@indigoai-us/hq-cloud 6.3.5 → 6.3.6
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/bin/sync-runner.d.ts +16 -8
- package/dist/bin/sync-runner.d.ts.map +1 -1
- package/dist/bin/sync-runner.js +28 -40
- package/dist/bin/sync-runner.js.map +1 -1
- package/dist/bin/sync-runner.test.js +24 -24
- package/dist/bin/sync-runner.test.js.map +1 -1
- package/dist/sync/event-sync.d.ts +3 -2
- package/dist/sync/event-sync.d.ts.map +1 -1
- package/dist/sync/event-sync.js +3 -2
- package/dist/sync/event-sync.js.map +1 -1
- package/package.json +1 -1
- package/src/bin/sync-runner.test.ts +24 -28
- package/src/bin/sync-runner.ts +28 -39
- package/src/sync/event-sync.ts +3 -2
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"event-sync.js","sourceRoot":"","sources":["../../src/sync/event-sync.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,OAAO,EACL,SAAS,EACT,qBAAqB,EACrB,oBAAoB,GACrB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EAAE,iBAAiB,EAAwB,MAAM,qBAAqB,CAAC;AAC9E,OAAO,EACL,eAAe,GAIhB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAGjD,+EAA+E;AAE/E
|
|
1
|
+
{"version":3,"file":"event-sync.js","sourceRoot":"","sources":["../../src/sync/event-sync.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,OAAO,EACL,SAAS,EACT,qBAAqB,EACrB,oBAAoB,GACrB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EAAE,iBAAiB,EAAwB,MAAM,qBAAqB,CAAC;AAC9E,OAAO,EACL,eAAe,GAIhB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAGjD,+EAA+E;AAE/E;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAwB,IAAI,GAAG,CAAC;IACpE,sBAAsB;CACvB,CAAC,CAAC;AAEH;;;;;;;;;GASG;AACH,MAAM,UAAU,gBAAgB,CAC9B,KAAyB,EACzB,QAA4B;IAE5B,MAAM,CAAC,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAChD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACxE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,OAAO,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,KAAK;QAAE,OAAO,KAAK,CAAC;IAC1E,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5C,OAAO,yBAAyB,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;AACnE,CAAC;AAgCD,SAAS,gBAAgB,CAAC,CAAU,EAAE,KAAa;IACjD,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CAAC,0CAA0C,KAAK,EAAE,CAAC,CAAC;IACrE,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,IAM1C;IACC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC/C,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC;IAC3B,MAAM,KAAK,GAAG,OAAO,GAAG,KAAK,UAAU,CAAC,CAAC,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;IAC5D,MAAM,SAAS,GACb,IAAI,CAAC,SAAS;QACd,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAE,UAAU,CAAC,KAA8B,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;IAE7E,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,OAAO,GAAG,UAAU,CACxB,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EACxB,IAAI,CAAC,SAAS,IAAI,MAAM,CACzB,CAAC;IACF,IAAI,GAAmC,CAAC;IACxC,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,MAAM,oBAAoB,EAAE;YACnD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,KAAK,EAAE;gBAChC,cAAc,EAAE,kBAAkB;aACnC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC;YACjD,MAAM,EAAE,UAAU,CAAC,MAAM;SAC1B,CAAC,CAAC;IACL,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,OAAO,CAAC,CAAC;IACxB,CAAC;IAED,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QAC9C,MAAM,IAAI,KAAK,CACb,yDAAyD,GAAG,CAAC,MAAM,MAAM,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAC9F,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IACrD,MAAM,GAAG,GAAG,MAAiC,CAAC;IAC9C,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,WAAW,IAAI,EAAE,CAA4B,CAAC;IACjE,OAAO;QACL,QAAQ,EAAE,gBAAgB,CAAC,GAAG,CAAC,QAAQ,EAAE,UAAU,CAAC;QACpD,MAAM,EAAE,gBAAgB,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC;QAC9C,WAAW,EAAE;YACX,WAAW,EAAE,gBAAgB,CAAC,KAAK,CAAC,WAAW,EAAE,yBAAyB,CAAC;YAC3E,eAAe,EAAE,gBAAgB,CAC/B,KAAK,CAAC,eAAe,EACrB,6BAA6B,CAC9B;YACD,YAAY,EAAE,gBAAgB,CAC5B,KAAK,CAAC,YAAY,EAClB,0BAA0B,CAC3B;YACD,UAAU,EAAE,gBAAgB,CAAC,KAAK,CAAC,UAAU,EAAE,wBAAwB,CAAC;SACzE;KACF,CAAC;AACJ,CAAC;AAED,+EAA+E;AAE/E;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CACjC,MAA+B;IAE/B,OAAO;QACL,KAAK,CAAC,cAAc,CAAC,EAAE,QAAQ,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,EAAE;YACrE,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,IAAI,CAC3B,IAAI,qBAAqB,CAAC;gBACxB,QAAQ,EAAE,QAAQ;gBAClB,mBAAmB,EAAE,WAAW;gBAChC,eAAe,EAAE,eAAe;aACjC,CAAC,EACF,EAAE,WAAW,EAAE,MAAM,EAAE,CACxB,CAAC;YACF,OAAO;gBACL,QAAQ,EAAE,CAAC,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;oBACzC,IAAI,EAAE,CAAC,CAAC,IAAI;oBACZ,aAAa,EAAE,CAAC,CAAC,aAAa;oBAC9B,SAAS,EAAE,CAAC,CAAC,SAAS;iBACvB,CAAC,CAAC;aACJ,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,aAAa,CAAC,EAAE,QAAQ,EAAE,aAAa,EAAE;YAC7C,MAAM,MAAM,CAAC,IAAI,CACf,IAAI,oBAAoB,CAAC;gBACvB,QAAQ,EAAE,QAAQ;gBAClB,aAAa,EAAE,aAAa;aAC7B,CAAC,CACH,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,+EAA+E;AAE/E;;;;GAIG;AACH,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC;IACjC,cAAc;IACd,uBAAuB;IACvB,sBAAsB;IACtB,sBAAsB;IACtB,6BAA6B;CAC9B,CAAC,CAAC;AAEH,SAAS,aAAa,CAAC,GAAY;IACjC,OAAO,GAAG,YAAY,KAAK,IAAI,kBAAkB,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AAClE,CAAC;AAED,+EAA+E;AAC/E,MAAM,eAAe,GAAG,OAAO,CAAC;AAgBhC,SAAS,eAAe,CAAC,IAA2B;IAClD,OAAO,mBAAmB,CACxB,IAAI,SAAS,CAAC;QACZ,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,WAAW,EAAE;YACX,WAAW,EAAE,IAAI,CAAC,WAAW,CAAC,WAAW;YACzC,eAAe,EAAE,IAAI,CAAC,WAAW,CAAC,eAAe;YACjD,YAAY,EAAE,IAAI,CAAC,WAAW,CAAC,YAAY;YAC3C,UAAU,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC;SAClD;KACF,CAAC,CACH,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,yBAAyB,CACvC,IAAgC;IAEhC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAC3C,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,eAAe,CAAC;IAElD,IAAI,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACnC,IAAI,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;IAClE,IAAI,UAAU,GAAyB,IAAI,CAAC;IAE5C,MAAM,OAAO,GAAG,GAAkB,EAAE;QAClC,UAAU,KAAK,CAAC,KAAK,IAAI,EAAE;YACzB,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;gBACpC,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;gBACvB,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;YACxD,CAAC;oBAAS,CAAC;gBACT,UAAU,GAAG,IAAI,CAAC;YACpB,CAAC;QACH,CAAC,CAAC,EAAE,CAAC;QACL,OAAO,UAAU,CAAC;IACpB,CAAC,CAAC;IAEF,MAAM,WAAW,GAAG,KAAK,IAAmB,EAAE;QAC5C,IAAI,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,GAAG,EAAE,IAAI,WAAW,GAAG,eAAe,EAAE,CAAC;YAC3E,MAAM,OAAO,EAAE,CAAC;QAClB,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,SAAS,GAAG,KAAK,EAAK,IAAsB,EAAc,EAAE;QAChE,MAAM,WAAW,EAAE,CAAC;QACpB,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,EAAE,CAAC;QACtB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC;gBAAE,MAAM,GAAG,CAAC;YACnC,MAAM,OAAO,EAAE,CAAC;YAChB,OAAO,MAAM,IAAI,EAAE,CAAC;QACtB,CAAC;IACH,CAAC,CAAC;IAEF,OAAO;QACL,cAAc,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;QACrE,aAAa,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;KACpE,CAAC;AACJ,CAAC;AAoDD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,IAA2B;IAE3B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1D,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC;QAC9C,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QAE/B,6BAA6B;QAC7B,MAAM,SAAS,GACb,IAAI,CAAC,SAAS;YACd,IAAI,iBAAiB,CAAC;gBACpB,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,QAAQ,EAAE,eAAe;gBACzB,SAAS,EAAE,IAAI,CAAC,SAAS;aAC1B,CAAC,CAAC;QACL,MAAM,SAAS,CAAC,KAAK,EAAE,CAAC;QACxB,MAAM,OAAO,GAAG,IAAI,gBAAgB,CAAC;YACnC,cAAc,EAAE,QAAQ;YACxB,cAAc,EAAE,QAAQ;YACxB,SAAS;YACT,uEAAuE;YACvE,wEAAwE;YACxE,YAAY,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE;YACvC,kEAAkE;YAClE,oEAAoE;YACpE,qEAAqE;YACrE,sEAAsE;YACtE,6DAA6D;YAC7D,iBAAiB,EAAE,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE;YACjD,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CACpB,GAAG,CACD,kCAAkC,GAAG,CAAC,YAAY,IAAI,GAAG,KAAK,GAAG,CAAC,OAAO,EAAE,CAC5E;SACJ,CAAC,CAAC;QAEH,6BAA6B;QAC7B,MAAM,SAAS,GACb,IAAI,CAAC,SAAS;YACd,CAAC,CAAC,GAAW,EAAE,EAAE,CACf,oBAAoB,CAAC;gBACnB,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,QAAQ,EAAE,GAAG;aACd,CAAC,CAAC,CAAC;QACR,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,QAAQ,CAAC,CAAC;QAC1C,MAAM,GAAG,GAAG,yBAAyB,CAAC;YACpC,OAAO;YACP,SAAS,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC;YACpC,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,GAAG,EAAE,IAAI,CAAC,GAAG;SACd,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,IAAI,eAAe,CAAC;YACnC,QAAQ;YACR,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,GAAG;YACH,mEAAmE;YACnE,sEAAsE;YACtE,8DAA8D;YAC9D,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;gBACpB,IAAI,GAAG,CAAC,KAAK,CAAC,cAAc,KAAK,QAAQ;oBAAE,OAAO;gBAClD,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACzB,CAAC;YACD,sEAAsE;YACtE,sEAAsE;YACtE,OAAO,EAAE,IAAI;SACd,CAAC,CAAC;QACH,MAAM,QAAQ,CAAC,KAAK,EAAE,CAAC;QAEvB,GAAG,CACD,4BAA4B,QAAQ,WAAW,QAAQ,UAAU,OAAO,CAAC,QAAQ,GAAG,CACrF,CAAC;QAEF,OAAO;YACL,YAAY,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC;YACzD,QAAQ;YACR,WAAW,EAAE,QAAQ;YACrB,OAAO,EAAE,KAAK,IAAI,EAAE;gBAClB,MAAM,QAAQ,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;gBAChD,MAAM,SAAS,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YACnD,CAAC;SACF,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CACD,qDAAqD,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CACxG,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}
|
package/package.json
CHANGED
|
@@ -3168,54 +3168,50 @@ describe("resolveSkipPersonal", () => {
|
|
|
3168
3168
|
});
|
|
3169
3169
|
|
|
3170
3170
|
// ---------------------------------------------------------------------------
|
|
3171
|
-
// resolvePresignTransport —
|
|
3171
|
+
// resolvePresignTransport — GA default-on + env override
|
|
3172
|
+
//
|
|
3173
|
+
// As of GA (2026-06-11) the presigned-URL transport is the default for every
|
|
3174
|
+
// account; the former per-domain rollout gate is gone. The env override is now
|
|
3175
|
+
// the only thing that changes the answer, and it is the emergency rollback
|
|
3176
|
+
// lever, so it gets the bulk of the coverage below.
