@indigoai-us/hq-cli 5.15.0 → 5.17.0-sources-rc.0

package/.github/workflows/ci.yml

@@ -10,12 +10,16 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+      - uses: pnpm/action-setup@v4
+        with:
+          version: 10
       - uses: actions/setup-node@v4
         with:
           node-version: 22
-      - run: npm ci
+          cache: pnpm
+      - run: pnpm install --frozen-lockfile --config.minimumReleaseAge=1440
       # generate-dsn.mjs only fatals when GITHUB_JOB=publish, so CI builds with
       # an empty BUNDLED_DSN. That's intentional — the DSN is publish-only.
-      - run: npm run build --if-present
-      - run: npm run typecheck --if-present
-      - run: npm test --if-present
+      - run: pnpm run build
+      - run: pnpm run typecheck
+      - run: pnpm test

package/.github/workflows/publish.yml

@@ -11,6 +11,9 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@v4
+      - uses: pnpm/action-setup@v4
+        with:
+          version: 10
       - uses: actions/setup-node@v4
         with:
           # Node 24 ships npm 11.x, required for npm's trusted-publisher OIDC
@@ -18,12 +21,14 @@ jobs:
           # rationale (npm 10.x produces masked-404 failures on publish PUT).
           node-version: 24
           registry-url: https://registry.npmjs.org
+          cache: pnpm
 
-      - run: node --version && npm --version
-      - run: npm ci
+      - run: node --version && npm --version && pnpm --version
+      # Install with pnpm (supply-chain policy); npm publish keeps OIDC.
+      - run: pnpm install --frozen-lockfile --config.minimumReleaseAge=1440
 
       - name: Build
-        run: npm run build --if-present
+        run: pnpm run build
         env:
           # generate-dsn.mjs fatals when GITHUB_JOB=publish and this var is
           # missing. Set this as a repo secret to bundle a Sentry DSN into the

package/dist/cli-version.d.ts

@@ -1,2 +1,3 @@
+export declare const CLI_NAME: string;
 export declare const CLI_VERSION: string;
 //# sourceMappingURL=cli-version.d.ts.map

package/dist/cli-version.js

@@ -1,11 +1,12 @@
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="9d613278-0268-5da9-a6d0-f1b4f15d405a")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="3e4e6f0a-40ac-5bee-b3c0-547fffb71ea5")}catch(e){}}();
 import { readFileSync } from "node:fs";
 import { fileURLToPath } from "node:url";
 import path from "node:path";
 const here = path.dirname(fileURLToPath(import.meta.url));
 const pkgPath = path.resolve(here, "..", "package.json");
 const pkg = JSON.parse(readFileSync(pkgPath, "utf-8"));
+export const CLI_NAME = pkg.name;
 export const CLI_VERSION = pkg.version;
 //# sourceMappingURL=cli-version.js.map
-//# debugId=9d613278-0268-5da9-a6d0-f1b4f15d405a
+//# debugId=3e4e6f0a-40ac-5bee-b3c0-547fffb71ea5

package/dist/commands/cloud-provision.d.ts

@@ -111,7 +111,32 @@ export interface VaultClient {
      * entity.
      */
     listMyPersonEntities(): Promise<VaultEntity[]>;
+    /**
+     * Legacy global-uniqueness lookup. Under the per-user-namespace model
+     * (hq-pro 2026-05-15) this can return any tenant's entity when more
+     * than one user holds the same slug, OR `null` when the caller doesn't
+     * have it but a different user does. Kept on the interface for any
+     * remaining callers, but `provisionCompany` now uses
+     * `checkSlugInMyNamespace` instead — same-slug-different-owner is
+     * legitimate and should NOT trigger reuse of the stranger's entity.
+     */
     findCompanyBySlug(slug: string): Promise<VaultEntity | null>;
+    /**
+     * Caller-scoped slug availability check via
+     * `GET /entity/check-slug/me?type=company&slug=...`. Returns
+     * `{available: true}` when the caller's namespace
+     * (owned ∪ active-member-of, soft-deleted excluded) doesn't hold the
+     * slug, or `{available: false, conflictingCompanyUid}` when it does
+     * — `provisionCompany` reuses the `conflictingCompanyUid` as the
+     * idempotent entity instead of creating a duplicate.
+     */
+    checkSlugInMyNamespace(slug: string): Promise<{
+        available: boolean;
+        conflictingCompanyUid?: string;
+    }>;
+    /** Fetch a company entity by uid. Used to materialize the entity
+     * after `checkSlugInMyNamespace` reports a same-namespace collision. */
+    getCompanyByUid(uid: string): Promise<VaultEntity>;
     createCompanyEntity(input: {
         slug: string;
         name: string;

