@indigoai-us/hq-cli 5.62.0 → 5.62.1

package/CHANGELOG.md

@@ -2,6 +2,13 @@
 
 ## [Unreleased]
 
+## [5.62.1]
+
+### Added
+
+- **`hq db provision` / `hq db status --remote` use Cognito + vault API** to call the live control plane (`POST /v1/db/provision`, `GET /v1/db/status`). Team plan required for provision; local `status|sql|migrate` unchanged.
+
+
 ## [5.55.1]
 
 ### Fixed

package/dist/commands/db-provision.js

@@ -2,31 +2,34 @@
  * hq db provision — request remote vault DB binding (US-009).
  */
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="cecdf1ea-3f73-54c4-adc0-f11caebf1e55")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="f0d312c6-3730-5e46-b21f-c694723d0f5b")}catch(e){}}();
 import chalk from "chalk";
 import { ControlPlaneDbClient } from "../lib/db/control-plane.js";
+import { DEFAULT_VAULT_API_URL, ensureCognitoToken, } from "../utils/cognito-session.js";
+import { getCompanyUid } from "../utils/vault-api.js";
 const defaultDeps = () => ({
     async resolveCompany(slug) {
-        // Production path: resolve via vault API membership. Tests inject mocks.
-        // Keep slug as placeholder uid only when HQ_DB_MOCK_CONTROL_PLANE=1.
         if (process.env.HQ_DB_MOCK_CONTROL_PLANE === "1") {
             return { companyUid: `cmp_${slug}`, companySlug: slug };
         }
-        throw new Error("company resolution not wired in this build path — inject deps or set HQ_DB_MOCK_CONTROL_PLANE=1 for local mock");
+        const token = await ensureCognitoToken({ interactive: false });
+        const companyUid = await getCompanyUid(token, slug);
+        return { companyUid, companySlug: slug.trim().toLowerCase() };
     },
     async getAccessToken() {
         if (process.env.HQ_DB_MOCK_CONTROL_PLANE === "1") {
             return "mock-token";
         }
-        throw new Error("auth token resolution not wired — inject deps for production");
+        return ensureCognitoToken({ interactive: false });
     },
-    apiBaseUrl: process.env.HQ_API_BASE_URL ||
+    apiBaseUrl: process.env.HQ_VAULT_API_URL ||
+        process.env.HQ_API_BASE_URL ||
         process.env.HQ_CLOUD_API_URL ||
-        "https://hqapi.getindigo.ai",
+        DEFAULT_VAULT_API_URL,
 });
 export function registerDbProvisionCommand(db, depsFactory = defaultDeps) {
     db.command("provision")
-        .description("Provision (or re-bind) the company remote vault DB via HQ control plane")
+        .description("Provision (or re-bind) the company remote vault DB via HQ control plane (Team plan)")
         .requiredOption("--company <slug>", "Company slug")
         .option("--region <region>", "AWS region", "us-east-1")
         .action(async (opts) => {
@@ -64,6 +67,10 @@ export function registerDbProvisionCommand(db, depsFactory = defaultDeps) {
                 console.error(chalk.red("Error:"), "Remote vault DB requires the HQ Team plan ($500/mo).");
                 console.error(chalk.dim("Local databases still work: hq db status|sql|migrate — no Team plan required."));
             }
+            else if (status === 404 || /Unknown route|Not Found/i.test(msg)) {
+                console.error(chalk.red("Error:"), "Remote DB control plane is not available yet (routes not deployed).");
+                console.error(chalk.dim("Local hq db status|sql|migrate still work offline."));
+            }
             else {
                 console.error(chalk.red("Error:"), msg);
             }
@@ -75,4 +82,4 @@ export function registerDbProvisionCommand(db, depsFactory = defaultDeps) {
     });
 }
 //# sourceMappingURL=db-provision.js.map
-//# debugId=cecdf1ea-3f73-54c4-adc0-f11caebf1e55
+//# debugId=f0d312c6-3730-5e46-b21f-c694723d0f5b

package/dist/commands/db-status.js

@@ -3,7 +3,7 @@
  * Optionally reports remote tier when control plane returns a binding (US-009).
  */
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="8b820218-b1e5-57a2-8acd-d8e749a0d83f")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="b0f21394-45cb-572c-890b-bcdf0fc9e7d7")}catch(e){}}();
 import chalk from "chalk";
 import { ControlPlaneDbClient } from "../lib/db/control-plane.js";
 import { ensureAndStatusLocalDb, formatLocalDbStatus, } from "../lib/db/local.js";
@@ -26,19 +26,23 @@ export function registerDbStatusCommand(db) {
             // Never print remote connection material.
             console.log(formatLocalDbStatus(status));
             if (opts.remote) {
-                const companyUid = opts.companyUid || `cmp_${company}`;
-                const baseUrl = process.env.HQ_API_BASE_URL ||
-                    process.env.HQ_CLOUD_API_URL ||
-                    "https://hqapi.getindigo.ai";
+                const { DEFAULT_VAULT_API_URL, ensureCognitoToken } = await import("../utils/cognito-session.js");
+                const { getCompanyUid } = await import("../utils/vault-api.js");
                 try {
+                    const token = process.env.HQ_DB_MOCK_CONTROL_PLANE === "1"
+                        ? "mock-token"
+                        : await ensureCognitoToken({ interactive: false });
+                    const companyUid = opts.companyUid ||
+                        (process.env.HQ_DB_MOCK_CONTROL_PLANE === "1"
+                            ? `cmp_${company}`
+                            : await getCompanyUid(token, company));
+                    const baseUrl = process.env.HQ_VAULT_API_URL ||
+                        process.env.HQ_API_BASE_URL ||
+                        process.env.HQ_CLOUD_API_URL ||
+                        DEFAULT_VAULT_API_URL;
                     const client = new ControlPlaneDbClient({
                         baseUrl,
-                        getAccessToken: async () => {
-                            if (process.env.HQ_DB_MOCK_CONTROL_PLANE === "1") {
-                                return "mock-token";
-                            }
-                            throw new Error("auth required for remote status");
-                        },
+                        getAccessToken: async () => token,
                     });
                     const remote = await client.status(companyUid);
                     if (!remote.remote) {
@@ -67,4 +71,4 @@ export function registerDbStatusCommand(db) {
     });
 }
 //# sourceMappingURL=db-status.js.map
-//# debugId=8b820218-b1e5-57a2-8acd-d8e749a0d83f
+//# debugId=b0f21394-45cb-572c-890b-bcdf0fc9e7d7

