@indigoai-us/hq-cli 5.313.0 → 5.314.0

package/dist/node-preflight.d.ts

@@ -23,12 +23,6 @@ export interface NodeVersionCheck {
     major: number;
     message?: string;
 }
-export interface NodePreflightOptions {
-    versionString?: string;
-    skip?: string;
-    stderr?: Pick<NodeJS.WriteStream, "write">;
-    exit?: (code: number) => void;
-}
 /**
  * Pure check: is the given Node version string (e.g. "18.19.0") supported?
  * Defaults to the running runtime's version. An unparseable version is treated
@@ -41,5 +35,5 @@ export declare function checkNodeVersion(versionString?: string): NodeVersionChe
  * `HQ_SKIP_NODE_PREFLIGHT=1` to bypass (used by the test runner, which already
  * runs on a supported Node).
  */
-export declare function enforceNodeVersion(options?: NodePreflightOptions): void;
+export declare function enforceNodeVersion(): void;
 //# sourceMappingURL=node-preflight.d.ts.map

package/dist/node-preflight.js

@@ -39,13 +39,13 @@ export function checkNodeVersion(versionString = process.versions.node) {
  * `HQ_SKIP_NODE_PREFLIGHT=1` to bypass (used by the test runner, which already
  * runs on a supported Node).
  */
-export function enforceNodeVersion(options = {}) {
-    if (options.skip ?? process.env.HQ_SKIP_NODE_PREFLIGHT)
+export function enforceNodeVersion() {
+    if (process.env.HQ_SKIP_NODE_PREFLIGHT)
         return;
-    const result = checkNodeVersion(options.versionString ?? process.versions.node);
+    const result = checkNodeVersion();
     if (!result.ok && result.message) {
-        (options.stderr ?? process.stderr).write(`${result.message}\n`);
-        (options.exit ?? process.exit)(1);
+        process.stderr.write(`${result.message}\n`);
+        process.exit(1);
     }
 }
 enforceNodeVersion();

package/dist/register-all.d.ts

@@ -1,7 +1,32 @@
 /**
- * Complete command registration, retained as the eager reference used by the
- * generated-catalog check and parity tests. Runtime dispatch uses the same
- * plan one root at a time through lazy-commands.ts.
+ * The full hq command graph — every `register*Command` call, moved here verbatim
+ * from main.ts.
+ *
+ * WHY IT IS ITS OWN MODULE: these 54 imports pull ~60 command modules and their
+ * dependency subtrees, and main.ts used to load all of them at module scope. On
+ * an outpost that cost real CPU, because the agent fleet calls `hq secrets`
+ * about 39 times a minute and each invocation paid for the entire graph before
+ * running one command. Measured on Outpost 2 (i-09424eff61920a4ac), CPU-seconds
+ * per process:
+ *
+ *   node -e ""                   0.03
+ *   dist/commands/secrets.js     1.13   <- what `hq secrets` actually needs
+ *   dist/main.js (full graph)    1.88   <- what it used to pay
+ *
+ * So ~0.75 CPU-seconds of every `hq secrets` was spent importing commands it
+ * never ran. At 39 invocations/minute that is ~0.5 of a core, continuously.
+ *
+ * Splitting the graph out lets the entrypoint import ONE command module for the
+ * hot paths named in lazy-commands.ts, and fall back to this module — the
+ * complete, unchanged registration — for everything else: `--help`, a bare
+ * `hq`, an unknown command, and every command not in that manifest. Anything
+ * not on the manifest therefore behaves exactly as before.
+ *
+ * Keep this list and lazy-commands.ts in sync through the parity test in
+ * lazy-commands.test.ts, which registers both ways and compares the resulting
+ * command shapes. Same discipline as commands/scaffold-fast.ts and core.ts.
  */
-export { registerAllCommands, registerCommandRoot } from "./command-registration-plan.js";
+import type { Command } from "commander";
+/** Register the complete hq command graph onto `program`. */
+export declare function registerAllCommands(program: Command): void;
 //# sourceMappingURL=register-all.d.ts.map