package/dist/commands/cloud-provision.js

@@ -28,7 +28,7 @@
  *       `initial_sync.ok=false`). Manifest + config may have been written.
  */
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="3c9e69f3-8137-5db1-8692-e38774558f61")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="925baddc-7b12-5ad4-b64f-d7e20bd0daab")}catch(e){}}();
 import chalk from "chalk";
 import * as fs from "node:fs";
 import * as path from "node:path";
@@ -295,6 +295,28 @@ export function createDefaultVaultClient(apiUrl, accessToken) {
             }
             return data.entity;
         },
+        async checkSlugInMyNamespace(slug) {
+            const url = `${apiUrl.replace(/\/$/, "")}/entity/check-slug/me?type=company&slug=${encodeURIComponent(slug)}`;
+            const res = await fetch(url, { method: "GET", headers });
+            if (!res.ok) {
+                const body = await safeBody(res);
+                throw new ProvisionError(1, `Vault GET /entity/check-slug/me failed: ${res.status} ${res.statusText} — ${body}`);
+            }
+            return (await res.json());
+        },
+        async getCompanyByUid(uid) {
+            const url = `${apiUrl.replace(/\/$/, "")}/entity/${encodeURIComponent(uid)}`;
+            const res = await fetch(url, { method: "GET", headers });
+            if (!res.ok) {
+                const body = await safeBody(res);
+                throw new ProvisionError(1, `Vault GET /entity/${uid} failed: ${res.status} ${res.statusText} — ${body}`);
+            }
+            const data = (await res.json());
+            if (!data.entity) {
+                throw new ProvisionError(1, `Vault GET /entity/${uid} returned 200 with no entity body`);
+            }
+            return data.entity;
+        },
         async createCompanyEntity(input) {
             const url = `${apiUrl.replace(/\/$/, "")}/entity`;
             const body = {
@@ -311,9 +333,15 @@ export function createDefaultVaultClient(apiUrl, accessToken) {
             });
             if (!res.ok) {
                 const text = await safeBody(res);
-                // 409 means a concurrent client created it between our GET and POST —
-                // surface it as a vault error. The orchestrator is responsible for
-                // retrying GET if it wants idempotency on collisions.
+                // 409 SLUG_IN_USE_FOR_PERSON: the caller already has the slug
+                // in their namespace (owned ∪ active-member-of). Under the
+                // per-user-namespace model this is the new same-user-collision
+                // signal — distinct from the legacy global EntityAlreadyExists.
+                // The CLI normally reaches `createCompanyEntity` only after
+                // `checkSlugInMyNamespace` reported `available: true`, so a
+                // 409 here means a race between the pre-check and the POST.
+                // Surface the response body verbatim so the caller can see the
+                // `code` + `conflictingCompanyUid` and resolve / retry.
                 throw new ProvisionError(1, `Vault POST /entity failed: ${res.status} ${res.statusText} — ${text}`);
             }
             const data = (await res.json());
@@ -393,13 +421,51 @@ export async function provisionCompany(options) {
