@indigoai-us/hq-cli 5.77.11 → 5.77.13

package/dist/commands/secrets.js

@@ -8,8 +8,14 @@ import { computeSha256 } from "../utils/integrity.js";
 import { SECRET_NAME_PATTERN, GROUP_ID_PATTERN, EMAIL_PATTERN } from "./_patterns.js";
 import { describeSecretsScope, formatSecretSaved, formatSecretsListEmpty, formatSecretsListHeader, } from "./secrets-scope.js";
 import { vaultApiFetch, getCompanyUid, getEntityUid, } from "../utils/vault-api.js";
+import { HQ_API_KEY_PREFIX, assertCognitoOnlyCommand, resolveVaultCredential, } from "../utils/resolve-vault-credential.js";
 import { SandboxRunnerClient, } from "../utils/sandbox-runner-client.js";
 export { vaultApiFetch, getCompanyUid, getEntityUid };
+/** Cognito session for secrets commands that do not support HQ_API_KEY. */
+async function requireCognitoTokenForSecrets(commandLabel) {
+    assertCognitoOnlyCommand(commandLabel);
+    return ensureCognitoToken();
+}
 function scopeOpts(opts) {
     if (opts.personal && opts.company) {
         console.error(chalk.red("Error: --personal cannot be combined with --company."));
@@ -424,7 +430,54 @@ function renderPolicyScripts(scripts) {
 // Requests are chunked at MAX_BATCH_NAMES and throw on the FIRST unresolved key
 // with the same `Failed to fetch secret '<k>': <reason>` shape the per-key GET
 // path used — never swallows a failure.
+async function loadRevealedSecretsViaApiKey(token, keys) {
+    const resolved = new Map();
+    const requested = [...new Set(keys)];
+    const cacheScope = "__api_key__";
+    for (const name of requested) {
+        const res = await vaultApiFetch({
+            token,
+            path: "/v1/keys/secrets/fetch",
+            method: "POST",
+            body: { name },
+            signal: AbortSignal.timeout(SECRET_LOAD_TIMEOUT_MS),
+        });
+        const body = (await res.json().catch(() => ({})));
+        if (!res.ok) {
+            if (res.status === 404) {
+                throw new Error(`Failed to fetch secret '${name}': Secret not found`);
+            }
+            if (res.status === 403) {
+                const message = typeof body.error === "string"
+                    ? body.error
+                    : typeof body.message === "string"
+                        ? body.message
+                        : "No read permission";
+                if (body.highSecurity === true) {
+                    throw new Error(highSecuritySandboxOnlyMessage(name));
+                }
+                throw new Error(`Failed to fetch secret '${name}': ${message}`);
+            }
+            if (res.status === 401) {
+                throw new Error(`Failed to fetch secret '${name}': Invalid or missing API key`);
+            }
+            throw new Error(`Failed to fetch secret '${name}': ${extractApiMessage(body, res.statusText)}`);
+        }
+        const secret = typeof body.secret === "object" && body.secret !== null
+            ? body.secret
+            : null;
+        if (typeof secret?.value !== "string") {
+            throw new Error(`Failed to fetch secret '${name}': malformed fetch response`);
+        }
+        removeCacheEntry(cacheScope, name);
+        resolved.set(name, secret.value);
+    }
+    return resolved;
+}
 export async function loadRevealedSecrets(token, companyUid, keys, usage) {
+    if (token.startsWith(HQ_API_KEY_PREFIX)) {
+        return loadRevealedSecretsViaApiKey(token, keys);
+    }
     const resolved = new Map();
     const requested = [...new Set(keys)];
     try {
@@ -632,7 +685,7 @@ export function registerSecretsCommand(program) {
                 console.error(chalk.red(`Secret value exceeds 4096-byte SSM limit (got ${Buffer.byteLength(value, "utf8")} bytes).`));
                 process.exit(1);
             }
-            const token = await ensureCognitoToken();
+            const token = await requireCognitoTokenForSecrets("secrets set");
             const scope = scopeOpts(secrets.opts());
             const companyUid = await getEntityUid(token, scope);
             const scopeLabel = describeSecretsScope({
@@ -677,7 +730,52 @@ export function registerSecretsCommand(program) {