package/dist/register-all.js

@@ -1,7 +1,236 @@
 /**
- * Complete command registration, retained as the eager reference used by the
- * generated-catalog check and parity tests. Runtime dispatch uses the same
- * plan one root at a time through lazy-commands.ts.
+ * The full hq command graph — every `register*Command` call, moved here verbatim
+ * from main.ts.
+ *
+ * WHY IT IS ITS OWN MODULE: these 54 imports pull ~60 command modules and their
+ * dependency subtrees, and main.ts used to load all of them at module scope. On
+ * an outpost that cost real CPU, because the agent fleet calls `hq secrets`
+ * about 39 times a minute and each invocation paid for the entire graph before
+ * running one command. Measured on Outpost 2 (i-09424eff61920a4ac), CPU-seconds
+ * per process:
+ *
+ *   node -e ""                   0.03
+ *   dist/commands/secrets.js     1.13   <- what `hq secrets` actually needs
+ *   dist/main.js (full graph)    1.88   <- what it used to pay
+ *
+ * So ~0.75 CPU-seconds of every `hq secrets` was spent importing commands it
+ * never ran. At 39 invocations/minute that is ~0.5 of a core, continuously.
+ *
+ * Splitting the graph out lets the entrypoint import ONE command module for the
+ * hot paths named in lazy-commands.ts, and fall back to this module — the
+ * complete, unchanged registration — for everything else: `--help`, a bare
+ * `hq`, an unknown command, and every command not in that manifest. Anything
+ * not on the manifest therefore behaves exactly as before.
+ *
+ * Keep this list and lazy-commands.ts in sync through the parity test in
+ * lazy-commands.test.ts, which registers both ways and compares the resulting
+ * command shapes. Same discipline as commands/scaffold-fast.ts and core.ts.
  */
-export { registerAllCommands, registerCommandRoot } from "./command-registration-plan.js";
+import { registerAddCommand } from "./commands/add.js";
+import { registerSyncCommand } from "./commands/sync.js";
+import { registerListCommand } from "./commands/list.js";
+import { registerUpdateCommand } from "./commands/update.js";
+import { registerCloudCommands } from "./commands/cloud.js";
+import { registerSyncModeCommand } from "./commands/sync-mode.js";
+import { registerSyncNarrowCommand } from "./commands/sync-narrow.js";
+import { registerSyncManifestCommand } from "./commands/sync-manifest.js";
+import { registerCloudProvisionCommands } from "./commands/cloud-provision.js";
+import { registerCloudDemoteCommands } from "./commands/cloud-demote.js";
+import { registerLoginCommand } from "./commands/login.js";
+import { registerLogoutCommand } from "./commands/logout.js";
+import { registerWhoamiCommand } from "./commands/whoami.js";
+import { registerOnboardCommand } from "./commands/onboard.js";
+import { registerPackageInstallCommand } from "./commands/pkg-install.js";
+import { registerPackageRemoveCommand } from "./commands/pkg-remove.js";
+import { registerPackageUpdateCommand } from "./commands/pkg-update.js";
+import { registerPackageListCommand } from "./commands/pkg-list.js";
+import { registerPacksCommand } from "./commands/packs.js";
+import { registerPublishCommand } from "./commands/publish.js";
+import { registerCreatorsCommand } from "./commands/creators.js";
+import { registerTeamSyncCommand } from "./commands/team-sync.js";
+import { registerAuthCommands } from "./commands/auth.js";
+import { registerApiKeysCommand } from "./commands/api-keys.js";
+import { registerSecretsCommand } from "./commands/secrets.js";
+import { registerRunCommand } from "./commands/run.js";
+import { registerGroupsCommand } from "./commands/groups.js";
+import { registerWorkersCommand } from "./commands/workers.js";
+import { registerGroupGrantsCommand } from "./commands/group-grants.js";
+import { registerFilesCommand } from "./commands/files.js";
+import { registerFilesBrowseCommands } from "./commands/files-browse.js";
+import { registerAccessCommand } from "./commands/access.js";
+import { registerSkillCommand } from "./commands/skill.js";
+import { registerMembersCommand } from "./commands/members.js";
+import { registerPeopleCommand } from "./commands/people.js";
+import { registerDmCommand } from "./commands/dm.js";
+import { registerChannelsCommand } from "./commands/channels.js";
+import { registerFeedbackCommand } from "./commands/feedback.js";
+import { registerMeetingsCommand } from "./commands/meetings.js";
+import { registerSourcesCommand } from "./commands/sources.js";
+import { registerSignalsCommand } from "./commands/signals.js";
+import { registerIntegrationsCommand } from "./commands/integrations.js";
+import { registerReindexCommand } from "./commands/reindex.js";