|
|
3172
3177
|
// ---------------------------------------------------------------------------
|
|
3173
3178
|
|
|
3174
3179
|
describe("resolvePresignTransport", () => {
|
|
3175
|
-
it("ON for
|
|
3180
|
+
it("ON by default for ANY account, no override (rollout is GA)", () => {
|
|
3181
|
+
// Formerly-enrolled domains stay on...
|
|
3176
3182
|
expect(resolvePresignTransport("me@getindigo.ai", undefined)).toBe(true);
|
|
3177
|
-
expect(resolvePresignTransport("ME@GetIndigo.AI", undefined)).toBe(true);
|
|
3178
|
-
});
|
|
3179
|
-
|
|
3180
|
-
it("ON for batch-2 rollout domains (gmail.com, vyg.ai, amass.com), no override", () => {
|
|
3181
3183
|
expect(resolvePresignTransport("someone@gmail.com", undefined)).toBe(true);
|
|
3182
|
-
|
|
3183
|
-
expect(resolvePresignTransport("
|
|
3184
|
-
expect(resolvePresignTransport("
|
|
3185
|
-
|
|
3186
|
-
|
|
3187
|
-
|
|
3188
|
-
expect(resolvePresignTransport("me@
|
|
3189
|
-
expect(resolvePresignTransport(undefined, undefined)).toBe(false);
|
|
3190
|
-
expect(resolvePresignTransport("no-at-sign", undefined)).toBe(false);
|
|
3191
|
-
// Exact-domain matching — lookalikes and suffix tricks must not match.
|
|
3192
|
-
expect(resolvePresignTransport("me@notgetindigo.ai.evil.com", undefined)).toBe(
|
|
3193
|
-
false,
|
|
3194
|
-
);
|
|
3195
|
-
expect(resolvePresignTransport("me@gmail.com.evil.com", undefined)).toBe(false);
|
|
3196
|
-
expect(resolvePresignTransport("me@evil-gmail.com", undefined)).toBe(false);
|
|
3197
|
-
// ridge.com is deliberately NOT in batch 2.
|
|
3198
|
-
expect(resolvePresignTransport("juan@ridge.com", undefined)).toBe(false);
|
|
3184
|
+
// ...and so does every account that was previously OFF under the gate.
|
|
3185
|
+
expect(resolvePresignTransport("me@example.com", undefined)).toBe(true);
|
|
3186
|
+
expect(resolvePresignTransport("juan@ridge.com", undefined)).toBe(true);
|
|
3187
|
+
// Email shape no longer matters — it is intentionally ignored at GA.
|
|
3188
|
+
expect(resolvePresignTransport(undefined, undefined)).toBe(true);
|
|
3189
|
+
expect(resolvePresignTransport("no-at-sign", undefined)).toBe(true);
|
|
3190
|
+
expect(resolvePresignTransport("me@evil-gmail.com", undefined)).toBe(true);
|
|
3199
3191
|
});
|
|
3200
3192
|
|
|
3201
3193
|
it.each(["1", "true", "yes", "on", "ON", " True "])(
|
|
3202
|
-
"override '%s' forces ON
|
|
3194
|
+
"override '%s' forces ON",
|
|
3203
3195
|
(val) => {
|
|
3204
3196
|
expect(resolvePresignTransport("me@example.com", val)).toBe(true);
|
|
3205
3197
|
},
|
|
3206
3198
|
);
|
|
3207
3199
|
|
|
3208
|
-
it.each(["0", "false", "no", "off", "OFF"])(
|
|
3209
|
-
"override '%s' forces OFF
|
|
3200
|
+
it.each(["0", "false", "no", "off", "OFF", " Off "])(
|
|
3201
|
+
"override '%s' forces OFF (the emergency rollback lever)",
|
|
3210
3202
|
(val) => {
|
|
3203
|
+
// Rollback must win regardless of account — this is the only path back
|
|
3204
|
+
// to the STS-direct transport without a redeploy.
