@indigoai-us/hq-cli 5.312.2-beta.0 → 5.314.0

package/dist/commands/db-provision.js

@@ -28,7 +28,7 @@ const defaultDeps = () => ({
 });
 export function registerDbProvisionCommand(db, depsFactory = defaultDeps) {
     db.command("provision")
-        .description("Provision (or re-bind) the company remote vault DB via HQ control plane (HQ Workforce plan)")
+        .description("Provision (or re-bind) the company remote vault DB via HQ control plane (Team plan)")
         .requiredOption("--company <slug>", "Company slug")
         .option("--region <region>", "AWS region", "us-east-1")
         .action(async (opts) => {
@@ -65,9 +65,9 @@ export function registerDbProvisionCommand(db, depsFactory = defaultDeps) {
                 throw error;
             const msg = error instanceof Error ? error.message : "Unknown error";
             const status = error.status;
-            if (status === 402 || /PLAN_REQUIRED|Team plan|Workforce|\$500/i.test(msg)) {
-                console.error(chalk.red("Error:"), "Remote vault DB requires the HQ Workforce plan ($500/mo).");
-                console.error(chalk.dim("Local databases still work: hq db status|sql|migrate — no HQ Workforce plan required."));
+            if (status === 402 || /PLAN_REQUIRED|Team plan|\$500/i.test(msg)) {
+                console.error(chalk.red("Error:"), "Remote vault DB requires the HQ Team plan ($500/mo).");
+                console.error(chalk.dim("Local databases still work: hq db status|sql|migrate — no Team plan required."));
             }
             else if (status === 404 || /Unknown route|Not Found/i.test(msg)) {
                 console.error(chalk.red("Error:"), "Remote DB control plane is not available yet (routes not deployed).");

package/dist/commands/db-sql.js

@@ -4,9 +4,9 @@
  * Default is read-only. Prefer `hq db migrate` for schema changes.
  * Never prints remote connection strings.
  */
-import { Option } from "commander";
 import chalk from "chalk";
 import fs from "node:fs";
+import { runRemoteSql } from "../lib/db/remote-sql.js";
 import { formatSqlResult, runLocalSql } from "../lib/db/sql.js";
 function readSqlArg(sqlArgs, stdinFlag) {
     if (stdinFlag || sqlArgs.length === 0) {
@@ -19,10 +19,10 @@ function readSqlArg(sqlArgs, stdinFlag) {
 }
 export function registerDbSqlCommand(db) {
     db.command("sql")
-        .description("Run SQL against the company vault DB (local; read-only by default)")
+        .description("Run SQL against the company vault DB (local default; --remote for secrets-injected remote; read-only by default)")
         .requiredOption("--company <slug>", "Company slug (tenant scope; required)")
         .option("--write", "Allow write/DDL statements (discouraged for ad-hoc DDL)", false)
-        .addOption(new Option("--remote", "Remote SQL is not available in this CLI build yet; local queries work without --remote").hideHelp())
+        .option("--remote", "Use remote tier via vault-bound credentials (not auto-replicated with local)", false)
         .option("--db-path <path>", "Dangerous: open a non-canonical DB path (denied unless --allow-cross-company-path)")
         .option("--allow-cross-company-path", "Dangerous: permit --db-path outside this company's canonical local DB", false)
         .option("--format <fmt>", "Output format: jsonl | table", "jsonl")
@@ -37,13 +37,27 @@ export function registerDbSqlCommand(db) {
                 process.exitCode = 1;
                 return;
             }
+            const sql = readSqlArg(sqlParts, !!opts.stdin).trim();
+            const format = opts.format === "table" ? "table" : "jsonl";
             if (opts.remote) {
-                console.error(chalk.red("Error: Remote SQL is not available in this CLI build yet. Local queries work without --remote."));
-                process.exitCode = 1;
+                // Local and remote are not auto-replicated (v1 limitation).
+                const remoteResult = await runRemoteSql({
+                    company,
+                    sql,
+                    getConnectionConfig: async () => {
+                        throw new Error("no remote binding");
+                    },
+                });
+                console.log(formatSqlResult({
+                    columns: remoteResult.rows[0]
+                        ? Object.keys(remoteResult.rows[0])
+                        : [],
+                    rows: remoteResult.rows,
+                    changes: 0,
+                    readonly: true,
+                }, format));
                 return;
             }
-            const sql = readSqlArg(sqlParts, !!opts.stdin).trim();
-            const format = opts.format === "table" ? "table" : "jsonl";
             const result = runLocalSql({
                 company,
                 sql,

