@indigoai-us/hq-cli 5.47.10 → 5.47.12

package/dist/commands/secrets.js

@@ -1,10 +1,12 @@
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="bdef03fd-2f30-5034-8f32-23a5eb77cc3d")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="d01cb1a1-b851-5ffe-9608-e505e55dcdc8")}catch(e){}}();
 import chalk from "chalk";
 import * as readline from "node:readline";
 import { spawn } from "node:child_process";
+import * as nodePath from "node:path";
 import { ensureCognitoToken } from "../utils/cognito-session.js";
-import { readCache, writeCache, removeCacheEntry, clearAllCache, } from "../utils/secrets-cache.js";
+import { DEFAULT_SECRETS_CACHE_TTL_MS, readCache, writeCache, removeCacheEntry, clearAllCache, } from "../utils/secrets-cache.js";
+import { computeSha256 } from "../utils/integrity.js";
 import { SECRET_NAME_PATTERN, GROUP_ID_PATTERN } from "./_patterns.js";
 import { vaultApiFetch, getCompanyUid, getEntityUid, } from "../utils/vault-api.js";
 export { vaultApiFetch, getCompanyUid, getEntityUid };
@@ -128,6 +130,86 @@ function promptSecretInteractively() {
 // large --only list is chunked client-side rather than 400'd whole by the
 // server (the legacy per-key GET path had no such cap).
 const MAX_BATCH_NAMES = 100;
+function normalizeSecretTier(tier) {
+    return tier === "sensitive" || tier === "nuclear" ? tier : "standard";
+}
+function normalizeScriptLockMode(mode) {
+    return mode === "enforced" ? "enforced" : "off";
+}
+function normalizeCacheTtlMs(cacheTtlMs) {
+    return typeof cacheTtlMs === "number"
+        ? cacheTtlMs
+        : DEFAULT_SECRETS_CACHE_TTL_MS;
+}
+function extractApiMessage(body, fallback) {
+    const message = typeof body.message === "string" ? body.message : undefined;
+    const error = typeof body.error === "string" ? body.error : undefined;
+    return message ?? error ?? fallback;
+}
+async function buildSecretUsage(channel, scriptPath, scriptId, attestationLevel = "self-asserted-hash") {
+    if (!scriptPath) {
+        return { channel };
+    }
+    const resolvedPath = nodePath.resolve(scriptPath);
+    return {
+        channel,
+        script: {
+            scriptId: scriptId ?? resolvedPath,
+            path: resolvedPath,
+            sha256: await computeSha256(resolvedPath),
+            attestationLevel,
+        },
+    };
+}
+function normalizePolicyRecord(secretPath, data) {
+    const policy = data.policy ?? { path: secretPath };
+    const scripts = Array.isArray(policy.scripts)
+        ? policy.scripts
+        : Array.isArray(data.scripts)
+            ? data.scripts
+            : [];
+    return {
+        path: policy.path ?? secretPath,
+        tier: normalizeSecretTier(policy.tier),
+        scriptLock: {
+            mode: normalizeScriptLockMode(policy.scriptLock?.mode),
+            requiredAttestation: policy.scriptLock?.requiredAttestation,
+        },
+        scripts,
+    };
+}
+function renderPolicySummary(policy) {
+    console.log(chalk.bold(`Policy: ${policy.path}`));
+    console.log(`  Tier:          ${normalizeSecretTier(policy.tier)}`);
+    console.log(`  Script Lock:   ${normalizeScriptLockMode(policy.scriptLock?.mode)}`);
+    if (policy.scriptLock?.requiredAttestation) {
+        console.log(`  Attestation:   ${policy.scriptLock.requiredAttestation}`);
+    }
+}
+function renderPolicyScripts(scripts) {
+    if (scripts.length === 0) {
+        console.log(chalk.dim("No approved scripts."));
+        return;
+    }
+    const idWidth = Math.max(2, ...scripts.map((script) => script.scriptId.length));
+    const pathWidth = Math.max(6, ...scripts.map((script) => script.scriptPath.length));
+    const attestationWidth = Math.max(11, ...scripts.map((script) => script.attestationLevel.length));
+    const header = [
+        "ID".padEnd(idWidth),
+        "SCRIPT".padEnd(pathWidth),
+        "ATTESTATION".padEnd(attestationWidth),
+        "SHA256",
+    ].join("  ");
+    console.log(chalk.bold(header));
+    for (const script of scripts) {
+        console.log([
+            script.scriptId.padEnd(idWidth),
+            script.scriptPath.padEnd(pathWidth),
+            script.attestationLevel.padEnd(attestationWidth),
+            script.sha256,
+        ].join("  "));
+    }
+}
 // HQ-4H — load + decrypt secrets through the BATCH-LOAD endpoint
 // (`POST /secrets/{companyUid}/load`) instead of one single-secret GET per key.