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.62.0",
+  "version": "5.62.1",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {

package/src/commands/db-provision.ts

@@ -6,6 +6,11 @@ import { Command } from "commander";
 import chalk from "chalk";
 
 import { ControlPlaneDbClient } from "../lib/db/control-plane.js";
+import {
+  DEFAULT_VAULT_API_URL,
+  ensureCognitoToken,
+} from "../utils/cognito-session.js";
+import { getCompanyUid } from "../utils/vault-api.js";
 
 export interface DbProvisionCommandDeps {
   resolveCompany: (slug: string) => Promise<{ companyUid: string; companySlug: string }>;
@@ -16,25 +21,24 @@ export interface DbProvisionCommandDeps {
 
 const defaultDeps = (): DbProvisionCommandDeps => ({
   async resolveCompany(slug) {
-    // Production path: resolve via vault API membership. Tests inject mocks.
-    // Keep slug as placeholder uid only when HQ_DB_MOCK_CONTROL_PLANE=1.
     if (process.env.HQ_DB_MOCK_CONTROL_PLANE === "1") {
       return { companyUid: `cmp_${slug}`, companySlug: slug };
     }
-    throw new Error(
-      "company resolution not wired in this build path — inject deps or set HQ_DB_MOCK_CONTROL_PLANE=1 for local mock",
-    );
+    const token = await ensureCognitoToken({ interactive: false });
+    const companyUid = await getCompanyUid(token, slug);
+    return { companyUid, companySlug: slug.trim().toLowerCase() };
   },
   async getAccessToken() {
     if (process.env.HQ_DB_MOCK_CONTROL_PLANE === "1") {
       return "mock-token";
     }
-    throw new Error("auth token resolution not wired — inject deps for production");
+    return ensureCognitoToken({ interactive: false });
   },
   apiBaseUrl:
+    process.env.HQ_VAULT_API_URL ||
     process.env.HQ_API_BASE_URL ||
     process.env.HQ_CLOUD_API_URL ||
-    "https://hqapi.getindigo.ai",
+    DEFAULT_VAULT_API_URL,
 });
 
 export function registerDbProvisionCommand(
@@ -43,7 +47,7 @@ export function registerDbProvisionCommand(
 ): void {
   db.command("provision")
     .description(
-      "Provision (or re-bind) the company remote vault DB via HQ control plane",
+      "Provision (or re-bind) the company remote vault DB via HQ control plane (Team plan)",
     )
     .requiredOption("--company <slug>", "Company slug")
     .option("--region <region>", "AWS region", "us-east-1")
@@ -90,6 +94,14 @@ export function registerDbProvisionCommand(
               "Local databases still work: hq db status|sql|migrate — no Team plan required.",
             ),
           );
+        } else if (status === 404 || /Unknown route|Not Found/i.test(msg)) {
+          console.error(
+            chalk.red("Error:"),
+            "Remote DB control plane is not available yet (routes not deployed).",
+          );
+          console.error(
+            chalk.dim("Local hq db status|sql|migrate still work offline."),
+          );
         } else {
           console.error(chalk.red("Error:"), msg);
         }

package/src/commands/db-status.ts

@@ -55,20 +55,28 @@ export function registerDbStatusCommand(db: Command): void {
           console.log(formatLocalDbStatus(status));
 
           if (opts.remote) {
-            const companyUid = opts.companyUid || `cmp_${company}`;
-            const baseUrl =
-              process.env.HQ_API_BASE_URL ||
-              process.env.HQ_CLOUD_API_URL ||
-              "https://hqapi.getindigo.ai";
+            const { DEFAULT_VAULT_API_URL, ensureCognitoToken } = await import(
+              "../utils/cognito-session.js"
+            );
+            const { getCompanyUid } = await import("../utils/vault-api.js");
             try {
+              const token =
+                process.env.HQ_DB_MOCK_CONTROL_PLANE === "1"
+                  ? "mock-token"
+                  : await ensureCognitoToken({ interactive: false });
+              const companyUid =
+                opts.companyUid ||
+                (process.env.HQ_DB_MOCK_CONTROL_PLANE === "1"
+                  ? `cmp_${company}`
+                  : await getCompanyUid(token, company));
+              const baseUrl =
+                process.env.HQ_VAULT_API_URL ||
+                process.env.HQ_API_BASE_URL ||
+                process.env.HQ_CLOUD_API_URL ||
+                DEFAULT_VAULT_API_URL;
               const client = new ControlPlaneDbClient({
                 baseUrl,
-                getAccessToken: async () => {
-                  if (process.env.HQ_DB_MOCK_CONTROL_PLANE === "1") {
-                    return "mock-token";
-                  }
-                  throw new Error("auth required for remote status");
-                },
+                getAccessToken: async () => token,
               });
               const remote = await client.status(companyUid);
               if (!remote.remote) {