         .option("--reveal", "Include the decrypted secret value")
         .action(async (name, opts) => {
         try {
-            const token = await ensureCognitoToken();
+            const cred = await resolveVaultCredential();
+            if (cred.kind === "api-key") {
+                const res = await vaultApiFetch({
+                    token: cred.token,
+                    path: "/v1/keys/secrets/fetch",
+                    method: "POST",
+                    body: { name },
+                });
+                const body = (await res.json().catch(() => ({})));
+                if (!res.ok) {
+                    if (res.status === 403 && body.highSecurity === true) {
+                        console.error(chalk.red(highSecuritySandboxOnlyMessage(name)));
+                        process.exit(1);
+                    }
+                    console.error(chalk.red(`Failed to get secret: ${extractApiMessage(body, res.statusText)}`));
+                    process.exit(1);
+                }
+                const secret = typeof body.secret === "object" && body.secret !== null
+                    ? body.secret
+                    : null;
+                if (!secret || typeof secret.name !== "string") {
+                    console.error(chalk.red("Failed to get secret: malformed response"));
+                    process.exit(1);
+                }
+                console.log(chalk.bold(`Secret: ${secret.name}`));
+                if (secret.lastModifiedDate) {
+                    console.log(`  Last Modified: ${secret.lastModifiedDate}`);
+                }
+                if (secret.version != null) {
+                    console.log(`  Version:       ${secret.version}`);
+                }
+                console.log(`  Tier:          ${normalizeSecretTier(secret.tier)}`);
+                console.log(`  Script Lock:   ${normalizeScriptLockMode(secret.scriptLock?.mode)}`);
+                if (opts.reveal) {
+                    if (typeof secret.value !== "string") {
+                        console.error(chalk.red("Failed to get secret: reveal requested but response omitted secret.value"));
+                        process.exit(1);
+                    }
+                    console.log(`  Value:         ${secret.value}`);
+                }
+                else {
+                    console.log(`  Value:         ${chalk.dim("[REDACTED]")}`);
+                }
+                return;
+            }
+            const token = cred.token;
             const companyUid = await getEntityUid(token, scopeOpts(secrets.opts()));
             const res = await vaultApiFetch({
                 token,
@@ -748,7 +846,7 @@ export function registerSecretsCommand(program) {
         .option("--quiet", "Suppress the present/absent line (use the exit code only)")
         .action(async (name, opts) => {
         try {
-            const token = await ensureCognitoToken();
+            const token = await requireCognitoTokenForSecrets("secrets exists");
             const companyUid = await getEntityUid(token, scopeOpts(secrets.opts()));
             const res = await vaultApiFetch({
                 token,
@@ -791,7 +889,7 @@ export function registerSecretsCommand(program) {
                 }
                 normalizedPrefix = normalized;
             }
-            const token = await ensureCognitoToken();
+            const token = await requireCognitoTokenForSecrets("secrets list");
             const scope = scopeOpts(secrets.opts());
             const companyUid = await getEntityUid(token, scope);
             const scopeLabel = describeSecretsScope({
@@ -865,7 +963,7 @@ export function registerSecretsCommand(program) {
                 console.error(chalk.red(`Invalid secret path '${secretPath}': must match ^[A-Z][A-Z0-9_]*(/[A-Z][A-Z0-9_]+)*$ (e.g. MY_KEY or PROD/DB_PASSWORD)`));
                 process.exit(1);
             }
-            const token = await ensureCognitoToken();
+            const token = await requireCognitoTokenForSecrets("secrets");
             const companyUid = await getEntityUid(token, scopeOpts(secrets.opts()));
             const res = await vaultApiFetch({