 //
@@ -146,7 +228,7 @@ const MAX_BATCH_NAMES = 100;
 // Cache-first (so warm keys cost no request), chunked at MAX_BATCH_NAMES, and
 // throws on the FIRST unresolved key with the same `Failed to fetch secret
 // '<k>': <reason>` shape the per-key GET path used — never swallows a failure.
-export async function loadRevealedSecrets(token, companyUid, keys) {
+export async function loadRevealedSecrets(token, companyUid, keys, usage) {
     const resolved = new Map();
     const missing = [];
     for (const key of keys) {
@@ -164,18 +246,27 @@ export async function loadRevealedSecrets(token, companyUid, keys) {
             token,
             path: `/secrets/${encodeURIComponent(companyUid)}/load`,
             method: "POST",
-            body: { names: chunk },
+            body: usage ? { names: chunk, usage } : { names: chunk },
         });
         if (!res.ok) {
             const body = (await res.json().catch(() => ({})));
-            throw new Error(`Failed to batch-load secrets: ${body.error ?? res.statusText}`);
+            const message = extractApiMessage(body, res.statusText);
+            if (res.status >= 400 &&
+                res.status < 500 &&
+                typeof body.code === "string") {
+                throw new Error(message);
+            }
+            throw new Error(`Failed to batch-load secrets: ${message}`);
         }
         const data = (await res.json());
         for (const s of data.secrets ?? []) {
             if (s.value == null) {
                 throw new Error(`Secret '${s.name}' has no value (reveal may not be permitted).`);
             }
-            writeCache(companyUid, s.name, s.value);
+            const cacheTtlMs = normalizeCacheTtlMs(s.cacheTtlMs);
+            if (cacheTtlMs > 0) {
+                writeCache(companyUid, s.name, s.value, cacheTtlMs);
+            }
             resolved.set(s.name, s.value);
         }
         const errorsByName = new Map();
@@ -267,21 +358,26 @@ export function registerSecretsCommand(program) {
         try {
             const token = await ensureCognitoToken();
             const companyUid = await getEntityUid(token, scopeOpts(secrets.opts()));
-            const query = {};
-            if (opts.reveal) {
-                query.reveal = "true";
-            }
             const res = await vaultApiFetch({
                 token,
                 path: buildSecretNamePath(companyUid, name),
-                query: Object.keys(query).length > 0 ? query : undefined,
             });
             if (!res.ok) {
-                const body = await res.json().catch(() => ({}));
-                console.error(chalk.red(`Failed to get secret: ${body.error ?? res.statusText}`));
+                const body = (await res.json().catch(() => ({})));
+                console.error(chalk.red(`Failed to get secret: ${extractApiMessage(body, res.statusText)}`));
                 process.exit(1);
             }
             const data = (await res.json());
+            let revealedValue;
+            let revealError = null;
+            if (opts.reveal) {
+                try {
+                    revealedValue = (await loadRevealedSecrets(token, companyUid, [name], await buildSecretUsage("reveal"))).get(name);
+                }
+                catch (err) {
+                    revealError = err instanceof Error ? err.message : String(err);
+                }
+            }
             const s = data.secret;
             console.log(chalk.bold(`Secret: ${s.name}`));
             if (s.lastModifiedDate) {
@@ -290,12 +386,18 @@ export function registerSecretsCommand(program) {
             if (s.version != null) {
                 console.log(`  Version:       ${s.version}`);
             }
-            if (opts.reveal && s.value != null) {
-                console.log(`  Value:         ${s.value}`);
+            console.log(`  Tier:          ${normalizeSecretTier(s.tier)}`);
+            console.log(`  Script Lock:   ${normalizeScriptLockMode(s.scriptLock?.mode)}`);
+            if (opts.reveal && revealedValue != null) {
+                console.log(`  Value:         ${revealedValue}`);
             }
             else {
                 console.log(`  Value:         ${chalk.dim("[REDACTED]")}`);
             }
+            if (revealError) {
+                console.error(chalk.red(revealError));
+                process.exit(1);
