@indigoai-us/hq-cli 5.314.0 → 5.316.0

package/dist/node-network-compat-core.js

@@ -0,0 +1,41 @@
+/** Node network defaults shared by the full graph and the selective fast path. */
+import * as nodeNet from "node:net";
+export const HQ_NETWORK_FAMILY_ATTEMPT_TIMEOUT_MS = 1000;
+const ATTEMPT_TIMEOUT_OPTION = "--network-family-autoselection-attempt-timeout";
+function hasExplicitAttemptTimeout(nodeOptions, execArgv) {
+    const optionPattern = new RegExp("(?:^|\\s)" + ATTEMPT_TIMEOUT_OPTION + "(?:=|\\s|$)");
+    return (optionPattern.test(nodeOptions) ||
+        execArgv.some((argument) => argument === ATTEMPT_TIMEOUT_OPTION ||
+            argument.startsWith(ATTEMPT_TIMEOUT_OPTION + "=")));
+}
+function resolveSetAttemptTimeout(override) {
+    if (override === null)
+        return undefined;
+    if (override)
+        return override;
+    const fn = nodeNet.setDefaultAutoSelectFamilyAttemptTimeout;
+    return typeof fn === "function" ? fn.bind(nodeNet) : undefined;
+}
+export function configureNodeNetworkCompatibility(options = {}) {
+    const nodeOptions = options.nodeOptions ?? process.env.NODE_OPTIONS ?? "";
+    const execArgv = options.execArgv ?? process.execArgv;
+    if (hasExplicitAttemptTimeout(nodeOptions, execArgv)) {
+        return false;
+    }
+    const setAttemptTimeout = resolveSetAttemptTimeout(options.setAttemptTimeout);
+    if (!setAttemptTimeout) {
+        // Runtime lacks the API; the Node preflight should already have exited.
+        return false;
+    }
+    setAttemptTimeout(HQ_NETWORK_FAMILY_ATTEMPT_TIMEOUT_MS);
+    return true;
+}
+let configurationAttempted = false;
+/** Apply at most once when both entrypoint routing layers import this module. */
+export function configureNodeNetworkCompatibilityOnce() {
+    if (configurationAttempted)
+        return false;
+    configurationAttempted = true;
+    return configureNodeNetworkCompatibility();
+}
+//# sourceMappingURL=node-network-compat-core.js.map

package/dist/node-network-compat-fast.d.ts

@@ -0,0 +1,7 @@
+/** Selective Node network setup for the entrypoint's fast routes. */
+/**
+ * Full-graph invocations keep the historical unconditional network patch.
+ * Fast routes opt in only when their direct implementation uses Node networking.
+ */
+export declare function shouldConfigureNodeNetworkCompatibility(argv: readonly string[]): boolean;
+//# sourceMappingURL=node-network-compat-fast.d.ts.map

package/dist/node-network-compat-fast.js

@@ -0,0 +1,23 @@
+/** Selective Node network setup for the entrypoint's fast routes. */
+import { parseFastCore, parseSecretsEnvFastRequest } from "./fast-scaffold.js";
+import { isVersionRequest, wantsLabelledVersionReport } from "./version-request.js";
+/**
+ * Full-graph invocations keep the historical unconditional network patch.
+ * Fast routes opt in only when their direct implementation uses Node networking.
+ */
+export function shouldConfigureNodeNetworkCompatibility(argv) {
+    if (isVersionRequest(argv))
+        return wantsLabelledVersionReport(argv);
+    const fastCore = parseFastCore(argv);
+    if (fastCore)
+        return fastCore.entry.requiresNodeNetworkCompatibility === true;
+    // The lightweight secrets route still makes vault API requests.
+    if (parseSecretsEnvFastRequest(argv))
+        return true;
+    return true;
+}
+if (shouldConfigureNodeNetworkCompatibility(process.argv)) {
+    const { configureNodeNetworkCompatibilityOnce } = await import("./node-network-compat-core.js");
+    configureNodeNetworkCompatibilityOnce();
+}
+//# sourceMappingURL=node-network-compat-fast.js.map

