
-    });
-    initialSync = {
-      ok: true,
-      files_uploaded: sync.filesUploaded,
-      bytes_uploaded: sync.bytesUploaded,
-    };
-    log(
-      `initial sync complete — files=${sync.filesUploaded} bytes=${sync.bytesUploaded}`,
-    );
-  } catch (err) {
-    const msg = err instanceof Error ? err.message : String(err);
-    log(`initial sync failed: ${msg}`);
-    throw new ProvisionError(3, `Initial sync failed: ${msg}`, {
-      ok: false,
-      company_slug: options.slug,
-      cloud_uid: cloudUid,
-      bucket_name: bucketName,
-      vault_api_url: options.vaultApiUrl,
-      kms_key_id: kmsKeyId,
-      created_entity: createdEntity,
-      manifest_patched: true,
-      config_written: true,
-      initial_sync: { ok: false, error: msg },
-    });
+  if (options.skipInitialSync) {
+    log(`skipping initial sync (--skip-initial-sync)`);
+    initialSync = { skipped: true };
+  } else {
+    const runner = options.runInitialSync ?? defaultRunInitialSync;
+    try {
+      log(`triggering initial sync via share()`);
+      const sync = await runner({
+        slug: options.slug,
+        hqRoot: options.hqRoot,
+        accessToken,
+        vaultApiUrl: options.vaultApiUrl,
+      });
+      initialSync = {
+        ok: true,
+        files_uploaded: sync.filesUploaded,
+        bytes_uploaded: sync.bytesUploaded,
+      };
+      log(
+        `initial sync complete — files=${sync.filesUploaded} bytes=${sync.bytesUploaded}`,
+      );
+    } catch (err) {
+      const msg = err instanceof Error ? err.message : String(err);
+      log(`initial sync failed: ${msg}`);
+      throw new ProvisionError(3, `Initial sync failed: ${msg}`, {
+        ok: false,
+        company_slug: options.slug,
+        cloud_uid: cloudUid,
+        bucket_name: bucketName,
+        vault_api_url: options.vaultApiUrl,
+        kms_key_id: kmsKeyId,
+        created_entity: createdEntity,
+        manifest_patched: true,
+        config_written: true,
+        initial_sync: { ok: false, error: msg },
+      });
+    }
   }
 
   return {
@@ -593,6 +611,12 @@ export function registerCloudProvisionCommands(program: Command): void {
       `Vault API URL (default: ${DEFAULT_VAULT_API_URL})`,
       DEFAULT_VAULT_API_URL,
     )
+    .option(
+      "--skip-initial-sync",
+      "Skip the post-provision share() initial sync. Use when the caller " +
+        "(e.g. AppBar HQ Sync) has its own upload pipeline. Result includes " +
+        "{ initial_sync: { skipped: true } } when set.",
+    )
     .action(
       async (
         slug: string,
@@ -601,6 +625,7 @@ export function registerCloudProvisionCommands(program: Command): void {
           owner?: string;
           hqRoot: string;
           vaultApiUrl: string;
+          skipInitialSync?: boolean;
         },
       ) => {
         try {
@@ -610,6 +635,7 @@ export function registerCloudProvisionCommands(program: Command): void {
             ownerUid: options.owner,
             hqRoot: options.hqRoot,
             vaultApiUrl: options.vaultApiUrl,
+            skipInitialSync: options.skipInitialSync,
           });
           // Final stdout line — single JSON document for downstream consumers
           process.stdout.write(JSON.stringify(result) + "\n");