         throw new ProvisionError(2, 'No person entity found for this Cognito identity. Run `hq onboard` first to create your HQ identity, then re-run `hq cloud provision company`. (Provision was halted before any cloud-side resources were created.)');
     }
     log(`pre-flight ok — caller has ${persons.length} person entity(ies)`);
-    let entity = await vaultClient.findCompanyBySlug(options.slug);
+    // Per-user-namespace-aware reuse-or-create. Replaces the legacy
+    // global `findCompanyBySlug` lookup, which under the per-user model
+    // (hq-pro 2026-05-15) returns ANY tenant's entity when more than one
+    // user holds the same slug, OR null when a different user has it —
+    // both wrong for the CLI's "reuse mine, or create" intent.
+    //
+    // `--owner` override: `options.ownerUid`, when set, lets a caller
+    // create the entity under a DIFFERENT person's ownership (e.g. an
+    // admin provisioning on behalf of someone). `/entity/check-slug/me`
+    // answers about the CALLER's namespace, not the target owner's, so
+    // the pre-check is meaningless in that case. Codex P2 on PR 7
+    // flagged this. The gate: only run the namespace check when the
+    // owner is the caller (or defaulted to the caller — i.e. no
+    // --owner supplied). On override, fall through to
+    // `createCompanyEntity` and let the server's authoritative 409
+    // (which IS scoped to the target's namespace, per the
+    // callerIsOwner gate on POST /entity in hq-pro PR 67) surface any
+    // real conflict.
+    //
+    // `callerIsOwner` is `true` whenever `options.ownerUid` is unset
+    // (defaults to caller server-side) OR — when set — happens to
+    // match the caller's own person UID(s) from `listMyPersonEntities`.
+    const callerOwnedUids = new Set(persons.map((p) => p.uid));
+    const callerIsOwner = !options.ownerUid || callerOwnedUids.has(options.ownerUid);
+    let entity;
     let createdEntity = false;
-    if (entity) {
-        log(`reusing existing vault entity uid=${entity.uid}`);
+    if (callerIsOwner) {
+        const slugCheck = await vaultClient.checkSlugInMyNamespace(options.slug);
+        if (!slugCheck.available && slugCheck.conflictingCompanyUid) {
+            log(`reusing existing vault entity uid=${slugCheck.conflictingCompanyUid} (slug already in caller's namespace)`);
+            entity = await vaultClient.getCompanyByUid(slugCheck.conflictingCompanyUid);
+        }
+        else {
+            log(`slug available in caller's namespace — creating vault entity`);
+            entity = await vaultClient.createCompanyEntity({
+                slug: options.slug,
+                name: options.name ?? options.slug,
+                ownerUid: options.ownerUid,
+            });
+            createdEntity = true;
+            log(`created vault entity uid=${entity.uid}`);
+        }
     }
     else {
-        log(`vault entity not found — creating`);
+        log(`--owner ${options.ownerUid} differs from caller's person(s); skipping namespace pre-check (server authoritatively gates per-target-namespace)`);
         entity = await vaultClient.createCompanyEntity({
             slug: options.slug,
             name: options.name ?? options.slug,
@@ -549,4 +615,4 @@ export function registerCloudProvisionCommands(program) {
     });
 }
 //# sourceMappingURL=cloud-provision.js.map
-//# debugId=3c9e69f3-8137-5db1-8692-e38774558f61
+//# debugId=925baddc-7b12-5ad4-b64f-d7e20bd0daab

