@indigoai-us/hq-cli 5.16.0 → 5.17.0-sources-rc.0

package/.github/workflows/ci.yml

@@ -10,12 +10,16 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+      - uses: pnpm/action-setup@v4
+        with:
+          version: 10
       - uses: actions/setup-node@v4
         with:
           node-version: 22
-      - run: npm ci
+          cache: pnpm
+      - run: pnpm install --frozen-lockfile --config.minimumReleaseAge=1440
       # generate-dsn.mjs only fatals when GITHUB_JOB=publish, so CI builds with
       # an empty BUNDLED_DSN. That's intentional — the DSN is publish-only.
-      - run: npm run build --if-present
-      - run: npm run typecheck --if-present
-      - run: npm test --if-present
+      - run: pnpm run build
+      - run: pnpm run typecheck
+      - run: pnpm test

package/.github/workflows/publish.yml

@@ -11,6 +11,9 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@v4
+      - uses: pnpm/action-setup@v4
+        with:
+          version: 10
       - uses: actions/setup-node@v4
         with:
           # Node 24 ships npm 11.x, required for npm's trusted-publisher OIDC
@@ -18,12 +21,14 @@ jobs:
           # rationale (npm 10.x produces masked-404 failures on publish PUT).
           node-version: 24
           registry-url: https://registry.npmjs.org
+          cache: pnpm
 
-      - run: node --version && npm --version
-      - run: npm ci
+      - run: node --version && npm --version && pnpm --version
+      # Install with pnpm (supply-chain policy); npm publish keeps OIDC.
+      - run: pnpm install --frozen-lockfile --config.minimumReleaseAge=1440
 
       - name: Build
-        run: npm run build --if-present
+        run: pnpm run build
         env:
           # generate-dsn.mjs fatals when GITHUB_JOB=publish and this var is
           # missing. Set this as a repo secret to bundle a Sentry DSN into the

package/dist/cli-version.d.ts

@@ -1,2 +1,3 @@
+export declare const CLI_NAME: string;
 export declare const CLI_VERSION: string;
 //# sourceMappingURL=cli-version.d.ts.map

package/dist/cli-version.js

@@ -1,11 +1,12 @@
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="9d613278-0268-5da9-a6d0-f1b4f15d405a")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="3e4e6f0a-40ac-5bee-b3c0-547fffb71ea5")}catch(e){}}();
 import { readFileSync } from "node:fs";
 import { fileURLToPath } from "node:url";
 import path from "node:path";
 const here = path.dirname(fileURLToPath(import.meta.url));
 const pkgPath = path.resolve(here, "..", "package.json");
 const pkg = JSON.parse(readFileSync(pkgPath, "utf-8"));
+export const CLI_NAME = pkg.name;
 export const CLI_VERSION = pkg.version;
 //# sourceMappingURL=cli-version.js.map
-//# debugId=9d613278-0268-5da9-a6d0-f1b4f15d405a
+//# debugId=3e4e6f0a-40ac-5bee-b3c0-547fffb71ea5