package/dist/node-network-compat.d.ts

@@ -1,31 +1,3 @@
-/**
- * Node network defaults for HQ CLI entry points.
- *
- * Node's default 250 ms address-family attempt window can fail on hosts where
- * IPv6 is advertised but black-holed. On affected WSL installations, undici's
- * fetch() reaches ETIMEDOUT before its usable IPv4 path completes. A 1 second
- * window fixes the connection while retaining Node's automatic family choice.
- *
- * Keep this module dependency-free and import it immediately after the Node
- * version preflight. Operators can retain a custom value through NODE_OPTIONS
- * or a direct Node CLI option; HQ only supplies the compatibility default when
- * neither is present.
- *
- * Use a namespace import of `node:net` (not a static named import of
- * `setDefaultAutoSelectFamilyAttemptTimeout`). Named ESM imports are linked
- * before any entry-module body runs — including `node-preflight` — so importing
- * a Node 18.13+/20.4+ API by name would turn unsupported runtimes into a
- * module-link SyntaxError instead of the preflight's upgrade message.
- */
-export declare const HQ_NETWORK_FAMILY_ATTEMPT_TIMEOUT_MS = 1000;
-export interface NodeNetworkCompatibilityOptions {
-    nodeOptions?: string;
-    execArgv?: readonly string[];
-    /**
-     * Inject the net timeout setter (tests). Pass `null` to simulate a runtime
-     * that lacks `setDefaultAutoSelectFamilyAttemptTimeout`.
-     */
-    setAttemptTimeout?: ((milliseconds: number) => void) | null;
-}
-export declare function configureNodeNetworkCompatibility(options?: NodeNetworkCompatibilityOptions): boolean;
+/** Unconditional compatibility setup for the full CLI command graph. */
+export { configureNodeNetworkCompatibility, HQ_NETWORK_FAMILY_ATTEMPT_TIMEOUT_MS, type NodeNetworkCompatibilityOptions, } from "./node-network-compat-core.js";
 //# sourceMappingURL=node-network-compat.d.ts.map

package/dist/node-network-compat.js

@@ -1,52 +1,5 @@
-/**
- * Node network defaults for HQ CLI entry points.
- *
- * Node's default 250 ms address-family attempt window can fail on hosts where
- * IPv6 is advertised but black-holed. On affected WSL installations, undici's
- * fetch() reaches ETIMEDOUT before its usable IPv4 path completes. A 1 second
- * window fixes the connection while retaining Node's automatic family choice.
- *
- * Keep this module dependency-free and import it immediately after the Node
- * version preflight. Operators can retain a custom value through NODE_OPTIONS
- * or a direct Node CLI option; HQ only supplies the compatibility default when
- * neither is present.
- *
- * Use a namespace import of `node:net` (not a static named import of
- * `setDefaultAutoSelectFamilyAttemptTimeout`). Named ESM imports are linked
- * before any entry-module body runs — including `node-preflight` — so importing
- * a Node 18.13+/20.4+ API by name would turn unsupported runtimes into a
- * module-link SyntaxError instead of the preflight's upgrade message.
- */
-import * as nodeNet from "node:net";
-export const HQ_NETWORK_FAMILY_ATTEMPT_TIMEOUT_MS = 1000;
-const ATTEMPT_TIMEOUT_OPTION = "--network-family-autoselection-attempt-timeout";
-function hasExplicitAttemptTimeout(nodeOptions, execArgv) {
-    const optionPattern = new RegExp(`(?:^|\\s)${ATTEMPT_TIMEOUT_OPTION}(?:=|\\s|$)`);
-    return (optionPattern.test(nodeOptions) ||
-        execArgv.some((argument) => argument === ATTEMPT_TIMEOUT_OPTION ||
-            argument.startsWith(`${ATTEMPT_TIMEOUT_OPTION}=`)));
-}
-function resolveSetAttemptTimeout(override) {
-    if (override === null)
-        return undefined;
-    if (override)
-        return override;
-    const fn = nodeNet.setDefaultAutoSelectFamilyAttemptTimeout;
-    return typeof fn === "function" ? fn.bind(nodeNet) : undefined;
-}
-export function configureNodeNetworkCompatibility(options = {}) {
-    const nodeOptions = options.nodeOptions ?? process.env.NODE_OPTIONS ?? "";
-    const execArgv = options.execArgv ?? process.execArgv;
-    if (hasExplicitAttemptTimeout(nodeOptions, execArgv)) {
-        return false;
-    }
-    const setAttemptTimeout = resolveSetAttemptTimeout(options.setAttemptTimeout);
-    if (!setAttemptTimeout) {
-        // Runtime lacks the API (pre-Node 18.13 / preflight should already have exited).
-        return false;
-    }
-    setAttemptTimeout(HQ_NETWORK_FAMILY_ATTEMPT_TIMEOUT_MS);
-    return true;
-}
-configureNodeNetworkCompatibility();
+/** Unconditional compatibility setup for the full CLI command graph. */
+import { configureNodeNetworkCompatibilityOnce } from "./node-network-compat-core.js";
+export { configureNodeNetworkCompatibility, HQ_NETWORK_FAMILY_ATTEMPT_TIMEOUT_MS, } from "./node-network-compat-core.js";
+configureNodeNetworkCompatibilityOnce();
 //# sourceMappingURL=node-network-compat.js.map

