@indigoai-us/hq-cli 5.6.1 → 5.6.3

package/dist/commands/cloud-provision.js

@@ -25,7 +25,7 @@
  *       `initial_sync.ok=false`). Manifest + config may have been written.
  */
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="325d7bbf-c44d-5bba-a156-072302ab1536")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="aacb5bf2-8362-5336-b864-43296c30a1d6")}catch(e){}}();
 import chalk from "chalk";
 import * as fs from "node:fs";
 import * as path from "node:path";
@@ -180,7 +180,7 @@ export function createDefaultVaultClient(apiUrl, accessToken) {
     };
     return {
         async findCompanyBySlug(slug) {
-            const url = `${apiUrl.replace(/\/$/, "")}/v1/entities/by-slug/company/${encodeURIComponent(slug)}`;
+            const url = `${apiUrl.replace(/\/$/, "")}/entity/by-slug/company/${encodeURIComponent(slug)}`;
             const res = await fetch(url, { method: "GET", headers });
             if (res.status === 404)
                 return null;
@@ -195,7 +195,7 @@ export function createDefaultVaultClient(apiUrl, accessToken) {
             return data.entity;
         },
         async createCompanyEntity(input) {
-            const url = `${apiUrl.replace(/\/$/, "")}/v1/entities`;
+            const url = `${apiUrl.replace(/\/$/, "")}/entity`;
             const body = {
                 type: "company",
                 slug: input.slug,
@@ -213,11 +213,11 @@ export function createDefaultVaultClient(apiUrl, accessToken) {
                 // 409 means a concurrent client created it between our GET and POST —
                 // surface it as a vault error. The orchestrator is responsible for
                 // retrying GET if it wants idempotency on collisions.
-                throw new ProvisionError(1, `Vault POST /v1/entities failed: ${res.status} ${res.statusText} — ${text}`);
+                throw new ProvisionError(1, `Vault POST /entity failed: ${res.status} ${res.statusText} — ${text}`);
             }
             const data = (await res.json());
             if (!data.entity) {
-                throw new ProvisionError(1, `Vault POST /v1/entities returned ${res.status} with no entity body`);
+                throw new ProvisionError(1, `Vault POST /entity returned ${res.status} with no entity body`);
             }
             return data.entity;
         },
@@ -426,4 +426,4 @@ export function registerCloudProvisionCommands(program) {
     });
 }
 //# sourceMappingURL=cloud-provision.js.map
-//# debugId=325d7bbf-c44d-5bba-a156-072302ab1536
+//# debugId=aacb5bf2-8362-5336-b864-43296c30a1d6

package/dist/utils/cognito-session.js

@@ -19,7 +19,7 @@
  *   HQ_VAULT_API_URL           — vault-service API Gateway URL
  */
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="5a05b8ed-8366-55d1-8a6a-5d145646e527")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="147a783f-029d-547f-ba36-a1dbf8ed0f65")}catch(e){}}();
 import * as os from "os";
 import * as path from "path";
 import chalk from "chalk";
@@ -31,6 +31,14 @@ export const DEFAULT_COGNITO = {
     port: process.env.HQ_COGNITO_CALLBACK_PORT
         ? Number(process.env.HQ_COGNITO_CALLBACK_PORT)
         : 8765,
+    // Skip Cognito's Hosted UI — go straight to Google OAuth. The Cognito
+    // /oauth2/authorize endpoint honors `identity_provider` and performs an
+    // internal redirect, so the user never sees the (un-styleable) Hosted UI.
+    // Set HQ_COGNITO_IDENTITY_PROVIDER="" to fall back to the IdP picker for
+    // accounts that use email+password (admin-created users without Google).
+    identityProvider: process.env.HQ_COGNITO_IDENTITY_PROVIDER !== undefined
+        ? process.env.HQ_COGNITO_IDENTITY_PROVIDER || undefined
+        : "Google",
 };
 export const DEFAULT_VAULT_API_URL = process.env.HQ_VAULT_API_URL ??
     "https://4nfy67z28h.execute-api.us-east-1.amazonaws.com";
@@ -101,4 +109,4 @@ export async function refreshCachedSession() {
     }
 }
 //# sourceMappingURL=cognito-session.js.map
-//# debugId=5a05b8ed-8366-55d1-8a6a-5d145646e527
+//# debugId=147a783f-029d-547f-ba36-a1dbf8ed0f65

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.6.1",
+  "version": "5.6.3",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {

package/src/commands/cloud-provision.test.ts

@@ -374,7 +374,7 @@ describe("createDefaultVaultClient", () => {
     expect(out).toEqual(entity);
     // Verify request shape
     const call = fetchSpy.mock.calls[0];
-    expect(call[0]).toBe(`${apiUrl}/v1/entities`);
+    expect(call[0]).toBe(`${apiUrl}/entity`);
     expect((call[1] as RequestInit)?.method).toBe("POST");
     const body = JSON.parse(((call[1] as RequestInit)?.body as string) ?? "{}");
     expect(body).toEqual({ type: "company", slug: "indigo", name: "Indigo" });

package/src/commands/cloud-provision.ts

@@ -346,7 +346,7 @@ export function createDefaultVaultClient(
   };
   return {
     async findCompanyBySlug(slug: string): Promise<VaultEntity | null> {
-      const url = `${apiUrl.replace(/\/$/, "")}/v1/entities/by-slug/company/${encodeURIComponent(
+      const url = `${apiUrl.replace(/\/$/, "")}/entity/by-slug/company/${encodeURIComponent(
         slug,
       )}`;
       const res = await fetch(url, { method: "GET", headers });
@@ -372,7 +372,7 @@ export function createDefaultVaultClient(
       name: string;
       ownerUid?: string;
     }): Promise<VaultEntity> {
-      const url = `${apiUrl.replace(/\/$/, "")}/v1/entities`;
+      const url = `${apiUrl.replace(/\/$/, "")}/entity`;
       const body: Record<string, unknown> = {
         type: "company",
         slug: input.slug,
@@ -391,14 +391,14 @@ export function createDefaultVaultClient(
         // retrying GET if it wants idempotency on collisions.
         throw new ProvisionError(
           1,
-          `Vault POST /v1/entities failed: ${res.status} ${res.statusText} — ${text}`,
+          `Vault POST /entity failed: ${res.status} ${res.statusText} — ${text}`,
         );
       }
       const data = (await res.json()) as { entity?: VaultEntity };
       if (!data.entity) {
         throw new ProvisionError(
           1,
-          `Vault POST /v1/entities returned ${res.status} with no entity body`,
+          `Vault POST /entity returned ${res.status} with no entity body`,
         );
       }
       return data.entity;

package/src/utils/cognito-session.ts

@@ -38,6 +38,15 @@ export const DEFAULT_COGNITO: CognitoAuthConfig = {
   port: process.env.HQ_COGNITO_CALLBACK_PORT
     ? Number(process.env.HQ_COGNITO_CALLBACK_PORT)
     : 8765,
+  // Skip Cognito's Hosted UI — go straight to Google OAuth. The Cognito
+  // /oauth2/authorize endpoint honors `identity_provider` and performs an
+  // internal redirect, so the user never sees the (un-styleable) Hosted UI.
+  // Set HQ_COGNITO_IDENTITY_PROVIDER="" to fall back to the IdP picker for
+  // accounts that use email+password (admin-created users without Google).
+  identityProvider:
+    process.env.HQ_COGNITO_IDENTITY_PROVIDER !== undefined
+      ? process.env.HQ_COGNITO_IDENTITY_PROVIDER || undefined
+      : "Google",
 };
 
 export const DEFAULT_VAULT_API_URL =