package/dist/commands/groups.js

@@ -1,5 +1,5 @@
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="37e6bf57-eabb-58da-874c-57cc39e78d89")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="35b60d26-d8e7-5c10-9ad4-db53285eaaf0")}catch(e){}}();
 import chalk from "chalk";
 import { ensureCognitoToken } from "../utils/cognito-session.js";
 import { vaultApiFetch, getCompanyUid } from "./secrets.js";
@@ -58,7 +58,7 @@ export function registerGroupsCommand(program) {
                     console.error(chalk.red("Not authenticated — please run `hq login`"));
                 }
                 else if (res.status === 403) {
-                    console.error(chalk.red("Not authorized — owner or admin role required"));
+                    console.error(chalk.red("Not authorized — owner role required"));
                 }
                 else if (res.status === 409) {
                     console.error(chalk.red(`Group already exists: ${groupId}`));
@@ -102,7 +102,7 @@ export function registerGroupsCommand(program) {
                     console.error(chalk.red("Not authenticated — please run `hq login`"));
                 }
                 else if (res.status === 403) {
-                    console.error(chalk.red("Not authorized — owner or admin role required"));
+                    console.error(chalk.red("Not authorized — owner role required"));
                 }
                 else if (res.status === 404) {
                     console.error(chalk.red(`Group not found: ${groupId}`));
@@ -151,7 +151,7 @@ export function registerGroupsCommand(program) {
                     console.error(chalk.red("Not authenticated — please run `hq login`"));
                 }
                 else if (res.status === 403) {
-                    console.error(chalk.red("Not authorized — owner/admin role or group creator required"));
+                    console.error(chalk.red("Not authorized — owner role or group creator required"));
                 }
                 else if (res.status === 404) {
                     // Server provides a helpful message (email not found vs group not found)
@@ -205,7 +205,7 @@ export function registerGroupsCommand(program) {
                     console.error(chalk.red("Not authenticated — please run `hq login`"));
                 }
                 else if (res.status === 403) {
-                    console.error(chalk.red("Not authorized — owner/admin role or group creator required"));
+                    console.error(chalk.red("Not authorized — owner role or group creator required"));
                 }
                 else if (res.status === 404) {
                     console.error(chalk.red(err.error ?? `Not found`));
@@ -345,4 +345,4 @@ export function registerGroupsCommand(program) {
     });
 }
 //# sourceMappingURL=groups.js.map
-//# debugId=37e6bf57-eabb-58da-874c-57cc39e78d89
+//# debugId=35b60d26-d8e7-5c10-9ad4-db53285eaaf0

package/dist/commands/meetings.js

@@ -1,8 +1,8 @@
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="8237a835-5842-52be-bb27-c4ffb7944d89")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="e1c09963-744f-5033-9981-1ab6d37956e9")}catch(e){}}();
 import chalk from "chalk";
 import { ensureCognitoToken } from "../utils/cognito-session.js";
-import { vaultApiFetch } from "../utils/vault-api.js";
+import { vaultApiFetch, getCompanyUid } from "../utils/vault-api.js";
 function formatDuration(seconds) {
     const h = Math.floor(seconds / 3600);
     const m = Math.floor((seconds % 3600) / 60);
@@ -132,7 +132,7 @@ export function registerMeetingsCommand(program) {
             if (opts.next)
                 query.nextToken = opts.next;
             if (companySlug)
-                query.companyId = companySlug;
+                query.companyId = await getCompanyUid(token, companySlug);
             const res = await vaultApiFetch({ token, path: "/v1/meetings", query });
             if (!res.ok)
                 await handleApiError(res);
@@ -163,7 +163,7 @@ export function registerMeetingsCommand(program) {
             const query = {};
             const companySlug = meetings.opts().company;
             if (companySlug)
-                query.companyId = companySlug;
+                query.companyId = await getCompanyUid(token, companySlug);
             const meetingId = await resolveShortId(token, rawId, query);
             const res = await vaultApiFetch({
                 token,
@@ -217,7 +217,7 @@ export function registerMeetingsCommand(program) {
             const params = { q: query };
             const companySlug = meetings.opts().company;
             if (companySlug)
-                params.companyId = companySlug;
+                params.companyId = await getCompanyUid(token, companySlug);
             const res = await vaultApiFetch({
                 token,
                 path: "/v1/meetings/search",
@@ -249,7 +249,7 @@ export function registerMeetingsCommand(program) {
             const query = {};
             const companySlug = meetings.opts().company;
             if (companySlug)
-                query.companyId = companySlug;
+                query.companyId = await getCompanyUid(token, companySlug);
             const meetingId = await resolveShortId(token, rawId, query);
             const res = await vaultApiFetch({
                 token,
@@ -299,7 +299,7 @@ export function registerMeetingsCommand(program) {
             const query = {};
             const companySlug = meetings.opts().company;
             if (companySlug)
-                query.companyId = companySlug;
+                query.companyId = await getCompanyUid(token, companySlug);
             const meetingId = await resolveShortId(token, rawId, query);
             const res = await vaultApiFetch({
                 token,
@@ -371,4 +371,4 @@ export function registerMeetingsCommand(program) {
     });
 }
 //# sourceMappingURL=meetings.js.map
-//# debugId=8237a835-5842-52be-bb27-c4ffb7944d89
+//# debugId=e1c09963-744f-5033-9981-1ab6d37956e9