package/dist/node-preflight.d.ts

@@ -23,6 +23,12 @@ export interface NodeVersionCheck {
     major: number;
     message?: string;
 }
+export interface NodePreflightOptions {
+    versionString?: string;
+    skip?: string;
+    stderr?: Pick<NodeJS.WriteStream, "write">;
+    exit?: (code: number) => void;
+}
 /**
  * Pure check: is the given Node version string (e.g. "18.19.0") supported?
  * Defaults to the running runtime's version. An unparseable version is treated
@@ -35,5 +41,5 @@ export declare function checkNodeVersion(versionString?: string): NodeVersionChe
  * `HQ_SKIP_NODE_PREFLIGHT=1` to bypass (used by the test runner, which already
  * runs on a supported Node).
  */
-export declare function enforceNodeVersion(): void;
+export declare function enforceNodeVersion(options?: NodePreflightOptions): void;
 //# sourceMappingURL=node-preflight.d.ts.map

package/dist/node-preflight.js

@@ -39,13 +39,13 @@ export function checkNodeVersion(versionString = process.versions.node) {
  * `HQ_SKIP_NODE_PREFLIGHT=1` to bypass (used by the test runner, which already
  * runs on a supported Node).
  */
-export function enforceNodeVersion() {
-    if (process.env.HQ_SKIP_NODE_PREFLIGHT)
+export function enforceNodeVersion(options = {}) {
+    if (options.skip ?? process.env.HQ_SKIP_NODE_PREFLIGHT)
         return;
-    const result = checkNodeVersion();
+    const result = checkNodeVersion(options.versionString ?? process.versions.node);
     if (!result.ok && result.message) {
-        process.stderr.write(`${result.message}\n`);
-        process.exit(1);
+        (options.stderr ?? process.stderr).write(`${result.message}\n`);
+        (options.exit ?? process.exit)(1);
     }
 }
 enforceNodeVersion();

package/dist/register-all.d.ts

@@ -1,32 +1,7 @@
 /**
- * The full hq command graph — every `register*Command` call, moved here verbatim
- * from main.ts.
- *
- * WHY IT IS ITS OWN MODULE: these 54 imports pull ~60 command modules and their
- * dependency subtrees, and main.ts used to load all of them at module scope. On
- * an outpost that cost real CPU, because the agent fleet calls `hq secrets`
- * about 39 times a minute and each invocation paid for the entire graph before
- * running one command. Measured on Outpost 2 (i-09424eff61920a4ac), CPU-seconds
- * per process:
- *
- *   node -e ""                   0.03
- *   dist/commands/secrets.js     1.13   <- what `hq secrets` actually needs
- *   dist/main.js (full graph)    1.88   <- what it used to pay
- *
- * So ~0.75 CPU-seconds of every `hq secrets` was spent importing commands it
- * never ran. At 39 invocations/minute that is ~0.5 of a core, continuously.
- *
- * Splitting the graph out lets the entrypoint import ONE command module for the
- * hot paths named in lazy-commands.ts, and fall back to this module — the
- * complete, unchanged registration — for everything else: `--help`, a bare
- * `hq`, an unknown command, and every command not in that manifest. Anything
- * not on the manifest therefore behaves exactly as before.
- *
- * Keep this list and lazy-commands.ts in sync through the parity test in
- * lazy-commands.test.ts, which registers both ways and compares the resulting
- * command shapes. Same discipline as commands/scaffold-fast.ts and core.ts.
+ * Complete command registration, retained as the eager reference used by the
+ * generated-catalog check and parity tests. Runtime dispatch uses the same
+ * plan one root at a time through lazy-commands.ts.
  */
-import type { Command } from "commander";
-/** Register the complete hq command graph onto `program`. */
-export declare function registerAllCommands(program: Command): void;
+export { registerAllCommands, registerCommandRoot } from "./command-registration-plan.js";
 //# sourceMappingURL=register-all.d.ts.map