                 token,
@@ -926,7 +1024,7 @@ export function registerSecretsCommand(program) {
                 console.error(chalk.red("Error: provide at least one of --tier or --lock-script."));
                 process.exit(1);
             }
-            const token = await ensureCognitoToken();
+            const token = await requireCognitoTokenForSecrets("secrets");
             const companyUid = await getEntityUid(token, scopeOpts(secrets.opts()));
             const res = await vaultApiFetch({
                 token,
@@ -971,7 +1069,7 @@ export function registerSecretsCommand(program) {
                 process.exit(1);
             }
             const usage = await buildSecretUsage("exec", opts.script, opts.id, opts.attestation);
-            const token = await ensureCognitoToken();
+            const token = await requireCognitoTokenForSecrets("secrets");
             const companyUid = await getEntityUid(token, scopeOpts(secrets.opts()));
             const res = await vaultApiFetch({
                 token,
@@ -1009,7 +1107,7 @@ export function registerSecretsCommand(program) {
                 console.error(chalk.red(`Invalid secret path '${secretPath}': must match ^[A-Z][A-Z0-9_]*(/[A-Z][A-Z0-9_]+)*$ (e.g. MY_KEY or PROD/DB_PASSWORD)`));
                 process.exit(1);
             }
-            const token = await ensureCognitoToken();
+            const token = await requireCognitoTokenForSecrets("secrets");
             const companyUid = await getEntityUid(token, scopeOpts(secrets.opts()));
             const res = await vaultApiFetch({
                 token,
@@ -1040,7 +1138,7 @@ export function registerSecretsCommand(program) {
                 console.error(chalk.red(`Invalid secret path '${secretPath}': must match ^[A-Z][A-Z0-9_]*(/[A-Z][A-Z0-9_]+)*$ (e.g. MY_KEY or PROD/DB_PASSWORD)`));
                 process.exit(1);
             }
-            const token = await ensureCognitoToken();
+            const token = await requireCognitoTokenForSecrets("secrets");
             const companyUid = await getEntityUid(token, scopeOpts(secrets.opts()));
             const res = await vaultApiFetch({
                 token,
@@ -1087,7 +1185,7 @@ export function registerSecretsCommand(program) {
                     return;
                 }
             }
-            const token = await ensureCognitoToken();
+            const token = await requireCognitoTokenForSecrets("secrets");
             const companyUid = await getEntityUid(token, scopeOpts(secrets.opts()));
             const res = await vaultApiFetch({
                 token,
@@ -1131,7 +1229,7 @@ export function registerSecretsCommand(program) {
                 process.exit(1);
             }
             const keys = parseSecretNameList(opts.only);
-            const token = await ensureCognitoToken();
+            const token = await requireCognitoTokenForSecrets("secrets");
             const scope = scopeOpts(mergeScopeOpts(secrets.opts(), opts));
             const companyUid = await getEntityUid(token, scope);
             const client = new SandboxRunnerClient();
@@ -1184,9 +1282,13 @@ export function registerSecretsCommand(program) {
                 process.exit(1);
             }
             const keys = parseSecretNameList(_opts.only);
-            const token = await ensureCognitoToken();
-            const companyUid = await getEntityUid(token, scopeOpts(secrets.opts()));
-            const revealed = await loadRevealedSecrets(token, companyUid, keys, await buildSecretUsage("exec", _opts.script, _opts.scriptId));
+            const cred = await resolveVaultCredential();
+            const companyUid = cred.kind === "api-key"
+                ? "__api_key__"
+                : await getEntityUid(cred.token, scopeOpts(secrets.opts()));
+            const revealed = await loadRevealedSecrets(cred.token, companyUid, keys, cred.kind === "cognito"
+                ? await buildSecretUsage("exec", _opts.script, _opts.scriptId)
+                : undefined);
             const secretEnv = {};
             for (const key of keys) {
                 const value = revealed.get(key);