+            }
         }
         catch (err) {
             console.error(chalk.red("Error:"), err instanceof Error ? err.message : String(err));
@@ -384,24 +486,244 @@ export function registerSecretsCommand(program) {
             }
             const nameWidth = Math.max(4, ...data.secrets.map((s) => s.name.length));
             const hasPermission = data.secrets.some((s) => s.permission !== undefined);
+            const tierWidth = Math.max(4, ...data.secrets.map((s) => normalizeSecretTier(s.tier).length));
+            const scriptLockWidth = Math.max(11, ...data.secrets.map((s) => normalizeScriptLockMode(s.scriptLock?.mode).length));
             if (hasPermission) {
                 const accessWidth = Math.max(6, ...data.secrets.map((s) => (s.permission ?? "-").length));
-                const header = `${"NAME".padEnd(nameWidth)}  ${"ACCESS".padEnd(accessWidth)}  LAST MODIFIED`;
+                const header = `${"NAME".padEnd(nameWidth)}  ${"ACCESS".padEnd(accessWidth)}  ${"TIER".padEnd(tierWidth)}  ${"SCRIPT LOCK".padEnd(scriptLockWidth)}  LAST MODIFIED`;
                 console.log(chalk.bold(header));
                 for (const s of data.secrets) {
                     const access = s.permission ?? "-";
+                    const tier = normalizeSecretTier(s.tier);
+                    const scriptLock = normalizeScriptLockMode(s.scriptLock?.mode);
                     const modified = s.lastModifiedDate ?? "-";
-                    console.log(`${s.name.padEnd(nameWidth)}  ${access.padEnd(accessWidth)}  ${modified}`);
+                    console.log(`${s.name.padEnd(nameWidth)}  ${access.padEnd(accessWidth)}  ${tier.padEnd(tierWidth)}  ${scriptLock.padEnd(scriptLockWidth)}  ${modified}`);
                 }
             }
             else {
-                const header = `${"NAME".padEnd(nameWidth)}  LAST MODIFIED`;
+                const header = `${"NAME".padEnd(nameWidth)}  ${"TIER".padEnd(tierWidth)}  ${"SCRIPT LOCK".padEnd(scriptLockWidth)}  LAST MODIFIED`;
                 console.log(chalk.bold(header));
                 for (const s of data.secrets) {
+                    const tier = normalizeSecretTier(s.tier);
+                    const scriptLock = normalizeScriptLockMode(s.scriptLock?.mode);
                     const modified = s.lastModifiedDate ?? "-";
-                    console.log(`${s.name.padEnd(nameWidth)}  ${modified}`);
+                    console.log(`${s.name.padEnd(nameWidth)}  ${tier.padEnd(tierWidth)}  ${scriptLock.padEnd(scriptLockWidth)}  ${modified}`);
+                }
+            }
+        }
+        catch (err) {
+            console.error(chalk.red("Error:"), err instanceof Error ? err.message : String(err));
+            process.exit(1);
+        }
+    });
+    const policy = secrets
+        .command("policy")
+        .description("View or update secret access policy");
+    policy
+        .command("get <path>")
+        .description("Show the policy for a secret path")
+        .action(async (secretPath) => {
+        try {
+            rejectIfPersonal(secrets.opts(), "policy get");
+            if (!SECRET_NAME_PATTERN.test(secretPath)) {
+                console.error(chalk.red(`Invalid secret path '${secretPath}': must match ^[A-Z][A-Z0-9_]*(/[A-Z][A-Z0-9_]+)*$ (e.g. MY_KEY or PROD/DB_PASSWORD)`));
+                process.exit(1);
+            }
+            const token = await ensureCognitoToken();
+            const companyUid = await getEntityUid(token, scopeOpts(secrets.opts()));
+            const res = await vaultApiFetch({
+                token,
+                path: `/secrets/${encodeURIComponent(companyUid)}/policy`,
+                query: { path: secretPath },
+            });
+            if (res.status === 404) {
+                renderPolicySummary(normalizePolicyRecord(secretPath, { policy: { path: secretPath } }));
+                return;
+            }
+            if (!res.ok) {
+                const body = (await res.json().catch(() => ({})));
+                console.error(chalk.red(`Failed to get policy: ${extractApiMessage(body, res.statusText)}`));
+                process.exit(1);
+            }
+            const data = (await res.json());
+            renderPolicySummary(normalizePolicyRecord(secretPath, data));
+        }
+        catch (err) {