package/dist/commands/dm.d.ts

@@ -71,7 +71,7 @@ export interface ChannelMember {
     handle?: string;
 }
 /** A structured mention as the POST messages route expects it. */
-interface ChannelMention {
+export interface ChannelMention {
     participantUid: string;
     participantType: "agent" | "human";
     displayName: string;
@@ -97,13 +97,6 @@ export declare function mentionParticipantType(uid: string): "agent" | "human";
  * Trailing punctuation is trimmed ("@Izzy," → "Izzy"), so a name is never
  * polluted by the sentence around it.
  */
-/**
- * Once a quoted token has resolved to a real mention, the quotes have done
- * their job (they only exist so a multi-word name parses as one token). Post
- * the body with `@"Jacob Posel"` rewritten to `@Jacob Posel`, which is how a
- * person would have typed it and how the room should read it. Pure.
- */
-export declare function stripMentionQuotes(body: string): string;
 export declare function parseMentionTokens(body: string): string[];
 /**
  * The names one roster row answers to, lowercased: its display name, the slug of
@@ -133,7 +126,6 @@ export declare function resolveMentions(tokens: string[], members: ChannelMember
  * Returns null on anything that doesn't match. Pure → unit-testable.
  */
 export declare function parseDuration(input: string): number | null;
-type DmAudience = "human" | "agent" | "both";
 export interface DmSendBody {
     toEmail?: string;
     toPersonUid?: string;
@@ -141,7 +133,6 @@ export interface DmSendBody {
     prompt?: string;
     details?: string;
     deliverAt?: string;
-    audience?: DmAudience;
 }
 /**
  * Build the POST /v1/notify/dm request body from CLI inputs. Pure (no I/O,
@@ -158,7 +149,6 @@ export declare function buildDmBody(args: {
     at?: string;
     inDelay?: string;
     now: number;
-    audience?: string;
 }): DmSendBody;
 /** A pending incoming connection request, as returned by the backend. */
 export interface ConnectionRequest {
@@ -178,24 +168,21 @@ export interface ConnectionRequest {
  */
 export declare function matchRequest(requests: ConnectionRequest[], identifier: string): ConnectionRequest | null;
 /**
- * Build the POST body for an accept/decline/block action. The connections
- * endpoints accept the requester's `personUid`, so resolve friendly email or
- * pairKey input through the pending request before building the body. Pure →
- * unit-testable.
+ * Build the POST body for an accept/decline/block action. Prefers a resolved
+ * pairKey (from a matched pending request); otherwise falls back to the
+ * recipient identifier the backend can resolve (`withPersonUid` for a prs_ UID,
+ * `toEmail`-style is not supported by the connections endpoints so we send
+ * `withEmail`). Pure → unit-testable.
  *
  * Throws Error with a user-facing message when the identifier can't be resolved.
  */
 export declare function buildConnectionActionBody(identifier: string, matched: ConnectionRequest | null): {
-    personUid: string;
+    pairKey: string;
+} | {
+    withPersonUid: string;
+} | {
+    withEmail: string;
 };
-/** Fetch the caller's channels (GET /v1/notify/channels). */
-export declare function fetchChannels(token: string): Promise<ChannelSummary[]>;
-/**
- * Fetch a channel's roster (GET /v1/notify/channels/{id}/members). Any member
- * who can read the channel may read its members, so this is the same gate the
- * post itself passes. Used to resolve `@name` mentions into participant uids.
- */
-export declare function fetchChannelMembers(token: string, channelId: string): Promise<ChannelMember[]>;
 /** One incoming DM as returned by GET /v1/notify/inbox. */
 export interface DmInboxEvent {
     eventId: string;
@@ -207,10 +194,6 @@ export interface DmInboxEvent {
     details?: string;
     prompt?: string;
     acknowledgedAt?: string;
-    audience?: DmAudience;
-    /** US-007 file references. Singular `attachment` is the legacy form. */
-    attachments?: DmAttachment[];
-    attachment?: DmAttachment;
 }
 /** One message in a 1:1 thread as returned by GET /v1/notify/thread. */
 export interface DmThreadMessage {
@@ -223,9 +206,6 @@ export interface DmThreadMessage {
     direction: "in" | "out";
     details?: string;
     prompt?: string;
-    audience?: DmAudience;
-    attachments?: DmAttachment[];
-    attachment?: DmAttachment;
 }
 /** One channel/group message from GET /v1/notify/channels/{id}/messages. */
