@indigoai-us/hq-cloud 6.15.0 → 6.15.2

package/src/index.ts

@@ -1,439 +0,0 @@
-/**
- * @indigoai-us/hq-cloud — public API
- *
- * VLT-5: Entity-aware sync engine. Operations resolve their target bucket
- * and credentials from the vault-service entity registry + STS vending.
- */
-
-export {
-  resolveEntityContext,
-  refreshEntityContext,
-  clearContextCache,
-  isExpiringSoon,
-} from "./context.js";
-
-export {
-  uploadFile,
-  downloadFile,
-  listRemoteFiles,
-  deleteRemoteFile,
-  headRemoteFile,
-  toPosixKey,
-} from "./s3.js";
-
-export type { RemoteFile, UploadAuthor } from "./s3.js";
-
-export {
-  readJournal,
-  writeJournal,
-  hashFile,
-  updateEntry,
-  getEntry,
-  removeEntry,
-  getJournalPath,
-  // State-dir + all-shard enumeration. `listJournals` is the single source of
-  // truth for "every journal the engine can write" — surfaces like
-  // `hq sync status` must read all shards through it, never a single path.
-  getStateDir,
-  listJournals,
-  // Journal v2 (US-005)
-  migrateToV2,
-  generatePullId,
-  appendPullRecord,
-  lastPullRecord,
-  tombstoneEntry,
-  isTombstone,
-  gcTombstones,
-  TOMBSTONE_TTL_MS,
-  JOURNAL_VERSION_CURRENT,
-  // Canonical personal-vault journal slug + its one-time legacy seed. Exported
-  // so downstream CLIs (hq-cli `sync --personal`) journal the personal vault
-  // under the SAME slug as hq-sync-runner. hq-cli hardcoding the legacy
-  // `"personal"` slug split the vault's bookkeeping across two journal files —
-  // each surface re-flagged the other's already-synced files as conflicts.
-  PERSONAL_VAULT_JOURNAL_SLUG,
-  migratePersonalVaultJournal,
-} from "./journal.js";
-
-export type { JournalSummary } from "./journal.js";
-
-// Cross-process sync progress — every sync path writes one shared snapshot so
-// a watcher (the hq-sync menubar) can show live progress for ANY sync.
-export {
-  createSyncProgressRecorder,
-  readSyncProgress,
-  syncProgressPath,
-} from "./sync-progress.js";
-export type { SyncProgressSnapshot } from "./sync-progress.js";
-
-// Prefix coalescing helper (US-005)
-export {
-  coalescePrefixes,
-  isCoveredByAny,
-  grantPathToPrefix,
-  grantPathToScopePrefix,
-  pathToScopePrefix,
-  toScopePrefixEntries,
-} from "./prefix-coalesce.js";
-export type {
-  ScopePrefixEntry,
-  ScopePrefixInput,
-  ScopePrefixMatch,
-} from "./prefix-coalesce.js";
-
-// Scope-shrink detection + application (US-005)
-export {
-  buildScopeShrinkPlan,
-  applyScopeShrink,
-  ScopeShrinkBlockedError,
-  ScopeShrinkLargePruneError,
-} from "./scope-shrink.js";
-export type {
-  OrphanClassification,
-  ScopeShrinkPlan,
-  BuildScopeShrinkPlanInput,
-  ApplyScopeShrinkInput,
-  ApplyScopeShrinkResult,
-  ScopeShrinkAdviceContext,
-  CleanOrphanDisposition,
-} from "./scope-shrink.js";
-
-// Engine-layer ACL-aware pull orchestration (US-005)
-export {
-  resolveCompanyScope,
-  batchPrefixesForVend,
-  listRemoteForScope,
-  pullCompany,
-  decideRemotePulls,
-  VEND_PATH_CAP,
-  POST_FILTER_THRESHOLD,
-  VEND_FANOUT_CONCURRENCY,
-} from "./remote-pull.js";
-export type {
-  CompanyScope,
-  ResolveCompanyScopeInput,
-  ListRemoteForScopeInput,
-  PullCompanyInput,
-  PullCompanyResult,