|
|
3211
3205
|
expect(resolvePresignTransport("me@getindigo.ai", val)).toBe(false);
|
|
3206
|
+
expect(resolvePresignTransport("me@example.com", val)).toBe(false);
|
|
3207
|
+
expect(resolvePresignTransport(undefined, val)).toBe(false);
|
|
3212
3208
|
},
|
|
3213
3209
|
);
|
|
3214
3210
|
|
|
3215
|
-
it("blank/unrecognized override falls through to the
|
|
3211
|
+
it("blank/unrecognized override falls through to the GA default (on)", () => {
|
|
3216
3212
|
expect(resolvePresignTransport("me@getindigo.ai", "")).toBe(true);
|
|
3217
3213
|
expect(resolvePresignTransport("me@getindigo.ai", "maybe")).toBe(true);
|
|
3218
|
-
expect(resolvePresignTransport("me@example.com", "maybe")).toBe(
|
|
3214
|
+
expect(resolvePresignTransport("me@example.com", "maybe")).toBe(true);
|
|
3219
3215
|
});
|
|
3220
3216
|
});
|
|
3221
3217
|
|
package/src/bin/sync-runner.ts
CHANGED
|
@@ -222,47 +222,35 @@ export function resolveSkipPersonal(flag: boolean): boolean {
|
|
|
222
222
|
return env === "1" || env === "true" || env === "yes";
|
|
223
223
|
}
|
|
224
224
|
|
|
225
|
-
/**
|
|
226
|
-
* Email domains enrolled in the presigned-URL transport rollout.
|
|
227
|
-
*
|
|
228
|
-
* Staged by the operator (2026-06-10) in descending user count: getindigo.ai
|
|
229
|
-
* was the pilot; gmail.com / vyg.ai / amass.com are batch 2. The presign
|
|
230
|
-
* transport also routes every upload through the vault API's
|
|
231
|
-
* `validateObjectKey` (INVALID_KEY_BACKSLASH et al.), so enrolling a domain
|
|
232
|
-
* upgrades its server-side input validation versus the STS-direct path.
|
|
233
|
-
* Matching is on the EXACT domain (the part after the last `@`), not a
|
|
234
|
-
* suffix — `evil-gmail.com` and `gmail.com.evil.com` never match.
|
|
235
|
-
*/
|
|
236
|
-
const PRESIGN_ROLLOUT_DOMAINS: ReadonlySet<string> = new Set([
|
|
237
|
-
"getindigo.ai",
|
|
238
|
-
"gmail.com",
|
|
239
|
-
"vyg.ai",
|
|
240
|
-
"amass.com",
|
|
241
|
-
]);
|
|
242
|
-
|
|
243
225
|
/**
|
|
244
226
|
* Decide whether this session uses the presigned-URL transport.
|
|
245
227
|
*
|
|
246
|
-
*
|
|
247
|
-
*
|
|
248
|
-
*
|
|
249
|
-
*
|
|
250
|
-
*
|
|
251
|
-
*
|
|
252
|
-
*
|
|
253
|
-
*
|
|
228
|
+
* GA (2026-06-11): the presigned-URL transport is now the DEFAULT for every
|
|
229
|
+
* account — the staged per-domain rollout (getindigo.ai pilot → gmail.com /
|
|
230
|
+
* vyg.ai / amass.com batch 2) is complete. The transport only NARROWS client
|
|
231
|
+
* privilege: the client holds no raw AWS credentials (it just fetches signed
|
|
232
|
+
* URLs) and every upload is validated server-side via the vault API, so it is
|
|
233
|
+
* safe as the universal default.
|
|
234
|
+
*
|
|
235
|
+
* `HQ_SYNC_PRESIGN_TRANSPORT` still overrides in both directions
|
|
236
|
+
* (`1`/`true`/`yes`/`on` → force on, `0`/`false`/`no`/`off` → force off), so
|
|
237
|
+
* an individual account can be rolled back to the STS-direct path WITHOUT a
|
|
238
|
+
* redeploy if a regression surfaces. An unset/blank or unrecognized override
|
|
239
|
+
* falls through to the GA default (on).