+            console.error(chalk.red("Error:"), err instanceof Error ? err.message : String(err));
+            process.exit(1);
+        }
+    });
+    policy
+        .command("set <path>")
+        .description("Set the policy for a secret path")
+        .option("--tier <tier>", "Secret tier: standard | sensitive | nuclear")
+        .option("--lock-script <mode>", "Script-lock mode: off | enforce")
+        .action(async (secretPath, opts) => {
+        try {
+            rejectIfPersonal(secrets.opts(), "policy set");
+            if (!SECRET_NAME_PATTERN.test(secretPath)) {
+                console.error(chalk.red(`Invalid secret path '${secretPath}': must match ^[A-Z][A-Z0-9_]*(/[A-Z][A-Z0-9_]+)*$ (e.g. MY_KEY or PROD/DB_PASSWORD)`));
+                process.exit(1);
+            }
+            const tier = opts.tier;
+            if (tier !== undefined &&
+                tier !== "standard" &&
+                tier !== "sensitive" &&
+                tier !== "nuclear") {
+                console.error(chalk.red(`Invalid tier '${tier}': must be one of standard, sensitive, nuclear`));
+                process.exit(1);
+            }
+            let scriptLock;
+            if (opts.lockScript !== undefined) {
+                if (opts.lockScript === "off") {
+                    scriptLock = { mode: "off" };
+                }
+                else if (opts.lockScript === "enforce") {
+                    scriptLock = { mode: "enforced" };
+                }
+                else {
+                    console.error(chalk.red(`Invalid script lock mode '${opts.lockScript}': must be one of off, enforce`));
+                    process.exit(1);
                 }
             }
+            if (tier === undefined && scriptLock === undefined) {
+                console.error(chalk.red("Error: provide at least one of --tier or --lock-script."));
+                process.exit(1);
+            }
+            const token = await ensureCognitoToken();
+            const companyUid = await getEntityUid(token, scopeOpts(secrets.opts()));
+            const res = await vaultApiFetch({
+                token,
+                path: `/secrets/${encodeURIComponent(companyUid)}/policy`,
+                method: "PUT",
+                body: {
+                    path: secretPath,
+                    ...(tier !== undefined ? { tier } : {}),
+                    ...(scriptLock ? { scriptLock } : {}),
+                },
+            });
+            if (!res.ok) {
+                const body = (await res.json().catch(() => ({})));
+                console.error(chalk.red(`Failed to set policy: ${extractApiMessage(body, res.statusText)}`));
+                process.exit(1);
+            }
+            const data = (await res.json().catch(() => ({})));
+            console.log(chalk.green(`Policy updated for '${secretPath}'.`));
+            renderPolicySummary(normalizePolicyRecord(secretPath, data.policy ? data : { policy: { path: secretPath, tier, scriptLock } }));
+        }
+        catch (err) {
+            console.error(chalk.red("Error:"), err instanceof Error ? err.message : String(err));
+            process.exit(1);
+        }
+    });
+    const script = secrets
+        .command("script")
+        .description("Manage approved scripts for script-locked secrets");
+    script
+        .command("approve <path>")
+        .description("Approve a script for a secret path")
+        .requiredOption("--id <scriptId>", "Stable script identifier")
+        .requiredOption("--script <path>", "Path to the local script file")
+        .option("--attestation <level>", "Attestation level", "self-asserted-hash")
+        .action(async (secretPath, opts) => {
+        try {
+            rejectIfPersonal(secrets.opts(), "script approve");
+            if (!SECRET_NAME_PATTERN.test(secretPath)) {
+                console.error(chalk.red(`Invalid secret path '${secretPath}': must match ^[A-Z][A-Z0-9_]*(/[A-Z][A-Z0-9_]+)*$ (e.g. MY_KEY or PROD/DB_PASSWORD)`));
+                process.exit(1);
+            }
+            const usage = await buildSecretUsage("exec", opts.script, opts.id, opts.attestation);
+            const token = await ensureCognitoToken();
+            const companyUid = await getEntityUid(token, scopeOpts(secrets.opts()));
+            const res = await vaultApiFetch({
+                token,