-  RemotePullDecision,
-  DecideRemotePullsInput,
-  SkippedKey,
-} from "./remote-pull.js";
-
-export {
-  createIgnoreFilter,
-  isWithinSizeLimit,
-} from "./ignore.js";
-
-// Cognito browser-OAuth (VLT-9)
-export {
-  browserLogin,
-  refreshTokens,
-  loadCachedTokens,
-  saveCachedTokens,
-  clearCachedTokens,
-  accessTokenFingerprint,
-  invalidateCachedTokensByFingerprint,
-  isExpiring,
-  getValidAccessToken,
-  CognitoAuthError,
-  CognitoRefreshError,
-  machineCredsFilePath,
-  loadMachineCreds,
-  isMachineIdentity,
-  mintMachineTokens,
-  getValidMachineTokens,
-} from "./cognito-auth.js";
-export type {
-  CognitoAuthConfig,
-  CognitoTokens,
-  MachineCreds,
-} from "./cognito-auth.js";
-
-// Per-company PULL scope resolver (US-005) — shared between hq-sync-runner and
-// `hq sync pull|now` (hq-cli). Exported so hq-cli's foreground pull paths resolve
-// the SAME effective scope the menubar runner does, instead of defaulting every
-// CLI pull to `syncMode: "all"` (the seed of the all→shared scope-shrink wedge,
-// DEV-1768).
-export {
-  resolvePullScope,
-  readPinnedPrefixes,
-  SESSIONS_SCOPE_PREFIX,
-} from "./sync/pull-scope.js";
-export type { PullScope, PullScopeClient } from "./sync/pull-scope.js";
-
-// Personal-vault scope helpers — shared between hq-sync-runner and `hq sync`
-export {
-  PERSONAL_VAULT_EXCLUDED_TOP_LEVEL,
-  PERSONAL_VAULT_COMPANY_EXCLUDED_SLUGS,
-  CONTINUITY_POINTER_REL,
-  SESSION_LOGS_SYNC_REL,
-  computePersonalVaultPaths,
-  computePersonalCompanySubdirs,
-  computeContinuityPointerPaths,
-  computeSessionLogsSyncPaths,
-} from "./personal-vault.js";
-export type { PersonalVaultOptions } from "./personal-vault.js";
-
-// Personal-vault default-exclusions (5.25+) — second-tier deep-walk filter
-// for secrets, machine-local state, scratch dirs, OS/build cruft.
-export {
-  PERSONAL_VAULT_DEFAULT_EXCLUSIONS,
-  isPersonalVaultExcluded,
-  matchPersonalVaultExclusion,
-  wrapFilterWithPersonalVaultDefaults,
-} from "./personal-vault-exclusions.js";
-export type { PersonalVaultExclusion } from "./personal-vault-exclusions.js";
-
-// VaultClient SDK (VLT-7)
-export { VaultClient, pickCanonicalPersonEntity } from "./vault-client.js";
-export {
-  VaultClientError,
-  VaultAuthError,
-  VaultPermissionDeniedError,
-  VaultNotFoundError,
-  VaultConflictError,
-} from "./vault-client.js";
-export type {
-  MembershipRole,
-  MembershipStatus,
-  Membership,
-  CreateInviteInput,
-  CreateInviteResult,
-  AcceptInviteResult,
-  UpdateRoleInput,
-  EntityInfo,
-  CreateEntityInput,
-  CreateEntityResult,
-  PendingInviteByEmail,
-  TelemetryOptInResponse,
-  UsageBatch,
-  UsageIngestResult,
-  RawTelemetryEventInput,
-  TelemetryEventsBatch,
-  TelemetryEventsIngestResult,
-  SkillInvocationBatch,
-  SkillInvocationIngestResult,
-  // US-004 — browse-vs-sync membership sync-mode + ACL surface
-  SyncMode,
-  MembershipSyncConfig,
-  SetMembershipSyncConfigInput,
-  ExplicitGrant,
-} from "./vault-client.js";
-
-// Usage telemetry collector (`/v1/usage`). Re-exported so wrappers other than
-// `hq-sync-runner` (mobile, custom CLIs) can run the collector on their own
-// schedule without re-implementing the cursor + sanitizer.