package/dist/commands/groups.js

@@ -1,5 +1,5 @@
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="37e6bf57-eabb-58da-874c-57cc39e78d89")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="35b60d26-d8e7-5c10-9ad4-db53285eaaf0")}catch(e){}}();
 import chalk from "chalk";
 import { ensureCognitoToken } from "../utils/cognito-session.js";
 import { vaultApiFetch, getCompanyUid } from "./secrets.js";
@@ -58,7 +58,7 @@ export function registerGroupsCommand(program) {
                     console.error(chalk.red("Not authenticated — please run `hq login`"));
                 }
                 else if (res.status === 403) {
-                    console.error(chalk.red("Not authorized — owner or admin role required"));
+                    console.error(chalk.red("Not authorized — owner role required"));
                 }
                 else if (res.status === 409) {
                     console.error(chalk.red(`Group already exists: ${groupId}`));
@@ -102,7 +102,7 @@ export function registerGroupsCommand(program) {
                     console.error(chalk.red("Not authenticated — please run `hq login`"));
                 }
                 else if (res.status === 403) {
-                    console.error(chalk.red("Not authorized — owner or admin role required"));
+                    console.error(chalk.red("Not authorized — owner role required"));
                 }
                 else if (res.status === 404) {
                     console.error(chalk.red(`Group not found: ${groupId}`));
@@ -151,7 +151,7 @@ export function registerGroupsCommand(program) {
                     console.error(chalk.red("Not authenticated — please run `hq login`"));
                 }
                 else if (res.status === 403) {
-                    console.error(chalk.red("Not authorized — owner/admin role or group creator required"));
+                    console.error(chalk.red("Not authorized — owner role or group creator required"));
                 }
                 else if (res.status === 404) {
                     // Server provides a helpful message (email not found vs group not found)
@@ -205,7 +205,7 @@ export function registerGroupsCommand(program) {
                     console.error(chalk.red("Not authenticated — please run `hq login`"));
                 }
                 else if (res.status === 403) {
-                    console.error(chalk.red("Not authorized — owner/admin role or group creator required"));
+                    console.error(chalk.red("Not authorized — owner role or group creator required"));
                 }
                 else if (res.status === 404) {
                     console.error(chalk.red(err.error ?? `Not found`));
@@ -345,4 +345,4 @@ export function registerGroupsCommand(program) {
     });
 }
 //# sourceMappingURL=groups.js.map
-//# debugId=37e6bf57-eabb-58da-874c-57cc39e78d89
+//# debugId=35b60d26-d8e7-5c10-9ad4-db53285eaaf0

package/dist/commands/meetings.js

@@ -1,8 +1,8 @@
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="8237a835-5842-52be-bb27-c4ffb7944d89")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="e1c09963-744f-5033-9981-1ab6d37956e9")}catch(e){}}();
 import chalk from "chalk";
 import { ensureCognitoToken } from "../utils/cognito-session.js";
-import { vaultApiFetch } from "../utils/vault-api.js";
+import { vaultApiFetch, getCompanyUid } from "../utils/vault-api.js";
 function formatDuration(seconds) {
     const h = Math.floor(seconds / 3600);
     const m = Math.floor((seconds % 3600) / 60);
@@ -132,7 +132,7 @@ export function registerMeetingsCommand(program) {
             if (opts.next)
                 query.nextToken = opts.next;
             if (companySlug)
-                query.companyId = companySlug;
+                query.companyId = await getCompanyUid(token, companySlug);
             const res = await vaultApiFetch({ token, path: "/v1/meetings", query });
             if (!res.ok)
                 await handleApiError(res);
@@ -163,7 +163,7 @@ export function registerMeetingsCommand(program) {
             const query = {};
             const companySlug = meetings.opts().company;
             if (companySlug)
-                query.companyId = companySlug;
+                query.companyId = await getCompanyUid(token, companySlug);
             const meetingId = await resolveShortId(token, rawId, query);
             const res = await vaultApiFetch({
                 token,
@@ -217,7 +217,7 @@ export function registerMeetingsCommand(program) {
             const params = { q: query };
             const companySlug = meetings.opts().company;
             if (companySlug)
-                params.companyId = companySlug;
+                params.companyId = await getCompanyUid(token, companySlug);
             const res = await vaultApiFetch({
                 token,
                 path: "/v1/meetings/search",
@@ -249,7 +249,7 @@ export function registerMeetingsCommand(program) {
             const query = {};
             const companySlug = meetings.opts().company;
             if (companySlug)
-                query.companyId = companySlug;
+                query.companyId = await getCompanyUid(token, companySlug);
             const meetingId = await resolveShortId(token, rawId, query);
             const res = await vaultApiFetch({
                 token,
@@ -299,7 +299,7 @@ export function registerMeetingsCommand(program) {
             const query = {};
             const companySlug = meetings.opts().company;
             if (companySlug)
-                query.companyId = companySlug;
+                query.companyId = await getCompanyUid(token, companySlug);
             const meetingId = await resolveShortId(token, rawId, query);
             const res = await vaultApiFetch({
                 token,
@@ -371,4 +371,4 @@ export function registerMeetingsCommand(program) {
     });
 }
 //# sourceMappingURL=meetings.js.map
-//# debugId=8237a835-5842-52be-bb27-c4ffb7944d89
+//# debugId=e1c09963-744f-5033-9981-1ab6d37956e9