+                path: `/secrets/${encodeURIComponent(companyUid)}/policy/scripts`,
+                method: "POST",
+                body: {
+                    path: secretPath,
+                    scriptId: usage.script?.scriptId,
+                    scriptPath: usage.script?.path,
+                    sha256: usage.script?.sha256,
+                    attestationLevel: usage.script?.attestationLevel,
+                },
+            });
+            if (!res.ok) {
+                const body = (await res.json().catch(() => ({})));
+                console.error(chalk.red(`Failed to approve script: ${extractApiMessage(body, res.statusText)}`));
+                process.exit(1);
+            }
+            console.log(chalk.green(`Approved script '${opts.id}' for '${secretPath}'.`));
+        }
+        catch (err) {
+            console.error(chalk.red("Error:"), err instanceof Error ? err.message : String(err));
+            process.exit(1);
+        }
+    });
+    script
+        .command("revoke <path>")
+        .description("Revoke an approved script from a secret path")
+        .requiredOption("--id <scriptId>", "Stable script identifier")
+        .action(async (secretPath, opts) => {
+        try {
+            rejectIfPersonal(secrets.opts(), "script revoke");
+            if (!SECRET_NAME_PATTERN.test(secretPath)) {
+                console.error(chalk.red(`Invalid secret path '${secretPath}': must match ^[A-Z][A-Z0-9_]*(/[A-Z][A-Z0-9_]+)*$ (e.g. MY_KEY or PROD/DB_PASSWORD)`));
+                process.exit(1);
+            }
+            const token = await ensureCognitoToken();
+            const companyUid = await getEntityUid(token, scopeOpts(secrets.opts()));
+            const res = await vaultApiFetch({
+                token,
+                path: `/secrets/${encodeURIComponent(companyUid)}/policy/scripts`,
+                method: "DELETE",
+                body: { path: secretPath, scriptId: opts.id },
+            });
+            if (!res.ok) {
+                const body = (await res.json().catch(() => ({})));
+                console.error(chalk.red(`Failed to revoke script: ${extractApiMessage(body, res.statusText)}`));
+                process.exit(1);
+            }
+            console.log(chalk.green(`Revoked script '${opts.id}' for '${secretPath}'.`));
+        }
+        catch (err) {
+            console.error(chalk.red("Error:"), err instanceof Error ? err.message : String(err));
+            process.exit(1);
+        }
+    });
+    script
+        .command("list <path>")
+        .description("List approved scripts for a secret path")
+        .action(async (secretPath) => {
+        try {
+            rejectIfPersonal(secrets.opts(), "script list");
+            if (!SECRET_NAME_PATTERN.test(secretPath)) {
+                console.error(chalk.red(`Invalid secret path '${secretPath}': must match ^[A-Z][A-Z0-9_]*(/[A-Z][A-Z0-9_]+)*$ (e.g. MY_KEY or PROD/DB_PASSWORD)`));
+                process.exit(1);
+            }
+            const token = await ensureCognitoToken();
+            const companyUid = await getEntityUid(token, scopeOpts(secrets.opts()));
+            const res = await vaultApiFetch({
+                token,
+                path: `/secrets/${encodeURIComponent(companyUid)}/policy`,
+                query: { path: secretPath },
+            });
+            if (res.status === 404) {
+                const policyRecord = normalizePolicyRecord(secretPath, {
+                    policy: { path: secretPath },
+                });
+                renderPolicySummary(policyRecord);
+                renderPolicyScripts(policyRecord.scripts);
+                return;
+            }
+            if (!res.ok) {
+                const body = (await res.json().catch(() => ({})));
+                console.error(chalk.red(`Failed to list scripts: ${extractApiMessage(body, res.statusText)}`));
+                process.exit(1);
+            }
+            const data = (await res.json());
+            const policyRecord = normalizePolicyRecord(secretPath, data);
+            renderPolicySummary(policyRecord);
+            renderPolicyScripts(policyRecord.scripts);
         }
         catch (err) {
             console.error(chalk.red("Error:"), err instanceof Error ? err.message : String(err));
@@ -449,6 +771,7 @@ export function registerSecretsCommand(program) {
         .command("exec")