-export { collectAndSendTelemetry, sanitizeRow } from "./telemetry.js";
-export type {
-  CollectTelemetryOptions,
-  CollectTelemetryResult,
-  TelemetryClientSurface,
-} from "./telemetry.js";
-
-// hq-cloud ACTION telemetry (`/v1/telemetry/events`). Unlike token/skill
-// collectors, these sync/CLI events are not gated by `/v1/usage` opt-in.
-export {
-  agentUidFromClaims,
-  emitCloudTelemetry,
-} from "./telemetry-events.js";
-export type {
-  CloudTelemetryClient,
-  EmitCloudTelemetryOptions,
-  TelemetryClaims,
-  TelemetryEvent,
-  TelemetryProperties,
-} from "./telemetry-events.js";
-
-// Skill-invocation telemetry collector (`/v1/skill-invocations`). Reads the
-// same Claude Code session logs as the token collector but extracts which
-// skill / slash-command was invoked. Independent cursor; same opt-in gate.
-export {
-  collectAndSendSkillTelemetry,
-  extractSkillEvents,
-} from "./skill-telemetry.js";
-export type {
-  CollectSkillTelemetryOptions,
-  CollectSkillTelemetryResult,
-  SkillEvent,
-  SkillTelemetryClientSurface,
-} from "./skill-telemetry.js";
-
-// STS child vending (VLT-8)
-export type {
-  TaskAction,
-  TaskScope,
-  VendChildInput,
-  VendChildResult,
-  StsChildCredentials,
-} from "./vault-client.js";
-
-// Raw vend (POST /vend, purpose-aware after US-009)
-export type {
-  VendPurpose,
-  VaultOperation,
-  VendInput,
-  VendResult,
-  VendCredentials,
-} from "./vault-client.js";
-
-// CLI commands
-export { share, sync } from "./cli/index.js";
-export type { ShareOptions, ShareResult, SyncOptions, SyncResult, SyncProgressEvent } from "./cli/index.js";
-export { resolveConflict, showDiff } from "./cli/index.js";
-export type { ConflictStrategy, ConflictInfo, ConflictResolution } from "./cli/index.js";
-
-// Membership CLI commands (VLT-7)
-export { invite, listInvites, revokeInvite } from "./cli/index.js";
-export type { InviteOptions, InviteResult, InviteListOptions, InviteRevokeOptions } from "./cli/index.js";
-export { accept, parseToken } from "./cli/index.js";
-export type { AcceptOptions, AcceptResult } from "./cli/index.js";
-export { promote } from "./cli/index.js";
-export type { PromoteOptions, PromoteResult } from "./cli/index.js";
-
-// Skill wrappers + retired personal-overlay mirror cleanup + workers-registry
-// regen (`hq reindex`). The personal overlay is read directly now, not mirrored.
-export { reindex } from "./cli/index.js";
-export type { ReindexOptions, ReindexResult } from "./cli/index.js";
-
-// Drift-preserving HQ-core re-sync — shared by the HQ Sync app and `hq rescue`.
-export { rescue, buildRescueArgs } from "./cli/index.js";
-export type { RescueOptions, RescueResult } from "./cli/index.js";
-
-// `hq sync doctor` — skill-key dedupe + local farm GC (US-003). Consumed by
-// @indigoai-us/hq-cli's `sync doctor` subcommand.
-export { syncDoctor, SKILLS_KEY_PREFIX } from "./cli/index.js";
-export type {
-  SyncDoctorOptions,
-  SyncDoctorResult,
-  SyncDoctorPlan,
-  DoctorStore,
-} from "./cli/index.js";
-
-export type {
-  EntityContext,
-  VaultCredentials,
-  VaultServiceConfig,
-  ClientInfo,
-  SyncConfig,
-  Credentials,
-  JournalEntry,
-  SyncJournal,
-  PullRecord,
-  SyncStatus,
-  PushResult,
-  PullResult,
-  DaemonState,
-} from "./types.js";
-
-// Client identification — every first-party caller should construct one of
-// these once at startup and pass it in via VaultServiceConfig.clientInfo.