+import { registerRescueCommand } from "./commands/rescue.js";
+import { registerMcpCommand } from "./commands/mcp-status.js";
+import { registerCrmCommand } from "./commands/crm.js";
+import { registerCompanyCommand } from "./commands/company.js";
+import { registerAgentsCommand } from "./commands/agents.js";
+import { registerOutpostsCommand } from "./commands/outposts.js";
+import { registerBillingCommand } from "./commands/billing.js";
+import { registerDbCommand } from "./commands/db.js";
+import { registerCoreCommands } from "./commands/core.js";
+import { registerSearchCommand } from "./commands/search.js";
+import { registerIndexCommand } from "./commands/index-cmd.js";
+import { registerDoctorCommand } from "./commands/doctor.js";
+import { registerMeshCommand } from "./commands/mesh.js";
+/** Register the complete hq command graph onto `program`. */
+export function registerAllCommands(program) {
+    // Module management subcommand group
+    const modulesCmd = program
+        .command("modules")
+        .description("Module management commands");
+    registerAddCommand(modulesCmd);
+    registerSyncCommand(modulesCmd);
+    registerListCommand(modulesCmd);
+    registerUpdateCommand(modulesCmd);
+    // Package management subcommand group
+    const packagesCmd = program
+        .command("packages")
+        .description("Package management commands");
+    registerPackageInstallCommand(packagesCmd);
+    registerPackageRemoveCommand(packagesCmd);
+    registerPackageUpdateCommand(packagesCmd);
+    registerPackageListCommand(packagesCmd);
+    // Content-pack lifecycle (core/packages/hq-pack-*). Distinct from the registry
+    // `packages` system above. Available as both `hq packages packs …` (grouped)
+    // and `hq packs …` (top-level convenience).
+    registerPacksCommand(packagesCmd);
+    registerPacksCommand(program);
+    // Top-level shortcuts for package commands
+    // "hq install <slug>" = "hq packages install <slug>"
+    // "hq remove <slug>"  = "hq packages remove <slug>"
+    registerPackageInstallCommand(program);
+    registerPackageRemoveCommand(program);
+    // Marketplace publish (top-level — packer + authenticated upload, US-004)
+    // "hq publish <skill-or-worker-path>" packages and submits a pack to the
+    // marketplace via POST /v1/listings.
+    registerPublishCommand(program);
+    // `hq creators apply` — request verified-creator access (required to publish).
+    registerCreatorsCommand(program);
+    // Cloud sync subcommand group
+    const syncCmd = program
+        .command("sync")
+        .description("Cloud sync commands — sync HQ to S3 for mobile access");
+    registerCloudCommands(syncCmd);
+    registerSyncModeCommand(syncCmd);
+    registerSyncNarrowCommand(syncCmd);
+    registerSyncManifestCommand(syncCmd);
+    // Cloud provisioning subcommand group (entity + bucket + initial sync)
+    // Distinct from `hq sync` which assumes provisioning has already happened.
+    const cloudCmd = program
+        .command("cloud")
+        .description("Cloud commands — provision entities and manage cloud-backed companies");
+    registerCloudProvisionCommands(cloudCmd);
+    registerCloudDemoteCommands(cloudCmd);
+    // Team commands (top-level)
+    registerTeamSyncCommand(program);
+    // Auth commands (top-level — Cognito OAuth)
+    registerLoginCommand(program);
+    registerLogoutCommand(program);
+    registerWhoamiCommand(program);
+    registerAuthCommands(program);
+    // Secrets management (subcommand group — hq secrets set|get|list|delete|exec|generate-link|cache)
+    registerSecretsCommand(program);
+    // Vault databases (subcommand group — hq db status|sql|migrate|provision)
+    registerDbCommand(program);
+    // API key management (subcommand group — hq api-keys create|list|revoke)
+    registerApiKeysCommand(program);
+    // Schema-driven dev runner — hq run [options] -- <cmd>
+    registerRunCommand(program);
+    // Groups management (subcommand group — hq groups create|delete|add|remove|list|members)
+    registerGroupsCommand(program);
+    // Worker discovery + sharing (subcommand group — hq workers list|share)
+    registerWorkersCommand(program);
+    // Cross-company group grants (subcommand group —
+    // hq group-grants grant|revoke|outbound|inbound)
+    registerGroupGrantsCommand(program);
+    // Files ACL management (subcommand group — hq files share|unshare|acl)
+    // `registerFilesCommand` returns the `files` group so we can attach the
+    // browse-vs-sync subcommands (`hq files browse`/`cat`) onto the same group.
+    const filesCmd = registerFilesCommand(program);
+    registerFilesBrowseCommands(filesCmd);
+    // Top-level `hq access` — vault existence + ACL probe (self-healing ladder).