package/dist/register-all.js

@@ -1,236 +1,7 @@
 /**
- * The full hq command graph — every `register*Command` call, moved here verbatim
- * from main.ts.
- *
- * WHY IT IS ITS OWN MODULE: these 54 imports pull ~60 command modules and their
- * dependency subtrees, and main.ts used to load all of them at module scope. On
- * an outpost that cost real CPU, because the agent fleet calls `hq secrets`
- * about 39 times a minute and each invocation paid for the entire graph before
- * running one command. Measured on Outpost 2 (i-09424eff61920a4ac), CPU-seconds
- * per process:
- *
- *   node -e ""                   0.03
- *   dist/commands/secrets.js     1.13   <- what `hq secrets` actually needs
- *   dist/main.js (full graph)    1.88   <- what it used to pay
- *
- * So ~0.75 CPU-seconds of every `hq secrets` was spent importing commands it
- * never ran. At 39 invocations/minute that is ~0.5 of a core, continuously.
- *
- * Splitting the graph out lets the entrypoint import ONE command module for the
- * hot paths named in lazy-commands.ts, and fall back to this module — the
- * complete, unchanged registration — for everything else: `--help`, a bare
- * `hq`, an unknown command, and every command not in that manifest. Anything
- * not on the manifest therefore behaves exactly as before.
- *
- * Keep this list and lazy-commands.ts in sync through the parity test in
- * lazy-commands.test.ts, which registers both ways and compares the resulting
- * command shapes. Same discipline as commands/scaffold-fast.ts and core.ts.
+ * Complete command registration, retained as the eager reference used by the
+ * generated-catalog check and parity tests. Runtime dispatch uses the same
+ * plan one root at a time through lazy-commands.ts.
  */
-import { registerAddCommand } from "./commands/add.js";
-import { registerSyncCommand } from "./commands/sync.js";
-import { registerListCommand } from "./commands/list.js";
-import { registerUpdateCommand } from "./commands/update.js";
-import { registerCloudCommands } from "./commands/cloud.js";
-import { registerSyncModeCommand } from "./commands/sync-mode.js";
-import { registerSyncNarrowCommand } from "./commands/sync-narrow.js";
-import { registerSyncManifestCommand } from "./commands/sync-manifest.js";
-import { registerCloudProvisionCommands } from "./commands/cloud-provision.js";
-import { registerCloudDemoteCommands } from "./commands/cloud-demote.js";
-import { registerLoginCommand } from "./commands/login.js";
-import { registerLogoutCommand } from "./commands/logout.js";
-import { registerWhoamiCommand } from "./commands/whoami.js";
-import { registerOnboardCommand } from "./commands/onboard.js";
-import { registerPackageInstallCommand } from "./commands/pkg-install.js";
-import { registerPackageRemoveCommand } from "./commands/pkg-remove.js";
-import { registerPackageUpdateCommand } from "./commands/pkg-update.js";
-import { registerPackageListCommand } from "./commands/pkg-list.js";
-import { registerPacksCommand } from "./commands/packs.js";
-import { registerPublishCommand } from "./commands/publish.js";
-import { registerCreatorsCommand } from "./commands/creators.js";
-import { registerTeamSyncCommand } from "./commands/team-sync.js";
-import { registerAuthCommands } from "./commands/auth.js";
-import { registerApiKeysCommand } from "./commands/api-keys.js";
-import { registerSecretsCommand } from "./commands/secrets.js";
-import { registerRunCommand } from "./commands/run.js";
-import { registerGroupsCommand } from "./commands/groups.js";
-import { registerWorkersCommand } from "./commands/workers.js";
-import { registerGroupGrantsCommand } from "./commands/group-grants.js";
-import { registerFilesCommand } from "./commands/files.js";
-import { registerFilesBrowseCommands } from "./commands/files-browse.js";
-import { registerAccessCommand } from "./commands/access.js";
-import { registerSkillCommand } from "./commands/skill.js";
-import { registerMembersCommand } from "./commands/members.js";
-import { registerPeopleCommand } from "./commands/people.js";
-import { registerDmCommand } from "./commands/dm.js";
-import { registerChannelsCommand } from "./commands/channels.js";
-import { registerFeedbackCommand } from "./commands/feedback.js";
-import { registerMeetingsCommand } from "./commands/meetings.js";
-import { registerSourcesCommand } from "./commands/sources.js";
-import { registerSignalsCommand } from "./commands/signals.js";
-import { registerIntegrationsCommand } from "./commands/integrations.js";
-import { registerReindexCommand } from "./commands/reindex.js";
-import { registerRescueCommand } from "./commands/rescue.js";
-import { registerMcpCommand } from "./commands/mcp-status.js";