|
|
240
|
+
*
|
|
241
|
+
* `email` is retained in the signature for the override contract and so the
|
|
242
|
+
* gate can be re-narrowed to a domain set in future without touching the call
|
|
243
|
+
* site; it is intentionally unused while the transport is GA.
|
|
254
244
|
*/
|
|
255
245
|
export function resolvePresignTransport(
|
|
256
246
|
email: string | undefined,
|
|
257
247
|
override: string | undefined,
|
|
258
248
|
): boolean {
|
|
249
|
+
void email;
|
|
259
250
|
const o = (override ?? "").trim().toLowerCase();
|
|
260
251
|
if (o === "1" || o === "true" || o === "yes" || o === "on") return true;
|
|
261
252
|
if (o === "0" || o === "false" || o === "no" || o === "off") return false;
|
|
262
|
-
|
|
263
|
-
const at = email.lastIndexOf("@");
|
|
264
|
-
if (at < 0) return false;
|
|
265
|
-
return PRESIGN_ROLLOUT_DOMAINS.has(email.slice(at + 1).toLowerCase());
|
|
253
|
+
return true;
|
|
266
254
|
}
|
|
267
255
|
|
|
268
256
|
// Personal-vault scope (exclusion list + path computer) lives in
|
|
@@ -1016,15 +1004,16 @@ export async function runRunner(
|
|
|
1016
1004
|
: undefined;
|
|
1017
1005
|
|
|
1018
1006
|
// ---- transport selection (presigned-URL vs STS-direct-S3) -------------
|
|
1019
|
-
//
|
|
1020
|
-
//
|
|
1021
|
-
//
|
|
1022
|
-
//
|
|
1023
|
-
// the
|
|
1024
|
-
//
|
|
1025
|
-
//
|
|
1026
|
-
//
|
|
1027
|
-
//
|
|
1007
|
+
// The presigned-URL transport (vault `list` + `presign` endpoints) is now
|
|
1008
|
+
// the GA default for every account. The STS-direct-S3 path (STS-vended
|
|
1009
|
+
// credentials + direct S3 SDK) remains the fallback only when an account is
|
|
1010
|
+
// force-disabled via HQ_SYNC_PRESIGN_TRANSPORT or the client build predates
|
|
1011
|
+
// the presign methods. The gate runs ONCE here — every s3.ts call in this
|
|
1012
|
+
// session's fanout resolves through the installed factory.
|
|
1013
|
+
// HQ_SYNC_PRESIGN_TRANSPORT is an explicit override (1/true → force on,
|
|
1014
|
+
// 0/false → force off) for testing or emergency rollback without a redeploy.
|
|
1015
|
+
// Setting the factory unconditionally (even to the default) keeps the choice
|
|
1016
|
+
// deterministic if a prior run mutated module state.
|
|
1028
1017
|
const presignCapable = client as Partial<PresignTransportClient>;
|
|
1029
1018
|
if (
|
|
1030
1019
|
resolvePresignTransport(
|
package/src/sync/event-sync.ts
CHANGED
|
@@ -57,8 +57,9 @@ import type { TreeChangeBatch } from "../watcher.js";
|
|
|
57
57
|
* EXACT full-address matching, case-insensitive — NOT a domain suffix. The
|
|
58
58
|
* single-account Phase 3 rollout (2026-06-10) targets the operator's own
|
|
59
59
|
* devices; `xhassaan@getindigo.ai` and `hassaan@getindigo.ai.evil.com` must
|
|
60
|
-
* never match. Broadening later is an entry here
|
|
61
|
-
*
|
|
60
|
+
* never match. Broadening later is an entry here, then a domain set, then a
|
|
61
|
+
* GA default-on switch (the path the presigned-URL transport already took in
|
|
62
|
+
* `resolvePresignTransport`).
|
|
62
63
|
*/
|
|
63
64
|
export const EVENT_SYNC_ROLLOUT_EMAILS: ReadonlySet<string> = new Set([
|
|
64
65
|
"hassaan@getindigo.ai",
|