+    registerAccessCommand(program);
+    // Comment-only skill improvement loop. Structured suggestion/review commands are
+    // intentionally absent; live content changes remain governed by FILE_ACL sync.
+    registerSkillCommand(program);
+    // Membership management (subcommand group — hq members invite|list|revoke)
+    registerMembersCommand(program);
+    // People directory (subcommand group — hq people list|search|resolve), reading
+    // the local companies/<co>/people store scoped to one company.
+    registerPeopleCommand(program);
+    registerDmCommand(program);
+    registerChannelsCommand(program);
+    // Onboarding (top-level — Cognito + vault-service provisioning)
+    registerOnboardCommand(program);
+    // Feedback (subcommand group — hq feedback bug|feature)
+    registerFeedbackCommand(program);
+    // Meetings (subcommand group — hq meetings list|get|search|transcript|notes)
+    registerMeetingsCommand(program);
+    // Sources read surface (subcommand group — hq sources list|get|channels|entities)
+    registerSourcesCommand(program);
+    // Signals read surface (subcommand group — hq signals list|get|types|entities)
+    registerSignalsCommand(program);
+    // Company-connected apps via the governed integration gateway
+    // (subcommand group — hq integrations list|tools|call|approve|reject)
+    registerIntegrationsCommand(program);
+    // Skill/personal-overlay mirroring + workers-registry regen. Invoked by the
+    // hq-core reindex hook shim (Stop / PostToolUse) and by sync()/rescue() after
+    // they change on-disk sources. Keeps a `master-sync` alias for one release.
+    // Implementation lives in @indigoai-us/hq-cloud.
+    registerReindexCommand(program);
+    // Drift-preserving HQ-core re-sync (top-level — `hq rescue`). CLI sibling of
+    // the HQ Sync app's "Update / Restore" pill; drives the same replace-rescue.sh
+    // shipped from @indigoai-us/hq-cloud.
+    registerRescueCommand(program);
+    // MCP pack observability (subcommand group — `hq mcp status`). Read-only
+    // provenance-based status across BOTH Claude + Codex runtimes (reads `_hqPack`
+    // off the configs, NOT linkStatus), with secret-redacted output + `--json`.
+    registerMcpCommand(program);
+    // Native CRM entity upsert (subcommand group — `hq crm entity upsert`). Wraps
+    // POST /crm/entities (the ontology write gate) so an authenticated company
+    // member can create/update canonical CRM entities in the company vault.
+    registerCrmCommand(program);
+    // Company settings (subcommand group — `hq company settings set`). Owner-only
+    // toggles for crmEnabled / ontologyEnabled via PUT /company-settings.
+    registerCompanyCommand(program);
+    // Cloud agent management (subcommand group — `hq agents …`). Rename, reconfigure,
+    // start/stop, and tear down a company's fleet agents via the hq-pro /v1/agents
+    // control plane — the same routes the web console's agents panel calls.
+    registerAgentsCommand(program);
+    // Personal Outpost management (subcommand group — `hq outposts …`). List, inspect,
+    // enable Codex on, refresh login for, and destroy your EC2 boxes via the hq-pro
+    // /outpost/* control plane.
+    registerOutpostsCommand(program);
+    // Billing (subcommand group — `hq billing …`). Check subscription/card state and
+    // mint a shareable Stripe card-capture link — the client side of the paid-
+    // provisioning gate for agents & Outposts.
+    registerBillingCommand(program);
+    // HQ scaffold scripts hosted by the CLI (hidden group — `hq core …`). Not a
+    // public surface: every entry is invoked by an HQ skill, hook, or forwarder, and
+    // the source-root entries are maintainer tools that must never touch a live
+    // install. Registered from a manifest in the module, not wired per script here.
+    registerCoreCommands(program);
+    // Local qmd search and index management. Kept distinct from `hq reindex`,
+    // which converges scaffold-owned files and hooks rather than search data.
+    registerSearchCommand(program);
+    registerIndexCommand(program);
+    // Hook guardrail diagnostics (top-level — `hq doctor`). Read-only, offline
+    // verification that HQ's hooks are wired and firing, backed by an extensible
+    // check registry so later check families (vault, sync, MCP, …) plug in without
+    // engine changes.
+    registerDoctorCommand(program);
+    // Work mesh (subcommand group — `hq mesh …`). Native REST + cache. Distinct
+    // from `hq doctor` (hook guardrails). Does not start MQTT listen.
+    registerMeshCommand(program);
+}
 //# sourceMappingURL=register-all.js.map