-import { registerCrmCommand } from "./commands/crm.js";
-import { registerCompanyCommand } from "./commands/company.js";
-import { registerAgentsCommand } from "./commands/agents.js";
-import { registerOutpostsCommand } from "./commands/outposts.js";
-import { registerBillingCommand } from "./commands/billing.js";
-import { registerDbCommand } from "./commands/db.js";
-import { registerCoreCommands } from "./commands/core.js";
-import { registerSearchCommand } from "./commands/search.js";
-import { registerIndexCommand } from "./commands/index-cmd.js";
-import { registerDoctorCommand } from "./commands/doctor.js";
-import { registerMeshCommand } from "./commands/mesh.js";
-/** Register the complete hq command graph onto `program`. */
-export function registerAllCommands(program) {
-    // Module management subcommand group
-    const modulesCmd = program
-        .command("modules")
-        .description("Module management commands");
-    registerAddCommand(modulesCmd);
-    registerSyncCommand(modulesCmd);
-    registerListCommand(modulesCmd);
-    registerUpdateCommand(modulesCmd);
-    // Package management subcommand group
-    const packagesCmd = program
-        .command("packages")
-        .description("Package management commands");
-    registerPackageInstallCommand(packagesCmd);
-    registerPackageRemoveCommand(packagesCmd);
-    registerPackageUpdateCommand(packagesCmd);
-    registerPackageListCommand(packagesCmd);
-    // Content-pack lifecycle (core/packages/hq-pack-*). Distinct from the registry
-    // `packages` system above. Available as both `hq packages packs …` (grouped)
-    // and `hq packs …` (top-level convenience).
-    registerPacksCommand(packagesCmd);
-    registerPacksCommand(program);
-    // Top-level shortcuts for package commands
-    // "hq install <slug>" = "hq packages install <slug>"
-    // "hq remove <slug>"  = "hq packages remove <slug>"
-    registerPackageInstallCommand(program);
-    registerPackageRemoveCommand(program);
-    // Marketplace publish (top-level — packer + authenticated upload, US-004)
-    // "hq publish <skill-or-worker-path>" packages and submits a pack to the
-    // marketplace via POST /v1/listings.
-    registerPublishCommand(program);
-    // `hq creators apply` — request verified-creator access (required to publish).
-    registerCreatorsCommand(program);
-    // Cloud sync subcommand group
-    const syncCmd = program
-        .command("sync")
-        .description("Cloud sync commands — sync HQ to S3 for mobile access");
-    registerCloudCommands(syncCmd);
-    registerSyncModeCommand(syncCmd);
-    registerSyncNarrowCommand(syncCmd);
-    registerSyncManifestCommand(syncCmd);
-    // Cloud provisioning subcommand group (entity + bucket + initial sync)
-    // Distinct from `hq sync` which assumes provisioning has already happened.
-    const cloudCmd = program
-        .command("cloud")
-        .description("Cloud commands — provision entities and manage cloud-backed companies");
-    registerCloudProvisionCommands(cloudCmd);
-    registerCloudDemoteCommands(cloudCmd);
-    // Team commands (top-level)
-    registerTeamSyncCommand(program);
-    // Auth commands (top-level — Cognito OAuth)
-    registerLoginCommand(program);
-    registerLogoutCommand(program);
-    registerWhoamiCommand(program);
-    registerAuthCommands(program);
-    // Secrets management (subcommand group — hq secrets set|get|list|delete|exec|generate-link|cache)
-    registerSecretsCommand(program);
-    // Vault databases (subcommand group — hq db status|sql|migrate|provision)
-    registerDbCommand(program);
-    // API key management (subcommand group — hq api-keys create|list|revoke)
-    registerApiKeysCommand(program);
-    // Schema-driven dev runner — hq run [options] -- <cmd>
-    registerRunCommand(program);
-    // Groups management (subcommand group — hq groups create|delete|add|remove|list|members)
-    registerGroupsCommand(program);
-    // Worker discovery + sharing (subcommand group — hq workers list|share)
-    registerWorkersCommand(program);
-    // Cross-company group grants (subcommand group —
-    // hq group-grants grant|revoke|outbound|inbound)
-    registerGroupGrantsCommand(program);
-    // Files ACL management (subcommand group — hq files share|unshare|acl)
-    // `registerFilesCommand` returns the `files` group so we can attach the
-    // browse-vs-sync subcommands (`hq files browse`/`cat`) onto the same group.
-    const filesCmd = registerFilesCommand(program);
-    registerFilesBrowseCommands(filesCmd);
-    // Top-level `hq access` — vault existence + ACL probe (self-healing ladder).
-    registerAccessCommand(program);