package/dist/commands/members.d.ts

@@ -26,6 +26,7 @@ export interface InviteResult {
     membership: {
         role: string;
         status: string;
+        inviteToken?: string;
     };
 }
 export interface DetectedTarget {
@@ -44,9 +45,10 @@ export declare function getCallerPersonUid(token: string): Promise<string>;
 export declare function inviteMember(options: InviteOptions): Promise<InviteResult>;
 export declare class InviteHttpError extends Error {
     status: number;
-    constructor(status: number, message: string);
+    code?: string | undefined;
+    constructor(status: number, message: string, code?: string | undefined);
 }
-export declare function formatInviteHttpError(status: number, fallback: string): string;
+export declare function formatInviteHttpError(status: number, fallback: string, code?: string): string;
 export declare function listPendingInvites(token: string, companyUid: string): Promise<PendingInvite[]>;
 export declare function revokeInvite(token: string, tokenOrKey: string, companyUid: string): Promise<void>;
 export declare function registerMembersCommand(program: Command): void;

package/dist/commands/members.js

@@ -1,5 +1,5 @@
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="1b3646e3-32c8-5601-9dba-1d7c0f6cf972")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="5f8b5b62-a00e-5ca3-b293-23906579a464")}catch(e){}}();
 import chalk from "chalk";
 import { ensureCognitoToken } from "../utils/cognito-session.js";
 import { vaultApiFetch, getCompanyUid } from "../utils/vault-api.js";
@@ -69,27 +69,41 @@ export async function inviteMember(options) {
     });
     if (!res.ok) {
         const err = (await res.json().catch(() => ({})));
-        throw new InviteHttpError(res.status, err.message ?? err.error ?? res.statusText);
+        throw new InviteHttpError(res.status, err.message ?? err.error ?? res.statusText, err.code);
     }
     const data = (await res.json());
+    // The token may arrive at the response root OR nested on the membership row,
+    // depending on vault-service version. Resolve from either; never emit
+    // `hq://accept/undefined` (a broken link that looks like success).
+    const inviteToken = data.inviteToken ?? data.membership?.inviteToken;
+    if (!inviteToken) {
+        const keys = Object.keys(data ?? {}).join(", ") || "<empty>";
+        throw new Error(`Invite was created but the server response did not include an invite token (response keys: ${keys}). ` +
+            "Run `hq members list` to retrieve the pending invite, or upgrade hq.");
+    }
     return {
-        inviteToken: data.inviteToken,
-        magicLink: `hq://accept/${data.inviteToken}`,
-        membership: data.membership,
+        inviteToken,
+        magicLink: `hq://accept/${inviteToken}`,
+        membership: data.membership ?? { role: options.role, status: "pending" },
     };
 }
 export class InviteHttpError extends Error {
     status;
-    constructor(status, message) {
+    code;
+    constructor(status, message, code) {
         super(message);
         this.status = status;
+        this.code = code;
         this.name = "InviteHttpError";
     }
 }