package/dist/run/discover-schemas.d.ts

@@ -1,4 +1,4 @@
-interface SchemaConflict {
+export interface SchemaConflict {
     paths: [string, string];
     slugs: [string, string];
 }
@@ -9,5 +9,4 @@ export interface DiscoverSchemasResult {
     conflict: SchemaConflict | null;
 }
 export declare function discoverSchemas(cwd: string): DiscoverSchemasResult;
-export {};
 //# sourceMappingURL=discover-schemas.d.ts.map

package/dist/run/env-graph-guard.d.ts

@@ -1,5 +1,5 @@
 /** The varlock version hq-cli is pinned to (package.json `dependencies`). */
-export declare const VARLOCK_PINNED_VERSION = "1.21.1";
+export declare const VARLOCK_PINNED_VERSION = "1.0.0";
 /** A schema/plugin source varlock could not finish loading. */
 interface GuardDataSource {
     readonly isValid: boolean;
@@ -68,7 +68,7 @@ export declare function assertEnvGraphLoaded(graph: LoadedEnvGraph): void;
  * rejection into a thrown EnvResolutionError instead of hanging on the promise
  * that never settles.
  *
- * varlock's resolveEnvValues dispatches its per-item resolver un-awaited
+ * varlock@1.0.0's resolveEnvValues dispatches its per-item resolver un-awaited
  * and with a dead `_reject`, so a throw inside it becomes a process-level
  * unhandled rejection AND leaves the returned promise permanently pending. We
  * race the resolve against a scoped `unhandledRejection` listener: whichever