-    // Comment-only skill improvement loop. Structured suggestion/review commands are
-    // intentionally absent; live content changes remain governed by FILE_ACL sync.
-    registerSkillCommand(program);
-    // Membership management (subcommand group — hq members invite|list|revoke)
-    registerMembersCommand(program);
-    // People directory (subcommand group — hq people list|search|resolve), reading
-    // the local companies/<co>/people store scoped to one company.
-    registerPeopleCommand(program);
-    registerDmCommand(program);
-    registerChannelsCommand(program);
-    // Onboarding (top-level — Cognito + vault-service provisioning)
-    registerOnboardCommand(program);
-    // Feedback (subcommand group — hq feedback bug|feature)
-    registerFeedbackCommand(program);
-    // Meetings (subcommand group — hq meetings list|get|search|transcript|notes)
-    registerMeetingsCommand(program);
-    // Sources read surface (subcommand group — hq sources list|get|channels|entities)
-    registerSourcesCommand(program);
-    // Signals read surface (subcommand group — hq signals list|get|types|entities)
-    registerSignalsCommand(program);
-    // Company-connected apps via the governed integration gateway
-    // (subcommand group — hq integrations list|tools|call|approve|reject)
-    registerIntegrationsCommand(program);
-    // Skill/personal-overlay mirroring + workers-registry regen. Invoked by the
-    // hq-core reindex hook shim (Stop / PostToolUse) and by sync()/rescue() after
-    // they change on-disk sources. Keeps a `master-sync` alias for one release.
-    // Implementation lives in @indigoai-us/hq-cloud.
-    registerReindexCommand(program);
-    // Drift-preserving HQ-core re-sync (top-level — `hq rescue`). CLI sibling of
-    // the HQ Sync app's "Update / Restore" pill; drives the same replace-rescue.sh
-    // shipped from @indigoai-us/hq-cloud.
-    registerRescueCommand(program);
-    // MCP pack observability (subcommand group — `hq mcp status`). Read-only
-    // provenance-based status across BOTH Claude + Codex runtimes (reads `_hqPack`
-    // off the configs, NOT linkStatus), with secret-redacted output + `--json`.
-    registerMcpCommand(program);
-    // Native CRM entity upsert (subcommand group — `hq crm entity upsert`). Wraps
-    // POST /crm/entities (the ontology write gate) so an authenticated company
-    // member can create/update canonical CRM entities in the company vault.
-    registerCrmCommand(program);
-    // Company settings (subcommand group — `hq company settings set`). Owner-only
-    // toggles for crmEnabled / ontologyEnabled via PUT /company-settings.
-    registerCompanyCommand(program);
-    // Cloud agent management (subcommand group — `hq agents …`). Rename, reconfigure,
-    // start/stop, and tear down a company's fleet agents via the hq-pro /v1/agents
-    // control plane — the same routes the web console's agents panel calls.
-    registerAgentsCommand(program);
-    // Personal Outpost management (subcommand group — `hq outposts …`). List, inspect,
-    // enable Codex on, refresh login for, and destroy your EC2 boxes via the hq-pro
-    // /outpost/* control plane.
-    registerOutpostsCommand(program);
-    // Billing (subcommand group — `hq billing …`). Check subscription/card state and
-    // mint a shareable Stripe card-capture link — the client side of the paid-
-    // provisioning gate for agents & Outposts.
-    registerBillingCommand(program);
-    // HQ scaffold scripts hosted by the CLI (hidden group — `hq core …`). Not a
-    // public surface: every entry is invoked by an HQ skill, hook, or forwarder, and
-    // the source-root entries are maintainer tools that must never touch a live
-    // install. Registered from a manifest in the module, not wired per script here.
-    registerCoreCommands(program);
-    // Local qmd search and index management. Kept distinct from `hq reindex`,
-    // which converges scaffold-owned files and hooks rather than search data.
-    registerSearchCommand(program);
-    registerIndexCommand(program);
-    // Hook guardrail diagnostics (top-level — `hq doctor`). Read-only, offline
-    // verification that HQ's hooks are wired and firing, backed by an extensible
-    // check registry so later check families (vault, sync, MCP, …) plug in without
-    // engine changes.
-    registerDoctorCommand(program);
-    // Work mesh (subcommand group — `hq mesh …`). Native REST + cache. Distinct
-    // from `hq doctor` (hook guardrails). Does not start MQTT listen.
-    registerMeshCommand(program);
-}
+export { registerAllCommands, registerCommandRoot } from "./command-registration-plan.js";
 //# sourceMappingURL=register-all.js.map