         .description("Run a command with secrets injected as env vars")
         .requiredOption("--only <keys>", "Comma-separated list of secret names to inject (required)")
+        .option("--script <path>", "Attach local script identity for script-locked secrets")
         .allowUnknownOption(true)
         .action(async (_opts, cmd) => {
         try {
@@ -478,7 +801,7 @@ export function registerSecretsCommand(program) {
             }
             const token = await ensureCognitoToken();
             const companyUid = await getEntityUid(token, scopeOpts(secrets.opts()));
-            const revealed = await loadRevealedSecrets(token, companyUid, keys);
+            const revealed = await loadRevealedSecrets(token, companyUid, keys, await buildSecretUsage("exec", _opts.script));
             const secretEnv = {};
             for (const key of keys) {
                 const value = revealed.get(key);
@@ -514,6 +837,7 @@ export function registerSecretsCommand(program) {
         .command("env")
         .description("Print 'export KEY=VALUE' lines suitable for: source <(hq secrets env --only K1,K2)")
         .requiredOption("--only <keys>", "Comma-separated list of secret names to print (required)")
+        .option("--script <path>", "Attach local script identity for script-locked secrets")
         .action(async (opts) => {
         try {
             const redact = process.stdout.isTTY;
@@ -533,7 +857,7 @@ export function registerSecretsCommand(program) {
             }
             const token = await ensureCognitoToken();
             const companyUid = await getEntityUid(token, scopeOpts(secrets.opts()));
-            const revealed = await loadRevealedSecrets(token, companyUid, keys);
+            const revealed = await loadRevealedSecrets(token, companyUid, keys, await buildSecretUsage("env", opts.script));
             for (const key of keys) {
                 const value = revealed.get(key);
                 // loadRevealedSecrets throws on any unresolved key, so a miss here is
@@ -801,4 +1125,4 @@ export function registerSecretsCommand(program) {
     });
 }
 //# sourceMappingURL=secrets.js.map
-//# debugId=bdef03fd-2f30-5034-8f32-23a5eb77cc3d
+//# debugId=d01cb1a1-b851-5ffe-9608-e505e55dcdc8

package/dist/run/hq-plugin.d.ts

@@ -1,17 +1,9 @@
+import type { SecretLoadResponse, SecretUsage } from '../commands/secrets.js';
 export interface InstallHqPluginOpts {
     companyOverride?: string;
     resolveCompanyUid: (slug: string) => Promise<string>;
-    fetchBatch: (uid: string, names: string[]) => Promise<{
-        secrets: Array<{
-            name: string;
-            value: string;
-        }>;
-        errors: Array<{
-            name: string;
-            code: string;
-            message?: string;
-        }>;
-    }>;
+    usage?: SecretUsage;
+    fetchBatch: (uid: string, names: string[], usage?: SecretUsage) => Promise<SecretLoadResponse>;
 }
 export interface PluginState {
     schemaCompanySlug: string | null;
@@ -20,6 +12,7 @@ export interface PluginState {
         code: string;
         message?: string;
     }>;
+    loadedSecretsByName: Map<string, string>;
 }
 export declare function installHqPlugin(graph: any, opts: InstallHqPluginOpts): PluginState;
 export declare function prewarmHqSecrets(graph: any, opts: InstallHqPluginOpts, state: PluginState): Promise<void>;

package/dist/run/hq-plugin.js

@@ -1,12 +1,18 @@
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="01fee323-1f63-5411-bfc9-ff49e241f712")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="63aeb21a-b1e7-5bff-8c7d-560fad3cc0dd")}catch(e){}}();
 import { ResolutionError } from 'varlock/plugin-lib';
-import { readCache, writeCache } from '../utils/secrets-cache.js';
+import { DEFAULT_SECRETS_CACHE_TTL_MS, readCache, writeCache, } from '../utils/secrets-cache.js';
+function normalizeCacheTtlMs(cacheTtlMs) {
+    return typeof cacheTtlMs === 'number'
+        ? cacheTtlMs
+        : DEFAULT_SECRETS_CACHE_TTL_MS;
+}
 export function installHqPlugin(graph /* EnvGraph */, opts) {
     const pluginState = {
         schemaCompanySlug: null,
         uid: null,
         errorsByName: new Map(),
+        loadedSecretsByName: new Map(),
     };
     // varlock@1.0.0's plugin-lib.js omits the Resolver export (d.ts/JS mismatch);
     // extract it at runtime from any already-registered built-in resolver's prototype.