package/dist/run/env-graph-guard.js

@@ -34,7 +34,7 @@
 // actionable `hq: …` line WITHOUT a Sentry capture (see isVarlockEnvError).
 import { claimRejection, releaseRejection, } from "../unhandled-rejection-boundary.js";
 /** The varlock version hq-cli is pinned to (package.json `dependencies`). */
-export const VARLOCK_PINNED_VERSION = "1.21.1";
+export const VARLOCK_PINNED_VERSION = "1.0.0";
 /**
  * A schema/entry file could not be loaded, so the env graph never finished
  * processing. Carries an actionable, file-naming message; classified by
@@ -114,7 +114,7 @@ export function assertEnvGraphLoaded(graph) {
  * rejection into a thrown EnvResolutionError instead of hanging on the promise
  * that never settles.
  *
- * varlock's resolveEnvValues dispatches its per-item resolver un-awaited
+ * varlock@1.0.0's resolveEnvValues dispatches its per-item resolver un-awaited
  * and with a dead `_reject`, so a throw inside it becomes a process-level
  * unhandled rejection AND leaves the returned promise permanently pending. We
  * race the resolve against a scoped `unhandledRejection` listener: whichever
@@ -143,9 +143,6 @@ export async function resolveEnvValuesOrThrow(graph) {
     });
     process.prependOnceListener("unhandledRejection", onRejection);
     try {
-        // Preserve current varlock's direct rejection unchanged. The race only
-        // turns a floated rejection (the 1.0.0 behavior) into a typed error rather
-        // than leaving the caller waiting on a promise that never settles.
         await Promise.race([graph.resolveEnvValues(), rejection]);
     }
     finally {

package/dist/run/hq-plugin.d.ts

@@ -1,10 +1,6 @@
 import type { SecretLoadResponse, SecretUsage } from '../commands/secrets.js';
 export interface InstallHqPluginOpts {
     companyOverride?: string;
-    /** Local cache identity derived from the current Cognito person/agent token. */
-    principalUid?: string;
-    /** Only hq run opts into encrypted offline values. */
-    allowOfflineFallback?: boolean;
     resolveCompanyUid: (slug: string) => Promise<string>;
     usage?: SecretUsage;
     fetchBatch: (uid: string, names: string[], usage?: SecretUsage) => Promise<SecretLoadResponse>;