-export function formatInviteHttpError(status, fallback) {
+export function formatInviteHttpError(status, fallback, code) {
     if (status === 401)
         return "Not authenticated — please run `hq login`";
     if (status === 403) {
+        if (code === "ADMIN_ROLE_TARGET_RESTRICTED") {
+            return "Admin can only invite at role=member; ask an owner to invite at this role";
+        }
         return "Not authorized — only admins and owners can invite members";
     }
     if (status === 409) {
@@ -106,10 +120,10 @@ export async function listPendingInvites(token, companyUid) {
     });
     if (!res.ok) {
         const err = (await res.json().catch(() => ({})));
-        throw new InviteHttpError(res.status, err.message ?? err.error ?? res.statusText);
+        throw new InviteHttpError(res.status, err.message ?? err.error ?? res.statusText, err.code);
     }
     const data = (await res.json());
-    return data.invites;
+    return data?.invites ?? [];
 }
 export async function revokeInvite(token, tokenOrKey, companyUid) {
     const res = await vaultApiFetch({
@@ -120,7 +134,7 @@ export async function revokeInvite(token, tokenOrKey, companyUid) {
     });
     if (!res.ok) {
         const err = (await res.json().catch(() => ({})));
-        throw new InviteHttpError(res.status, err.message ?? err.error ?? res.statusText);
+        throw new InviteHttpError(res.status, err.message ?? err.error ?? res.statusText, err.code);
     }
 }
 export function registerMembersCommand(program) {
@@ -156,7 +170,7 @@ export function registerMembersCommand(program) {
         }
         catch (err) {
             if (err instanceof InviteHttpError) {
-                console.error(chalk.red(formatInviteHttpError(err.status, err.message)));
+                console.error(chalk.red(formatInviteHttpError(err.status, err.message, err.code)));
                 process.exit(1);
             }
             console.error(chalk.red("Error:"), err instanceof Error ? err.message : String(err));
@@ -224,10 +238,12 @@ export function registerMembersCommand(program) {
         catch (err) {
             if (err instanceof InviteHttpError) {
                 const msg = err.status === 403
-                    ? "Not authorized — only admins and owners can revoke invites"
+                    ? err.code === "ADMIN_ROLE_TARGET_RESTRICTED"
+                        ? "Admin can only revoke role=member; ask an owner to revoke this membership"
+                        : "Not authorized — only admins and owners can revoke invites"
                     : err.status === 404
                         ? "Invite not found — it may have already been accepted or revoked"
-                        : formatInviteHttpError(err.status, err.message);
+                        : formatInviteHttpError(err.status, err.message, err.code);
                 console.error(chalk.red(msg));
                 process.exit(1);
             }
@@ -237,4 +253,4 @@ export function registerMembersCommand(program) {
     });
 }
 //# sourceMappingURL=members.js.map
-//# debugId=1b3646e3-32c8-5601-9dba-1d7c0f6cf972
+//# debugId=5f8b5b62-a00e-5ca3-b293-23906579a464