package/dist/commands/members.d.ts

@@ -26,6 +26,7 @@ export interface InviteResult {
     membership: {
         role: string;
         status: string;
+        inviteToken?: string;
     };
 }
 export interface DetectedTarget {
@@ -44,9 +45,10 @@ export declare function getCallerPersonUid(token: string): Promise<string>;
 export declare function inviteMember(options: InviteOptions): Promise<InviteResult>;
 export declare class InviteHttpError extends Error {
     status: number;
-    constructor(status: number, message: string);
+    code?: string | undefined;
+    constructor(status: number, message: string, code?: string | undefined);
 }
-export declare function formatInviteHttpError(status: number, fallback: string): string;
+export declare function formatInviteHttpError(status: number, fallback: string, code?: string): string;
 export declare function listPendingInvites(token: string, companyUid: string): Promise<PendingInvite[]>;
 export declare function revokeInvite(token: string, tokenOrKey: string, companyUid: string): Promise<void>;
 export declare function registerMembersCommand(program: Command): void;

package/dist/commands/members.js

@@ -1,5 +1,5 @@
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="1b3646e3-32c8-5601-9dba-1d7c0f6cf972")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="5f8b5b62-a00e-5ca3-b293-23906579a464")}catch(e){}}();
 import chalk from "chalk";
 import { ensureCognitoToken } from "../utils/cognito-session.js";
 import { vaultApiFetch, getCompanyUid } from "../utils/vault-api.js";
@@ -69,27 +69,41 @@ export async function inviteMember(options) {
     });
     if (!res.ok) {
         const err = (await res.json().catch(() => ({})));
-        throw new InviteHttpError(res.status, err.message ?? err.error ?? res.statusText);
+        throw new InviteHttpError(res.status, err.message ?? err.error ?? res.statusText, err.code);
     }
     const data = (await res.json());
+    // The token may arrive at the response root OR nested on the membership row,
+    // depending on vault-service version. Resolve from either; never emit
+    // `hq://accept/undefined` (a broken link that looks like success).
+    const inviteToken = data.inviteToken ?? data.membership?.inviteToken;
+    if (!inviteToken) {
+        const keys = Object.keys(data ?? {}).join(", ") || "<empty>";
+        throw new Error(`Invite was created but the server response did not include an invite token (response keys: ${keys}). ` +
+            "Run `hq members list` to retrieve the pending invite, or upgrade hq.");
+    }
     return {
-        inviteToken: data.inviteToken,
-        magicLink: `hq://accept/${data.inviteToken}`,
-        membership: data.membership,
+        inviteToken,
+        magicLink: `hq://accept/${inviteToken}`,
+        membership: data.membership ?? { role: options.role, status: "pending" },
     };
 }
 export class InviteHttpError extends Error {
     status;
-    constructor(status, message) {
+    code;
+    constructor(status, message, code) {
         super(message);
         this.status = status;
+        this.code = code;
         this.name = "InviteHttpError";
     }
 }
-export function formatInviteHttpError(status, fallback) {
+export function formatInviteHttpError(status, fallback, code) {
     if (status === 401)
         return "Not authenticated — please run `hq login`";
     if (status === 403) {
+        if (code === "ADMIN_ROLE_TARGET_RESTRICTED") {
+            return "Admin can only invite at role=member; ask an owner to invite at this role";
+        }
         return "Not authorized — only admins and owners can invite members";
     }
     if (status === 409) {
@@ -106,10 +120,10 @@ export async function listPendingInvites(token, companyUid) {