package/dist/run/hq-plugin.js

@@ -1,6 +1,5 @@
 import { ResolutionError } from 'varlock/plugin-lib';
-import { DEFAULT_SECRETS_CACHE_TTL_MS, hasCacheEntry, readCache, writeCache, removeCacheEntry, } from '../utils/secrets-cache.js';
-import { CACHED_SECRETS_SERVER_UNAVAILABLE_MESSAGE, isSecretLoadUnavailable, } from '../utils/secret-load-availability.js';
+import { DEFAULT_SECRETS_CACHE_TTL_MS, writeCache, removeCacheEntry, } from '../utils/secrets-cache.js';
 function normalizeCacheTtlMs(secret) {
     if (secret.tier === 'sensitive' ||
         secret.tier === 'nuclear' ||
@@ -23,9 +22,8 @@ export function installHqPlugin(graph /* EnvGraph */, opts) {
         errorsByName: new Map(),
         loadedSecretsByName: new Map(),
     };
-    // In varlock@1.21.1, Resolver remains declared in plugin-lib's .d.mts but
-    // is not exported from its runtime module. Derive the runtime base class from
-    // a built-in resolver registered on the graph; the shape test pins this API.
+    // varlock@1.0.0's plugin-lib.js omits the Resolver export (d.ts/JS mismatch);
+    // extract it at runtime from any already-registered built-in resolver's prototype.
     // eslint-disable-next-line @typescript-eslint/no-explicit-any
     let RuntimeResolver;
     try {
@@ -40,8 +38,8 @@ export function installHqPlugin(graph /* EnvGraph */, opts) {
         RuntimeResolver = proto;
     }
     catch (e) {
-        throw new Error('varlock Resolver base class extraction failed — varlock@1.21.1 still declares ' +
-            'Resolver in plugin-lib types without exporting it at runtime. ' +
+        throw new Error('varlock Resolver base class extraction failed — the varlock@1.0.0 d.ts/JS mismatch ' +
+            'may have been resolved; switch to `import { Resolver } from "varlock/plugin-lib"`. ' +
             `Underlying: ${e instanceof Error ? e.message : String(e)}`);
     }
     // HqResolver is declared INSIDE installHqPlugin so its static def.resolve
@@ -97,7 +95,7 @@ export function installHqPlugin(graph /* EnvGraph */, opts) {
             }
         }
     }
-    // Varlock's env-spec parser rejects dots in decorator names ([a-zA-Z0-9_] only),
+    // varlock@1.0.0's env-spec parser rejects dots in decorator names ([a-zA-Z0-9_] only),
     // so `@hq.company` is not valid syntax. We register as `@hqCompany` (camelCase) instead.
     // Schema files must use `# @hqCompany("slug")` followed by a blank line so the parser
     // treats it as a file-level root decorator rather than an item decorator for the next var.
@@ -171,14 +169,6 @@ export async function prewarmHqSecrets(graph /* EnvGraph */, opts, state) {
                 throw new Error('Invalid secret load response from vault');
             }
             seenNames.add(s.name);
-            if (s.revokedAt != null) {
-                errorsByName.set(s.name, {
-                    code: 'revoked',
-                    message: `Secret '${s.name}' has been revoked`,
-                });
-                removeCacheEntry(uid, s.name);
-                continue;
-            }
             if (s.value == null) {
                 errorsByName.set(s.name, {
                     code: 'not_returned',
@@ -190,8 +180,8 @@ export async function prewarmHqSecrets(graph /* EnvGraph */, opts, state) {
             returnedNames.add(s.name);
             state.loadedSecretsByName.set(s.name, s.value);
             const cacheTtlMs = normalizeCacheTtlMs(s);
-            if (cacheTtlMs > 0 && opts.principalUid) {
-                writeCache(uid, s.name, opts.principalUid, s.value, cacheTtlMs, s.version);
+            if (cacheTtlMs > 0) {
+                writeCache(uid, s.name, s.value, cacheTtlMs, s.version);
             }
             else {
                 removeCacheEntry(uid, s.name);
@@ -229,24 +219,6 @@ export async function prewarmHqSecrets(graph /* EnvGraph */, opts, state) {
     catch (err) {
         state.loadedSecretsByName.clear();
         state.errorsByName = new Map();
-        if (isSecretLoadUnavailable(err) && opts.allowOfflineFallback === true && opts.principalUid) {
-            const cached = new Map();
-            for (const name of uniqueNames) {
-                const value = hasCacheEntry(uid, name, opts.principalUid)
-                    ? readCache(uid, name, opts.principalUid)
-                    : null;
-                if (value === null) {
-                    throw err;
-                }
-                cached.set(name, value);
-            }
-            state.loadedSecretsByName = cached;
-            state.uid = uid;
-            console.error(CACHED_SECRETS_SERVER_UNAVAILABLE_MESSAGE);
-            return;
-        }
-        if (isSecretLoadUnavailable(err))
-            throw err;
         for (const name of uniqueNames) {
             removeCacheEntry(uid, name);
         }