package/dist/run/discover-schemas.d.ts

@@ -1,4 +1,4 @@
-export interface SchemaConflict {
+interface SchemaConflict {
     paths: [string, string];
     slugs: [string, string];
 }
@@ -9,4 +9,5 @@ export interface DiscoverSchemasResult {
     conflict: SchemaConflict | null;
 }
 export declare function discoverSchemas(cwd: string): DiscoverSchemasResult;
+export {};
 //# sourceMappingURL=discover-schemas.d.ts.map

package/dist/run/env-graph-guard.d.ts

@@ -1,5 +1,5 @@
 /** The varlock version hq-cli is pinned to (package.json `dependencies`). */
-export declare const VARLOCK_PINNED_VERSION = "1.0.0";
+export declare const VARLOCK_PINNED_VERSION = "1.21.1";
 /** A schema/plugin source varlock could not finish loading. */
 interface GuardDataSource {
     readonly isValid: boolean;
@@ -68,7 +68,7 @@ export declare function assertEnvGraphLoaded(graph: LoadedEnvGraph): void;
  * rejection into a thrown EnvResolutionError instead of hanging on the promise
  * that never settles.
  *
- * varlock@1.0.0's resolveEnvValues dispatches its per-item resolver un-awaited
+ * varlock's resolveEnvValues dispatches its per-item resolver un-awaited
  * and with a dead `_reject`, so a throw inside it becomes a process-level
  * unhandled rejection AND leaves the returned promise permanently pending. We
  * race the resolve against a scoped `unhandledRejection` listener: whichever

package/dist/run/env-graph-guard.js

@@ -34,7 +34,7 @@
 // actionable `hq: …` line WITHOUT a Sentry capture (see isVarlockEnvError).
 import { claimRejection, releaseRejection, } from "../unhandled-rejection-boundary.js";
 /** The varlock version hq-cli is pinned to (package.json `dependencies`). */
-export const VARLOCK_PINNED_VERSION = "1.0.0";
+export const VARLOCK_PINNED_VERSION = "1.21.1";
 /**
  * A schema/entry file could not be loaded, so the env graph never finished
  * processing. Carries an actionable, file-naming message; classified by
@@ -114,7 +114,7 @@ export function assertEnvGraphLoaded(graph) {
  * rejection into a thrown EnvResolutionError instead of hanging on the promise
  * that never settles.
  *
- * varlock@1.0.0's resolveEnvValues dispatches its per-item resolver un-awaited
+ * varlock's resolveEnvValues dispatches its per-item resolver un-awaited
  * and with a dead `_reject`, so a throw inside it becomes a process-level
  * unhandled rejection AND leaves the returned promise permanently pending. We
  * race the resolve against a scoped `unhandledRejection` listener: whichever
@@ -143,6 +143,9 @@ export async function resolveEnvValuesOrThrow(graph) {
     });
     process.prependOnceListener("unhandledRejection", onRejection);
     try {
+        // Preserve current varlock's direct rejection unchanged. The race only
+        // turns a floated rejection (the 1.0.0 behavior) into a typed error rather
+        // than leaving the caller waiting on a promise that never settles.
         await Promise.race([graph.resolveEnvValues(), rejection]);
     }
     finally {

package/dist/run/hq-plugin.d.ts

@@ -1,6 +1,10 @@
 import type { SecretLoadResponse, SecretUsage } from '../commands/secrets.js';
 export interface InstallHqPluginOpts {
     companyOverride?: string;
+    /** Local cache identity derived from the current Cognito person/agent token. */
+    principalUid?: string;
+    /** Only hq run opts into encrypted offline values. */
+    allowOfflineFallback?: boolean;
     resolveCompanyUid: (slug: string) => Promise<string>;
     usage?: SecretUsage;
     fetchBatch: (uid: string, names: string[], usage?: SecretUsage) => Promise<SecretLoadResponse>;