package/dist/commands/signals.d.ts

@@ -0,0 +1,24 @@
+/**
+ * `hq signals` subcommand group (US-007).
+ *
+ * Read-side surface over the signals written by sources-pipeline (and any
+ * future signal producer). Each invocation resolves a Cognito access
+ * token (or honors HQ_ACCESS_TOKEN), vends STS-scoped credentials via
+ * vault-service for the requested entity, and delegates to hq-cloud's
+ * listSignals/getSignal primitives.
+ *
+ * Subcommands:
+ *   hq signals list      List signals of a given type for an entity.
+ *   hq signals get       Fetch one signal by id.
+ *   hq signals types     Print the canonical SIGNAL_TYPES enum.
+ *   hq signals entities  List entities the caller has access to.
+ *
+ * Mirrors `hq sources` exactly — same flags, same TTY-aware defaults,
+ * same error/Sentry plumbing. Defense-in-depth signal-type validation
+ * (assertSignalType) runs at the CLI layer as well as in hq-cloud, so
+ * agents can't fabricate a signal type even if they bypass the CLI's
+ * --type flag parsing.
+ */
+import { Command } from "commander";
+export declare function registerSignalsCommand(program: Command): void;
+//# sourceMappingURL=signals.d.ts.map

package/dist/commands/signals.js

@@ -0,0 +1,240 @@
+/**
+ * `hq signals` subcommand group (US-007).
+ *
+ * Read-side surface over the signals written by sources-pipeline (and any
+ * future signal producer). Each invocation resolves a Cognito access
+ * token (or honors HQ_ACCESS_TOKEN), vends STS-scoped credentials via
+ * vault-service for the requested entity, and delegates to hq-cloud's
+ * listSignals/getSignal primitives.
+ *
+ * Subcommands:
+ *   hq signals list      List signals of a given type for an entity.
+ *   hq signals get       Fetch one signal by id.
+ *   hq signals types     Print the canonical SIGNAL_TYPES enum.
+ *   hq signals entities  List entities the caller has access to.
+ *
+ * Mirrors `hq sources` exactly — same flags, same TTY-aware defaults,
+ * same error/Sentry plumbing. Defense-in-depth signal-type validation
+ * (assertSignalType) runs at the CLI layer as well as in hq-cloud, so
+ * agents can't fabricate a signal type even if they bypass the CLI's
+ * --type flag parsing.
+ */
+
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="2088e3af-a005-57eb-b642-90aca198460b")}catch(e){}}();
+import * as fs from "node:fs";
+import * as path from "node:path";
+import chalk from "chalk";
+import { SIGNAL_TYPES, assertSignalType, resolveEntity, listAvailableEntities, listSignals, getSignal, } from "@indigoai-us/hq-cloud";
+import { ensureCognitoToken, buildVaultConfig, DEFAULT_HQ_ROOT, } from "../utils/cognito-session.js";
+import { Sentry } from "../sentry.js";
+// ---------------------------------------------------------------------------
+// Access token resolution — honors HQ_ACCESS_TOKEN for tests + CI smoke
+// ---------------------------------------------------------------------------
+async function resolveAccessToken() {
+    if (process.env.HQ_ACCESS_TOKEN)
+        return process.env.HQ_ACCESS_TOKEN;
+    return ensureCognitoToken();
+}
+// ---------------------------------------------------------------------------
+// Entity resolution — flag → .hq/config.json activeCompany fallback
+// ---------------------------------------------------------------------------
+function readActiveCompanySlug(hqRoot) {
+    const configPath = path.join(hqRoot, ".hq", "config.json");
+    if (!fs.existsSync(configPath))
+        return undefined;
+    try {
+        const cfg = JSON.parse(fs.readFileSync(configPath, "utf-8"));
+        const slug = cfg.activeCompany;
+        return typeof slug === "string" && slug.length > 0 ? slug : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+function requireEntitySlug(flag, hqRoot) {
+    const slug = flag ?? readActiveCompanySlug(hqRoot);
+    if (!slug) {
+        throw new Error("No entity specified. Pass --entity <slug> or run `hq signals entities` to see your options.");
+    }
+    return slug;
+}
+function defaultListFormat() {
+    return process.stdout.isTTY ? "table" : "json";
+}
+function defaultGetFormat() {
+    return process.stdout.isTTY ? "markdown" : "json";
+}
+// ---------------------------------------------------------------------------
+// Rendering helpers
+// ---------------------------------------------------------------------------
+function renderListTable(entries, includeFrontmatter) {
+    if (entries.length === 0)
+        return "(no signals)";
+    // sourceRef column is only meaningful when --include-frontmatter was passed;