@@ -1231,9 +1333,13 @@ export function registerSecretsCommand(program) {
                 console.error(chalk.yellow("stdout is a terminal — values redacted. Use: source <(hq secrets env --only KEY1,KEY2)"));
             }
             const keys = parseSecretNameList(opts.only);
-            const token = await ensureCognitoToken();
-            const companyUid = await getEntityUid(token, scopeOpts(secrets.opts()));
-            const revealed = await loadRevealedSecrets(token, companyUid, keys, await buildSecretUsage("env", opts.script, opts.scriptId));
+            const cred = await resolveVaultCredential();
+            const companyUid = cred.kind === "api-key"
+                ? "__api_key__"
+                : await getEntityUid(cred.token, scopeOpts(secrets.opts()));
+            const revealed = await loadRevealedSecrets(cred.token, companyUid, keys, cred.kind === "cognito"
+                ? await buildSecretUsage("env", opts.script, opts.scriptId)
+                : undefined);
             for (const key of keys) {
                 const value = revealed.get(key);
                 // loadRevealedSecrets throws on any unresolved key, so a miss here is
@@ -1270,7 +1376,7 @@ export function registerSecretsCommand(program) {
                 console.error(chalk.red("Maximum expiry is 7 days (7d)."));
                 process.exit(1);
             }
-            const token = await ensureCognitoToken();
+            const token = await requireCognitoTokenForSecrets("secrets");
             const companyUid = await getEntityUid(token, scopeOpts(secrets.opts()));
             const res = await vaultApiFetch({
                 token,
@@ -1316,7 +1422,7 @@ export function registerSecretsCommand(program) {
             if (!principal) {
                 process.exit(1);
             }
-            const token = await ensureCognitoToken();
+            const token = await requireCognitoTokenForSecrets("secrets");
             const companyUid = await getEntityUid(token, scopeOpts(secrets.opts()));
             const res = await vaultApiFetch({
                 token,
@@ -1373,7 +1479,7 @@ export function registerSecretsCommand(program) {
             if (!principal) {
                 process.exit(1);
             }
-            const token = await ensureCognitoToken();
+            const token = await requireCognitoTokenForSecrets("secrets");
             const companyUid = await getEntityUid(token, scopeOpts(secrets.opts()));
             const res = await vaultApiFetch({
                 token,
@@ -1422,7 +1528,7 @@ export function registerSecretsCommand(program) {
                 console.error(chalk.red(`Invalid secret path '${path}': must match ^[A-Z][A-Z0-9_]*(/[A-Z][A-Z0-9_]+)*$ (e.g. MY_KEY or PROD/DB_PASSWORD)`));
                 process.exit(1);
             }
-            const token = await ensureCognitoToken();
+            const token = await requireCognitoTokenForSecrets("secrets");
             const companyUid = await getEntityUid(token, scopeOpts(secrets.opts()));
             const secretPath = path;
             const res = await vaultApiFetch({

package/dist/outpost/session-heartbeat-publisher.d.ts

@@ -0,0 +1,76 @@
+/**
+ * Outpost on-box realtime publisher — mission-control US-009.
+ *
+ * The box already holds a Cognito session (seeded from the caller's refresh
+ * token in user-data, kept fresh by the box's auth timers — see provision.ts).
+ * This module turns that session into a `PublishPort` for the session-heartbeat
+ * emitter using the EXACT on-box credential pattern the rest of the realtime
+ * fabric uses (docs/realtime-fabric.md):
+ *
+ *   1. POST {HQAPI}/v1/realtime/credentials with the box's Cognito JWT.
+ *      The Lambda resolves the caller's `personUid` from the verified JWT
+ *      (never request input) and vends short-lived STS creds whose session
+ *      policy scopes `iot:Connect/Publish/...` to `hq/{personUid}/*` only.
+ *   2. SigV4-sign an IoT Data-plane publish with those creds to
+ *      `hq/{personUid}/sessions`.
+ *
+ * No new auth surface, no embedded long-lived key, no per-device cert — the
+ * per-identity STS session policy is the isolation boundary (US-010).