 export interface ChannelMessageItem {
@@ -236,35 +216,7 @@ export interface ChannelMessageItem {
     fromDisplayName?: string;
     body: string;
     createdAt: string;
-    /** Present on a reply; absent on a top-level (root) message. */
-    rootEventId?: string;
-    attachments?: DmAttachment[];
-    attachment?: DmAttachment;
 }
-/**
- * One file attached to a DM (US-007 `attachments[]` on the read endpoints). The
- * server returns a vault path, not bytes: a reader fetches it with
- * a presigned read of that key.
- */
-export interface DmAttachment {
-    vaultPath: string;
-    name?: string;
-    sizeBytes?: number;
-    contentType?: string;
-    kind?: string;
-    companyUid?: string;
-}
-/**
- * Render the attachment lines for one message. An agent reading its DMs through
- * the CLI only ever sees this text, so the vault path AND the command that
- * fetches it both have to be on screen — a bare "[image]" marker is why a bot
- * answers "no image came through". Returns "" when there is nothing attached.
- * Pure → unit-testable.
- */
-export declare function formatAttachments(m: {
-    attachments?: DmAttachment[];
-    attachment?: DmAttachment;
-}, indent?: string): string;
 /**
  * Human label for a message sender — display name, else email, else uid. Pure →
  * unit-testable.
@@ -306,65 +258,6 @@ export declare function formatInboxEvent(e: DmInboxEvent, nowMs: number): string
 /** Render one 1:1 thread line, tagged by direction. */
 export declare function formatThreadMessage(m: DmThreadMessage, nowMs: number): string;
 /** Render one channel/group message line. */
-export declare function formatChannelMessage(m: ChannelMessageItem, nowMs: number, opts?: {
-    indent?: string;
-    showEventId?: boolean;
-}): string;
-/** Identity we can match against a channel message's from* fields. Pure. */
-export interface CallerIdentity {
-    personUid?: string;
-    email?: string;
-}
-/**
- * Read the caller's person/agent uid and email from a JWT we already hold.
- * Used to resolve `--thread last` (most recent top-level message *by us*).
- * Pure → unit-testable.
- */
-export declare function callerFromToken(token: string): CallerIdentity;
-/**
- * Newest-first channel history → the caller's most recent top-level eventId.
- * Replies (those with rootEventId) are skipped. Pure → unit-testable.
- */
-export declare function lastCallerRootEventId(messagesNewestFirst: ChannelMessageItem[], me: CallerIdentity): string | undefined;
-export type ThreadFlagResolution = {
-    ok: true;
-    rootEventId?: string;
-} | {
-    ok: false;
-    error: string;
-};
-/**
- * Resolve `--thread <eventId|last>` against a newest-first message page.
- * An explicit eventId is passed through; `last` picks our most recent
- * top-level message. Pure → unit-testable (the fetch is the caller's job).
- */
-export declare function resolveThreadFlag(thread: string | undefined, messagesNewestFirst: ChannelMessageItem[], me: CallerIdentity): ThreadFlagResolution;
-export interface ChannelThread {
-    root: ChannelMessageItem;
-    replies: ChannelMessageItem[];
-    /** True when the root is not in this page — replies hang off a placeholder. */
-    missingRoot?: boolean;
-}
-/**
- * Group a channel history page into roots with their replies underneath.
- * Orphan replies (root not in this page) hang off a placeholder carrying the
- * missing root's eventId. Pure → unit-testable.
- */
-export declare function groupChannelMessages(messages: ChannelMessageItem[]): ChannelThread[];
-/**
- * Human channel history: each root prints its eventId so `--thread` can copy
- * it; replies render indented under their root. `--json` does not use this.
- * Pure → unit-testable.
- */
-export declare function formatChannelTranscript(messages: ChannelMessageItem[], nowMs: number): string;
-/**
- * The agent uid when the caller is an agent (machine) identity, else null.
- * Agents may not read /v1/notify/inbox or /v1/notify/thread (the server
- * allow-list is intentionally human-only); their read surface is
- * GET /v1/agents/{uid}/inbox.
- */
-export declare function agentCallerUid(token: string, machine?: () => boolean): string | null;
-export declare const AGENT_THREAD_UNAVAILABLE: string;
+export declare function formatChannelMessage(m: ChannelMessageItem, nowMs: number): string;
 export declare function registerDmCommand(program: Command): void;
-export {};
 //# sourceMappingURL=dm.d.ts.map