     });
     if (!res.ok) {
         const err = (await res.json().catch(() => ({})));
-        throw new InviteHttpError(res.status, err.message ?? err.error ?? res.statusText);
+        throw new InviteHttpError(res.status, err.message ?? err.error ?? res.statusText, err.code);
     }
     const data = (await res.json());
-    return data.invites;
+    return data?.invites ?? [];
 }
 export async function revokeInvite(token, tokenOrKey, companyUid) {
     const res = await vaultApiFetch({
@@ -120,7 +134,7 @@ export async function revokeInvite(token, tokenOrKey, companyUid) {
     });
     if (!res.ok) {
         const err = (await res.json().catch(() => ({})));
-        throw new InviteHttpError(res.status, err.message ?? err.error ?? res.statusText);
+        throw new InviteHttpError(res.status, err.message ?? err.error ?? res.statusText, err.code);
     }
 }
 export function registerMembersCommand(program) {
@@ -156,7 +170,7 @@ export function registerMembersCommand(program) {
         }
         catch (err) {
             if (err instanceof InviteHttpError) {
-                console.error(chalk.red(formatInviteHttpError(err.status, err.message)));
+                console.error(chalk.red(formatInviteHttpError(err.status, err.message, err.code)));
                 process.exit(1);
             }
             console.error(chalk.red("Error:"), err instanceof Error ? err.message : String(err));
@@ -224,10 +238,12 @@ export function registerMembersCommand(program) {
         catch (err) {
             if (err instanceof InviteHttpError) {
                 const msg = err.status === 403
-                    ? "Not authorized — only admins and owners can revoke invites"
+                    ? err.code === "ADMIN_ROLE_TARGET_RESTRICTED"
+                        ? "Admin can only revoke role=member; ask an owner to revoke this membership"
+                        : "Not authorized — only admins and owners can revoke invites"
                     : err.status === 404
                         ? "Invite not found — it may have already been accepted or revoked"
-                        : formatInviteHttpError(err.status, err.message);
+                        : formatInviteHttpError(err.status, err.message, err.code);
                 console.error(chalk.red(msg));
                 process.exit(1);
             }
@@ -237,4 +253,4 @@ export function registerMembersCommand(program) {
     });
 }
 //# sourceMappingURL=members.js.map
-//# debugId=1b3646e3-32c8-5601-9dba-1d7c0f6cf972
+//# debugId=5f8b5b62-a00e-5ca3-b293-23906579a464

package/dist/commands/signals.d.ts

@@ -0,0 +1,24 @@
+/**
+ * `hq signals` subcommand group (US-007).
+ *
+ * Read-side surface over the signals written by sources-pipeline (and any
+ * future signal producer). Each invocation resolves a Cognito access
+ * token (or honors HQ_ACCESS_TOKEN), vends STS-scoped credentials via
+ * vault-service for the requested entity, and delegates to hq-cloud's
+ * listSignals/getSignal primitives.
+ *
+ * Subcommands:
+ *   hq signals list      List signals of a given type for an entity.
+ *   hq signals get       Fetch one signal by id.
+ *   hq signals types     Print the canonical SIGNAL_TYPES enum.
+ *   hq signals entities  List entities the caller has access to.
+ *
+ * Mirrors `hq sources` exactly — same flags, same TTY-aware defaults,
+ * same error/Sentry plumbing. Defense-in-depth signal-type validation
+ * (assertSignalType) runs at the CLI layer as well as in hq-cloud, so
+ * agents can't fabricate a signal type even if they bypass the CLI's
+ * --type flag parsing.
+ */
+import { Command } from "commander";
+export declare function registerSignalsCommand(program: Command): void;
+//# sourceMappingURL=signals.d.ts.map