+ *
+ * The HTTP fetch + IoT client are injected so this is unit-testable without a
+ * live endpoint; `defaultRealtimeCredentialsFetcher` and the IoT publish are
+ * the production wiring.
+ */
+import { IoTDataPlaneClient } from "@aws-sdk/client-iot-data-plane";
+import type { PublishPort } from "./session-heartbeat.js";
+import { sessionsTopicForPerson } from "./session-heartbeat.js";
+/** Shape returned by `POST /v1/realtime/credentials` (mirrors the handler). */
+export interface RealtimeCredentialsResponse {
+    credentials: {
+        accessKeyId: string;
+        secretAccessKey: string;
+        sessionToken: string;
+        expiration: string;
+    };
+    iotEndpoint: string;
+    region: string;
+    /** The caller's own topic — `hq/{personUid}/...`. */
+    topic: string;
+    expiresAt: string;
+}
+/** Fetches scoped realtime credentials for the box. Injected for tests. */
+export type RealtimeCredentialsFetcher = () => Promise<RealtimeCredentialsResponse>;
+/** Ceiling on a single credentials request. */
+export declare const DEFAULT_CREDENTIALS_TIMEOUT_MS = 10000;
+/**
+ * Build the production credentials fetcher. Reads the box's current Cognito
+ * id/access token via the injected `getJwt` and POSTs it to the
+ * realtime-credentials endpoint.
+ */
+export declare function defaultRealtimeCredentialsFetcher(opts: {
+    apiBaseUrl: string;
+    getJwt: () => Promise<string>;
+    fetchImpl?: typeof fetch;
+    /** Bound the request. Defaults to {@link DEFAULT_CREDENTIALS_TIMEOUT_MS}. */
+    timeoutMs?: number;
+}): RealtimeCredentialsFetcher;
+/**
+ * Create a `PublishPort` that vends scoped creds (refreshing before expiry) and
+ * publishes the compact payload to the box's own sessions topic over MQTT/IoT.
+ *
+ * @param fetchCredentials  vends per-identity-scoped STS creds + IoT endpoint
+ * @param makeClient        builds an IoT client from creds (injected for tests)
+ * @param now               clock injection
+ */
+export declare function createIotPublishPort(opts: {
+    fetchCredentials: RealtimeCredentialsFetcher;
+    makeClient?: (args: {
+        endpoint: string;
+        region: string;
+        credentials: RealtimeCredentialsResponse["credentials"];
+    }) => IoTDataPlaneClient;
+    now?: () => Date;
+}): PublishPort;
+/** Re-export for the runner so it imports one module. */
+export { sessionsTopicForPerson };
+//# sourceMappingURL=session-heartbeat-publisher.d.ts.map

package/dist/outpost/session-heartbeat-publisher.js

@@ -0,0 +1,117 @@
+/**
+ * Outpost on-box realtime publisher — mission-control US-009.
+ *
+ * The box already holds a Cognito session (seeded from the caller's refresh
+ * token in user-data, kept fresh by the box's auth timers — see provision.ts).
+ * This module turns that session into a `PublishPort` for the session-heartbeat
+ * emitter using the EXACT on-box credential pattern the rest of the realtime
+ * fabric uses (docs/realtime-fabric.md):
+ *
+ *   1. POST {HQAPI}/v1/realtime/credentials with the box's Cognito JWT.
+ *      The Lambda resolves the caller's `personUid` from the verified JWT
+ *      (never request input) and vends short-lived STS creds whose session
+ *      policy scopes `iot:Connect/Publish/...` to `hq/{personUid}/*` only.
+ *   2. SigV4-sign an IoT Data-plane publish with those creds to
+ *      `hq/{personUid}/sessions`.
+ *
+ * No new auth surface, no embedded long-lived key, no per-device cert — the
+ * per-identity STS session policy is the isolation boundary (US-010).
+ *
+ * The HTTP fetch + IoT client are injected so this is unit-testable without a
+ * live endpoint; `defaultRealtimeCredentialsFetcher` and the IoT publish are
+ * the production wiring.