+    // omit it otherwise so the table doesn't lie with empty cells.
+    const rows = entries.map((e) => ({
+        signalId: e.signalId,
+        ...(includeFrontmatter ? { sourceRef: e.sourceRef ?? "" } : {}),
+        lastModified: e.lastModified.toISOString(),
+        size: String(e.size),
+    }));
+    const headers = Object.keys(rows[0]);
+    const widths = headers.map((h) => Math.max(h.length, ...rows.map((r) => String(r[h]).length)));
+    const pad = (s, w) => s + " ".repeat(Math.max(0, w - s.length));
+    const headerLine = headers.map((h, i) => pad(h, widths[i])).join("  ");
+    const sep = widths.map((w) => "-".repeat(w)).join("  ");
+    const body = rows
+        .map((r) => headers.map((h, i) => pad(String(r[h]), widths[i])).join("  "))
+        .join("\n");
+    return [headerLine, sep, body].join("\n");
+}
+async function runList(options) {
+    if (!options.type) {
+        throw new Error(`--type <signalType> is required. Valid types: ${SIGNAL_TYPES.join(", ")}`);
+    }
+    // Throws InvalidSignalTypeError with the list of valid types if not in enum.
+    assertSignalType(options.type);
+    const signalType = options.type;
+    const slug = requireEntitySlug(options.entity, options.hqRoot);
+    const limit = options.limit ? Number.parseInt(options.limit, 10) : 50;
+    if (!Number.isFinite(limit) || limit <= 0) {
+        throw new Error(`--limit must be a positive integer (got '${options.limit}')`);
+    }
+    const format = options.format ?? defaultListFormat();
+    const accessToken = await resolveAccessToken();
+    const vaultConfig = buildVaultConfig(accessToken);
+    const entity = await resolveEntity({ slug, vaultConfig });
+    const result = await listSignals({
+        entity,
+        signalType,
+        limit,
+        continuationToken: options.pageToken,
+        includeFrontmatter: options.includeFrontmatter,
+    });
+    if (format === "json") {
+        process.stdout.write(JSON.stringify(result, null, 2) + "\n");
+        return;
+    }
+    process.stdout.write(renderListTable(result.entries, !!options.includeFrontmatter) + "\n");
+    if (result.nextToken) {
+        process.stdout.write(`\nNext page token: ${result.nextToken}\n`);
+    }
+}
+async function runGet(options) {
+    if (!options.type) {
+        throw new Error(`--type <signalType> is required. Valid types: ${SIGNAL_TYPES.join(", ")}`);
+    }
+    if (!options.id) {
+        throw new Error("--id <signalId> is required.");
+    }
+    assertSignalType(options.type);
+    const signalType = options.type;
+    const slug = requireEntitySlug(options.entity, options.hqRoot);
+    const format = options.format ?? defaultGetFormat();
+    const accessToken = await resolveAccessToken();
+    const vaultConfig = buildVaultConfig(accessToken);
+    const entity = await resolveEntity({ slug, vaultConfig });
+    const doc = await getSignal({
+        entity,
+        signalType,
+        signalId: options.id,
+    });
+    if (format === "json") {
+        process.stdout.write(JSON.stringify(doc, null, 2) + "\n");
+        return;
+    }
+    // markdown: reconstruct frontmatter block + body so the output round-trips.
+    if (doc.frontmatter) {
+        const yamlLines = Object.entries(doc.frontmatter).map(([k, v]) => `${k}: ${typeof v === "string" ? v : JSON.stringify(v)}`);
+        process.stdout.write(`---\n${yamlLines.join("\n")}\n---\n\n${doc.body}\n`);
+    }
+    else {
+        process.stdout.write(doc.body + "\n");
+    }
+}
+// ---------------------------------------------------------------------------
+// Subcommand: types
+// ---------------------------------------------------------------------------
+function runTypes() {
+    const sorted = [...SIGNAL_TYPES].sort();
+    process.stdout.write(sorted.join("\n") + "\n");
+}
+// ---------------------------------------------------------------------------
+// Subcommand: entities (alias — identical to `hq sources entities`)
+// ---------------------------------------------------------------------------
+async function runEntities(options) {
+    const format = options.format ?? defaultListFormat();
+    const accessToken = await resolveAccessToken();
+    const vaultConfig = buildVaultConfig(accessToken);
+    const entities = await listAvailableEntities({ vaultConfig });
+    if (format === "json") {
+        process.stdout.write(JSON.stringify(entities, null, 2) + "\n");
+        return;
+    }
+    if (entities.length === 0) {