package/dist/run/hq-plugin.js

@@ -1,5 +1,6 @@
 import { ResolutionError } from 'varlock/plugin-lib';
-import { DEFAULT_SECRETS_CACHE_TTL_MS, writeCache, removeCacheEntry, } from '../utils/secrets-cache.js';
+import { DEFAULT_SECRETS_CACHE_TTL_MS, hasCacheEntry, readCache, writeCache, removeCacheEntry, } from '../utils/secrets-cache.js';
+import { CACHED_SECRETS_SERVER_UNAVAILABLE_MESSAGE, isSecretLoadUnavailable, } from '../utils/secret-load-availability.js';
 function normalizeCacheTtlMs(secret) {
     if (secret.tier === 'sensitive' ||
         secret.tier === 'nuclear' ||
@@ -22,8 +23,9 @@ export function installHqPlugin(graph /* EnvGraph */, opts) {
         errorsByName: new Map(),
         loadedSecretsByName: new Map(),
     };
-    // varlock@1.0.0's plugin-lib.js omits the Resolver export (d.ts/JS mismatch);
-    // extract it at runtime from any already-registered built-in resolver's prototype.
+    // In varlock@1.21.1, Resolver remains declared in plugin-lib's .d.mts but
+    // is not exported from its runtime module. Derive the runtime base class from
+    // a built-in resolver registered on the graph; the shape test pins this API.
     // eslint-disable-next-line @typescript-eslint/no-explicit-any
     let RuntimeResolver;
     try {
@@ -38,8 +40,8 @@ export function installHqPlugin(graph /* EnvGraph */, opts) {
         RuntimeResolver = proto;
     }
     catch (e) {
-        throw new Error('varlock Resolver base class extraction failed — the varlock@1.0.0 d.ts/JS mismatch ' +
-            'may have been resolved; switch to `import { Resolver } from "varlock/plugin-lib"`. ' +
+        throw new Error('varlock Resolver base class extraction failed — varlock@1.21.1 still declares ' +
+            'Resolver in plugin-lib types without exporting it at runtime. ' +
             `Underlying: ${e instanceof Error ? e.message : String(e)}`);
     }
     // HqResolver is declared INSIDE installHqPlugin so its static def.resolve
@@ -95,7 +97,7 @@ export function installHqPlugin(graph /* EnvGraph */, opts) {
             }
         }
     }
-    // varlock@1.0.0's env-spec parser rejects dots in decorator names ([a-zA-Z0-9_] only),
+    // Varlock's env-spec parser rejects dots in decorator names ([a-zA-Z0-9_] only),
     // so `@hq.company` is not valid syntax. We register as `@hqCompany` (camelCase) instead.
     // Schema files must use `# @hqCompany("slug")` followed by a blank line so the parser
     // treats it as a file-level root decorator rather than an item decorator for the next var.
@@ -169,6 +171,14 @@ export async function prewarmHqSecrets(graph /* EnvGraph */, opts, state) {
                 throw new Error('Invalid secret load response from vault');
             }
             seenNames.add(s.name);
+            if (s.revokedAt != null) {
+                errorsByName.set(s.name, {
+                    code: 'revoked',
+                    message: `Secret '${s.name}' has been revoked`,
+                });
+                removeCacheEntry(uid, s.name);
+                continue;
+            }
             if (s.value == null) {
                 errorsByName.set(s.name, {
                     code: 'not_returned',
@@ -180,8 +190,8 @@ export async function prewarmHqSecrets(graph /* EnvGraph */, opts, state) {
             returnedNames.add(s.name);
             state.loadedSecretsByName.set(s.name, s.value);
             const cacheTtlMs = normalizeCacheTtlMs(s);
-            if (cacheTtlMs > 0) {
-                writeCache(uid, s.name, s.value, cacheTtlMs, s.version);
+            if (cacheTtlMs > 0 && opts.principalUid) {
+                writeCache(uid, s.name, opts.principalUid, s.value, cacheTtlMs, s.version);
             }
             else {
                 removeCacheEntry(uid, s.name);
@@ -219,6 +229,24 @@ export async function prewarmHqSecrets(graph /* EnvGraph */, opts, state) {
     catch (err) {
         state.loadedSecretsByName.clear();
         state.errorsByName = new Map();
+        if (isSecretLoadUnavailable(err) && opts.allowOfflineFallback === true && opts.principalUid) {
+            const cached = new Map();
+            for (const name of uniqueNames) {
+                const value = hasCacheEntry(uid, name, opts.principalUid)
+                    ? readCache(uid, name, opts.principalUid)
+                    : null;
+                if (value === null) {
+                    throw err;
+                }
+                cached.set(name, value);
+            }
+            state.loadedSecretsByName = cached;
+            state.uid = uid;
+            console.error(CACHED_SECRETS_SERVER_UNAVAILABLE_MESSAGE);
+            return;
+        }
+        if (isSecretLoadUnavailable(err))
+            throw err;
         for (const name of uniqueNames) {
             removeCacheEntry(uid, name);
         }