+ */
+import { IoTDataPlaneClient, PublishCommand, } from "@aws-sdk/client-iot-data-plane";
+import { assertNoSecretsInPayload, sessionsTopicForPerson, } from "./session-heartbeat.js";
+/** Ceiling on a single credentials request. */
+export const DEFAULT_CREDENTIALS_TIMEOUT_MS = 10_000;
+/**
+ * Build the production credentials fetcher. Reads the box's current Cognito
+ * id/access token via the injected `getJwt` and POSTs it to the
+ * realtime-credentials endpoint.
+ */
+export function defaultRealtimeCredentialsFetcher(opts) {
+    const doFetch = opts.fetchImpl ?? fetch;
+    return async () => {
+        const jwt = await opts.getJwt();
+        const res = await doFetch(`${opts.apiBaseUrl}/v1/realtime/credentials`, {
+            method: "POST",
+            // Bounded. An endpoint that accepts the connection but never answers
+            // would otherwise park the tick forever: the loop stops beating, the
+            // liveness marker goes stale, and SIGTERM cannot finish the in-flight
+            // tick — a hang that reads exactly like a healthy quiet box.
+            signal: AbortSignal.timeout(opts.timeoutMs ?? DEFAULT_CREDENTIALS_TIMEOUT_MS),
+            headers: {
+                authorization: `Bearer ${jwt}`,
+                "content-type": "application/json",
+            },
+        });
+        if (!res.ok) {
+            throw new Error(`realtime/credentials returned ${res.status} ${res.statusText}`);
+        }
+        return (await res.json());
+    };
+}
+/**
+ * Create a `PublishPort` that vends scoped creds (refreshing before expiry) and
+ * publishes the compact payload to the box's own sessions topic over MQTT/IoT.
+ *
+ * @param fetchCredentials  vends per-identity-scoped STS creds + IoT endpoint
+ * @param makeClient        builds an IoT client from creds (injected for tests)
+ * @param now               clock injection
+ */
+export function createIotPublishPort(opts) {
+    const now = opts.now ?? (() => new Date());
+    const makeClient = opts.makeClient ??
+        (({ endpoint, region, credentials }) => {
+            const url = endpoint.startsWith("http")
+                ? endpoint
+                : `https://${endpoint}`;
+            return new IoTDataPlaneClient({
+                endpoint: url,
+                region,
+                credentials: {
+                    accessKeyId: credentials.accessKeyId,
+                    secretAccessKey: credentials.secretAccessKey,
+                    sessionToken: credentials.sessionToken,
+                },
+            });
+        });
+    let cached = null;
+    // Refresh creds this many ms before they actually expire so a publish never
+    // races expiry mid-flight.
+    const REFRESH_SKEW_MS = 60_000;
+    async function clientFor() {
+        const nowMs = now().getTime();
+        if (cached && cached.expiresAtMs - REFRESH_SKEW_MS > nowMs) {
+            return { client: cached.client };
+        }
+        const vended = await opts.fetchCredentials();
+        const client = makeClient({
+            endpoint: vended.iotEndpoint,
+            region: vended.region,
+            credentials: vended.credentials,
+        });
+        cached = {
+            client,
+            endpoint: vended.iotEndpoint,
+            accessKeyId: vended.credentials.accessKeyId,
+            expiresAtMs: Date.parse(vended.credentials.expiration),
+        };
+        return { client };
+    }
+    return async (topic, payload) => {
+        // Re-guard at the transport boundary — a publisher must never ship a
+        // payload that fails the no-secrets contract, regardless of caller.
+        assertNoSecretsInPayload(payload);
+        const { client } = await clientFor();
+        await client.send(new PublishCommand({
+            topic,
+            qos: 0,
+            payload: Buffer.from(JSON.stringify(payload)),
+        }));
+    };
+}
+/** Re-export for the runner so it imports one module. */
+export { sessionsTopicForPerson };
+//# sourceMappingURL=session-heartbeat-publisher.js.map