+        process.stdout.write("(no entities — your account has no active memberships)\n");
+        return;
+    }
+    const headers = ["slug", "role", "uid"];
+    const widths = headers.map((h, i) => Math.max(h.length, ...entities.map((e) => String([e.slug, e.role, e.uid][i]).length)));
+    const pad = (s, w) => s + " ".repeat(Math.max(0, w - s.length));
+    const headerLine = headers.map((h, i) => pad(h, widths[i])).join("  ");
+    const sep = widths.map((w) => "-".repeat(w)).join("  ");
+    const body = entities
+        .map((e) => [e.slug, e.role, e.uid].map((cell, i) => pad(cell, widths[i])).join("  "))
+        .join("\n");
+    process.stdout.write([headerLine, sep, body].join("\n") + "\n");
+}
+// ---------------------------------------------------------------------------
+// Registration
+// ---------------------------------------------------------------------------
+/** Wrap an action so caught errors print red + capture to Sentry + exit 1. */
+function withErrorHandling(fn) {
+    return async (...args) => {
+        try {
+            await fn(...args);
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            process.stderr.write(chalk.red(`✗ ${message}\n`));
+            Sentry.captureException(err);
+            process.exit(1);
+        }
+    };
+}
+export function registerSignalsCommand(program) {
+    const signals = program
+        .command("signals")
+        .description("Read signals (action_items, decisions, etc.) from a vault entity");
+    signals
+        .command("list")
+        .description("List signals of a given type for an entity")
+        .option("--entity <slug>", "Entity slug (defaults to .hq/config.json activeCompany)")
+        .option("--type <signalType>", `Signal type: ${SIGNAL_TYPES.join(" | ")}`)
+        .option("--limit <n>", "Max entries per page (default 50)")
+        .option("--page-token <token>", "Continuation token from a prior page")
+        .option("--format <fmt>", "Output format: table | json (default: table for TTY, json piped)")
+        .option("--include-frontmatter", "Fetch + parse each entry's frontmatter (extra GETs)")
+        .option("--hq-root <path>", `Local HQ tree root (for .hq/config.json lookup; default: ${DEFAULT_HQ_ROOT})`, DEFAULT_HQ_ROOT)
+        .action(withErrorHandling(async (options) => runList(options)));
+    signals
+        .command("get")
+        .description("Fetch a single signal by id")
+        .option("--entity <slug>", "Entity slug (defaults to .hq/config.json activeCompany)")
+        .option("--type <signalType>", `Signal type: ${SIGNAL_TYPES.join(" | ")}`)
+        .option("--id <signalId>", "Signal id (filename minus .md)")
+        .option("--format <fmt>", "Output format: markdown | json (default: markdown for TTY, json piped)")
+        .option("--hq-root <path>", `Local HQ tree root (for .hq/config.json lookup; default: ${DEFAULT_HQ_ROOT})`, DEFAULT_HQ_ROOT)
+        .action(withErrorHandling(async (options) => runGet(options)));
+    signals
+        .command("types")
+        .description("Print the canonical signal types (one per line)")
+        .action(withErrorHandling(() => runTypes()));
+    signals
+        .command("entities")
+        .description("List entities (companies/personal) your account has access to")
+        .option("--format <fmt>", "Output format: table | json (default: table for TTY, json piped)")
+        .action(withErrorHandling(async (options) => runEntities(options)));
+}
+//# sourceMappingURL=signals.js.map
+//# debugId=2088e3af-a005-57eb-b642-90aca198460b

package/dist/commands/sources.d.ts

@@ -0,0 +1,22 @@
+/**
+ * `hq sources` subcommand group (US-006).
+ *
+ * Read-side surface over the sources written by sources-pipeline. Each
+ * invocation resolves a Cognito access token (or honors HQ_ACCESS_TOKEN),
+ * vends STS-scoped credentials via vault-service for the requested entity,
+ * and delegates to hq-cloud's listSources/getSource primitives.
+ *
+ * Subcommands:
+ *   hq sources list      List sources of a given channel for an entity.
+ *   hq sources get       Fetch one source by id.
+ *   hq sources channels  Print the canonical SOURCE_CHANNELS enum.
+ *   hq sources entities  List entities the caller has access to.
+ *
+ * Defaults:
+ *   --entity   falls back to .hq/config.json activeCompany (per sync.ts).
+ *   --format   'table' when stdout is a TTY, 'json' when piped.
+ *   --limit    50.
+ */
+import { Command } from "commander";
+export declare function registerSourcesCommand(program: Command): void;
+//# sourceMappingURL=sources.d.ts.map