package/dist/sentry-before-send.js

@@ -175,86 +175,6 @@ function scrubFields(value, memo = new Map()) {
     return out;
 }
 export function beforeSend(event, _hint) {
-    if (event.tags?.sentry_event_type === "client_health") {
-        const sourceTags = (event.tags ?? {});
-        const checkClasses = new Set([
-            "sync.update.core",
-            "sync.journal.personal",
-            "sync.journal.personal_vault",
-            "sync.journal.company",
-            "sync.manifest.personal",
-            "sync.manifest.personal_vault",
-            "sync.manifest.company",
-            "other",
-        ]);
-        const reasonCodes = new Set([
-            "none",
-            "core-version-unavailable",
-            "core-update-available",
-            "no-local-tree",
-            "never-synced",
-            "invalid-last-sync",
-            "stale-threshold",
-            "manifest-unavailable",
-            "manifest-state-unavailable",
-            "no-manifest-scopes",
-            "never-uploaded",
-            "invalid-upload-time",
-            "unresolved-company-uid",
-        ]);
-        const platforms = new Set([
-            "aix", "android", "darwin", "freebsd", "haiku", "linux", "openbsd",
-            "sunos", "win32", "cygwin",
-        ]);
-        const architectures = new Set([
-            "arm", "arm64", "ia32", "loong64", "mips", "mipsel", "ppc", "ppc64",
-            "riscv64", "s390x", "x64",
-        ]);
-        const versionPattern = /^(?:unknown|\d+\.\d+\.\d+(?:-[A-Za-z0-9.-]+)?(?:\+[A-Za-z0-9.-]+)?)$/;
-        const id = typeof event.user?.id === "string" &&
-            /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(event.user.id)
-            ? event.user.id
-            : undefined;
-        const checkClass = typeof sourceTags.check_class === "string" && checkClasses.has(sourceTags.check_class)
-            ? sourceTags.check_class
-            : "other";
-        const reasonCode = typeof sourceTags.reason_code === "string" && reasonCodes.has(sourceTags.reason_code)
-            ? sourceTags.reason_code
-            : "none";
-        const fixOutcome = ["not_auto_fixable", "fix_failed", "fix_timed_out"].includes(String(sourceTags.fix_outcome)) ? String(sourceTags.fix_outcome) : "not_auto_fixable";
-        const status = sourceTags.status === "WARN" ? "WARN" : "FAIL";
-        const count = typeof sourceTags.failing_check_count === "string" &&
-            /^[1-9]\d{0,2}$/.test(sourceTags.failing_check_count) &&
-            Number(sourceTags.failing_check_count) <= 250
-            ? sourceTags.failing_check_count
-            : "1";
-        const safeVersion = (value) => typeof value === "string" && versionPattern.test(value) ? value : "unknown";
-        const safePlatform = (value) => typeof value === "string" && platforms.has(value) ? value : "unknown";
-        const safeArchitecture = (value) => typeof value === "string" && architectures.has(value) ? value : "unknown";
-        return {
-            type: undefined,
-            ...(typeof event.event_id === "string" ? { event_id: event.event_id } : {}),
-            ...(typeof event.timestamp === "number" ? { timestamp: event.timestamp } : {}),
-            platform: "node",
-            level: "warning",
-            message: `Client health: ${checkClass} unresolved after hq doctor --fix`,
-            fingerprint: ["client-health", checkClass, reasonCode],
-            tags: {
-                sentry_event_type: "client_health",
-                check_class: checkClass,
-                reason_code: reasonCode,
-                fix_outcome: fixOutcome,
-                status,
-                failing_check_count: count,
-                cli_version: safeVersion(sourceTags.cli_version),
-                core_version: safeVersion(sourceTags.core_version),
-                sync_version: safeVersion(sourceTags.sync_version),
-                platform: safePlatform(sourceTags.platform),
-                arch: safeArchitecture(sourceTags.arch),
-            },
-            user: { ...(id ? { id } : {}), ip_address: null },
-        };
-    }
     if (event.request) {
         const req = event.request;
         event.request = {

package/dist/sentry.d.ts

@@ -1,5 +1,5 @@
 import * as Sentry from "@sentry/node";
-import type { ErrorEvent, EventHint, NodeOptions } from "@sentry/node";
+import type { ErrorEvent, EventHint } from "@sentry/node";
 /**
  * Drop broken-pipe (EPIPE) crashes before scrubbing/send. A closed downstream
  * reader (`hq … | head`, `source <(hq …)`, a parent that exited) is normal
@@ -11,12 +11,6 @@ import type { ErrorEvent, EventHint, NodeOptions } from "@sentry/node";
  * Consistent with the swallow-EPIPE posture established in #138.
  */
 export declare function epipeAwareBeforeSend(event: ErrorEvent, hint: EventHint): ErrorEvent | null;
-/**
- * Tests substitute only the transport so the real SDK lifecycle can be
- * exercised without an ingest request. Production callers pass nothing.
- */
-export declare function initSentry(overrides?: Partial<Pick<NodeOptions, "transport">>): void;
-/** Finish HQ's one per-invocation release-health session. */
-export declare function finishSentrySession(): void;
+export declare function initSentry(): void;
 export { Sentry };
 //# sourceMappingURL=sentry.d.ts.map