-export {
-  buildClientHeaders,
-  clientInfoFromPackage,
-  detectHqCoreVersion,
-  HEADER_CLIENT_NAME,
-  HEADER_CLIENT_VERSION,
-  HEADER_HQ_CORE_VERSION,
-} from "./client-info.js";
-
-// Source-channel + signal-type schemas (SoT)
-export {
-  SOURCE_CHANNELS,
-  isSourceChannel,
-  assertSourceChannel,
-  InvalidSourceChannelError,
-  sourcePathSegment,
-} from "./schemas/source-channels.js";
-export type { SourceChannel } from "./schemas/source-channels.js";
-
-export {
-  SIGNAL_TYPES,
-  isSignalType,
-  assertSignalType,
-  InvalidSignalTypeError,
-} from "./schemas/signal-types.js";
-export type { SignalType } from "./schemas/signal-types.js";
-
-// Entity resolver (sources/signals slug → EntityContext)
-export {
-  resolveEntity,
-  listAvailableEntities,
-  EntityNotFoundError,
-  EntityPermissionError,
-  EntityResolutionError,
-} from "./entity-resolver.js";
-export type { AvailableEntity } from "./entity-resolver.js";
-
-// Sources read surface
-export { listSources } from "./sources/list.js";
-export { getSource, SourceNotFoundError } from "./sources/get.js";
-export type {
-  SourceSummary,
-  SourceDocument,
-  ListSourcesOptions,
-  ListSourcesResult,
-  GetSourceOptions,
-} from "./sources/types.js";
-
-// Test-only S3 factory hook for sources (consumed by hq-cli tests).
-// Underscore prefix signals "not for production use".
-export {
-  _setSourcesS3Factory,
-  _resetSourcesS3Factory,
-} from "./sources/internals.js";
-
-// Signals read surface
-export { listSignals } from "./signals/list.js";
-export { getSignal, SignalNotFoundError } from "./signals/get.js";
-export type {
-  SignalSummary,
-  SignalDocument,
-  ListSignalsOptions,
-  ListSignalsResult,
-  GetSignalOptions,
-} from "./signals/types.js";
-
-// Test-only S3 factory hook for signals (consumed by hq-cli tests).
-// Underscore prefix signals "not for production use".
-export {
-  _setSignalsS3Factory,
-  _resetSignalsS3Factory,
-} from "./signals/internals.js";
-
-// Event-driven sync — PushEvent wire contract + PushTransport shipping seam
-// (ported from hq-pro PR #112 per project event-driven-sync-menubar US-007).
-export {
-  CONTENT_HASH_PATTERN,
-  ISO8601_DATETIME_PATTERN,
-  PushEventSchema,
-  PushEventDecodeError,
-  encodePushEvent,
-  decodePushEvent,
-  NoopPushTransport,
-  HttpPushTransport,
-  EVENT_SYNC_LOCAL_DISABLE_ENV_VAR,
-  isEventSyncLocallyDisabled,
-  StaticFlagProvider,
-} from "./sync/index.js";
-export type {
-  PushEvent,
-  PushEventInput,
-  PushEventDecodeIssue,
-  PushTransport,
-  HttpPushTransportOptions,
-  AuthTokenSource,
-  FetchLike,
-  EventDrivenPushFlagProvider,
-  FlagProviderWarnFn,
-  EnvTenantListFlagProviderOptions,
-} from "./sync/index.js";
-
-// US-008 — watcher PushEvent emitter (bridges TreeWatcher → PushTransport,
-// flag-gated, failure-safe).
-export { PushEventEmitter } from "./watcher.js";
-export type {
-  PushEventEmitterOptions,
-  TreeChangeBatch,
-  TreeChangeListener,
-} from "./watcher.js";