@@ -63,6 +69,10 @@ export function installHqPlugin(graph /* EnvGraph */, opts) {
                 if (pluginState.uid == null) {
                     throw new ResolutionError('Internal error: prewarmHqSecrets was not called before resolveEnvValues');
                 }
+                const inMemory = pluginState.loadedSecretsByName.get(secretName);
+                if (inMemory != null) {
+                    return inMemory;
+                }
                 const cached = readCache(pluginState.uid, secretName); // string | null
                 if (cached == null) {
                     throw new ResolutionError(`Internal error: pre-warm did not populate cache for "${secretName}"`);
@@ -129,9 +139,16 @@ export async function prewarmHqSecrets(graph /* EnvGraph */, opts, state) {
     if (uniqueNames.length > 100) {
         throw new Error(`hq run supports at most 100 hq() resolvers per schema; got ${uniqueNames.length}`);
     }
-    const result = await opts.fetchBatch(uid, uniqueNames);
+    const result = await opts.fetchBatch(uid, uniqueNames, opts.usage);
     for (const s of result.secrets) {
-        writeCache(uid, s.name, s.value);
+        if (s.value == null) {
+            continue;
+        }
+        state.loadedSecretsByName.set(s.name, s.value);
+        const cacheTtlMs = normalizeCacheTtlMs(s.cacheTtlMs);
+        if (cacheTtlMs > 0) {
+            writeCache(uid, s.name, s.value, cacheTtlMs);
+        }
     }
     const errorsByName = new Map();
     for (const e of result.errors) {
@@ -141,4 +158,4 @@ export async function prewarmHqSecrets(graph /* EnvGraph */, opts, state) {
     state.uid = uid;
 }
 //# sourceMappingURL=hq-plugin.js.map
-//# debugId=01fee323-1f63-5411-bfc9-ff49e241f712
+//# debugId=63aeb21a-b1e7-5bff-8c7d-560fad3cc0dd

package/dist/utils/integrity.d.ts

@@ -1,6 +1,10 @@
 /**
  * Integrity verification — SHA256 hash and RSA signature checks (US-005)
  */
+/**
+ * Verify a file's SHA256 hash matches the expected value.
+ */
+export declare function computeSha256(filePath: string): Promise<string>;
 /**
  * Verify a file's SHA256 hash matches the expected value.
  */

package/dist/utils/integrity.js

@@ -2,7 +2,7 @@
  * Integrity verification — SHA256 hash and RSA signature checks (US-005)
  */
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="820f12b3-4caf-5f08-9add-621628715744")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="e47a47a7-a9cf-56f1-9522-983ebaa0e5cb")}catch(e){}}();
 import * as crypto from 'crypto';
 import * as fs from 'fs';
 import * as path from 'path';
@@ -10,18 +10,22 @@ import { resolveDefaultHqRoot } from './cognito-session.js';
 /**
  * Verify a file's SHA256 hash matches the expected value.
  */
-export async function verifySha256(filePath, expectedHash) {
+export async function computeSha256(filePath) {
     return new Promise((resolve, reject) => {
         const hash = crypto.createHash('sha256');
         const stream = fs.createReadStream(filePath);
         stream.on('data', (chunk) => hash.update(chunk));
-        stream.on('end', () => {
-            const computed = hash.digest('hex');
-            resolve(computed === expectedHash.toLowerCase());
-        });
+        stream.on('end', () => resolve(hash.digest('hex')));
         stream.on('error', reject);
     });
 }
+/**
+ * Verify a file's SHA256 hash matches the expected value.
+ */
+export async function verifySha256(filePath, expectedHash) {
+    const computed = await computeSha256(filePath);
+    return computed === expectedHash.toLowerCase();
+}
 /**
  * Verify an RSA signature of a SHA256 hash using the registry public key.
  * The public key is expected at packages/.keys/registry-public.pem.
@@ -40,4 +44,4 @@ export function verifyRsaSignature(sha256Hash, signature, publicKeyPath) {
     return verifier.verify(publicKey, Buffer.from(signature, 'base64'));
 }
 //# sourceMappingURL=integrity.js.map
-//# debugId=820f12b3-4caf-5f08-9add-621628715744
+//# debugId=e47a47a7-a9cf-56f1-9522-983ebaa0e5cb

package/dist/utils/secrets-cache.d.ts

@@ -1,5 +1,6 @@
+export declare const DEFAULT_SECRETS_CACHE_TTL_MS: number;
 export declare function readCache(companyUid: string, name: string): string | null;
-export declare function writeCache(companyUid: string, name: string, value: string): void;
+export declare function writeCache(companyUid: string, name: string, value: string, ttlMs?: number): void;
 export declare function removeCacheEntry(companyUid: string, name: string): void;
 export declare function clearAllCache(): {
     removed: number;