@indigoai-us/hq-cli 5.314.0 → 5.316.0

package/dist/commands/team-sync.js

@@ -16,6 +16,7 @@ import chalk from 'chalk';
 import simpleGit from 'simple-git';
 import { resolveDefaultHqRoot } from '../utils/cognito-session.js';
 import { ensureCognitoToken } from '../utils/cognito-session.js';
+import { readCompaniesManifestMap } from '../lib/work-context/repo-remote.js';
 // ─── API helpers ────────────────────────────────────────────────────────────
 const API_BASE = 'https://example.com/api';
 async function apiGet(urlPath, token) {
@@ -137,15 +138,38 @@ function getTrackedFiles(repoDir) {
 function discoverTeamDirs(hqRoot) {
     const companiesDir = path.join(hqRoot, 'companies');
     if (!fs.existsSync(companiesDir)) {
-        return [];
+        return {
+            teams: [],
+            cloudSyncedCompanyNames: [],
+            nonCloudBackedCompanyNames: [],
+            diagnostics: [`companies directory ${companiesDir}: missing`],
+        };
+    }
+    let entries;
+    try {
+        entries = fs.readdirSync(companiesDir, { withFileTypes: true });
     }
+    catch (error) {
+        return {
+            teams: [],
+            cloudSyncedCompanyNames: [],
+            nonCloudBackedCompanyNames: [],
+            diagnostics: [
+                `companies directory ${companiesDir}: could not read (${error instanceof Error ? error.message : 'unknown error'})`,
+            ],
+        };
+    }
+    const companyDirs = entries.filter((entry) => entry.isDirectory());
     const results = [];
-    for (const entry of fs.readdirSync(companiesDir, { withFileTypes: true })) {
-        if (!entry.isDirectory())
-            continue;
+    const missingTeamJson = [];
+    const invalidTeamJson = [];
+    const companiesManifest = readCompaniesManifestMap(hqRoot) ?? {};
+    for (const entry of companyDirs) {
         const teamJsonPath = path.join(companiesDir, entry.name, 'team.json');
-        if (!fs.existsSync(teamJsonPath))
+        if (!fs.existsSync(teamJsonPath)) {
+            missingTeamJson.push(teamJsonPath);
             continue;
+        }
         try {
             const raw = fs.readFileSync(teamJsonPath, 'utf-8');
             const meta = JSON.parse(raw);
@@ -155,12 +179,31 @@ function discoverTeamDirs(hqRoot) {
                     meta,
                 });
             }
+            else {
+                invalidTeamJson.push(teamJsonPath);
+            }
         }
         catch {
-            // Skip malformed team.json
+            invalidTeamJson.push(teamJsonPath);
         }
     }
-    return results;
+    const missingTeamJsonCompanyNames = missingTeamJson.map((file) => path.basename(path.dirname(file)));
+    const isCloudBacked = (name) => {
+        const cloudUid = companiesManifest[name]?.cloud_uid;
+        return typeof cloudUid === 'string' && cloudUid.trim().length > 0;
+    };
+    return {
+        teams: results,
+        cloudSyncedCompanyNames: missingTeamJsonCompanyNames.filter(isCloudBacked),
+        nonCloudBackedCompanyNames: missingTeamJsonCompanyNames.filter((name) => !isCloudBacked(name)),
+        diagnostics: [
+            `HQ root resolver: resolveDefaultHqRoot() returned ${hqRoot}`,
+            `companies directory ${companiesDir}: present; ${companyDirs.length} direct company directories found`,
+            `team.json discovery: ${results.length} valid, ${missingTeamJson.length} missing, ${invalidTeamJson.length} unreadable or invalid`,
+            ...missingTeamJson.map((file) => `${file}: missing`),
+            ...invalidTeamJson.map((file) => `${file}: unreadable or invalid`),
+        ],
+    };
 }
 /**
  * Sync a single team directory:
@@ -308,9 +351,27 @@ export function registerTeamSyncCommand(program) {
         try {
             const hqRoot = resolveDefaultHqRoot({ onMissing: 'throw' });
             // 1. Discover team directories
-            let teamDirs = discoverTeamDirs(hqRoot);
+            const discovery = discoverTeamDirs(hqRoot);
+            let teamDirs = discovery.teams;
             if (teamDirs.length === 0) {
-                console.log(chalk.yellow('No team directories found. Join a team first with: npx create-hq'));
+                console.log(chalk.yellow('No joined team directories found; no team sync ran.'));
+                if (discovery.cloudSyncedCompanyNames.length > 0) {
+                    const companyNames = discovery.cloudSyncedCompanyNames
+                        .map((name) => `"${name}"`)
+                        .join(', ');
+                    console.log(chalk.yellow(`Companies ${companyNames} are cloud-synced and do not have team.json. ` +
+                        'hq team-sync only handles git team repositories with team.json.'));
+                    console.log(chalk.dim('Use `hq sync pull --all` to sync company vault files and `hq sync status` to check their local sync state.'));
+                }
+                if (discovery.nonCloudBackedCompanyNames.length > 0) {
+                    const companyNames = discovery.nonCloudBackedCompanyNames
+                        .map((name) => `"${name}"`)
+                        .join(', ');
+                    console.log(`Companies ${companyNames} have no team.json and are not cloud-backed.`);
+                }
+                for (const diagnostic of discovery.diagnostics) {
+                    console.log(chalk.dim(`  ${diagnostic}`));
+                }
                 return;
             }
             // Filter to specific team if requested
@@ -318,7 +379,7 @@ export function registerTeamSyncCommand(program) {
                 teamDirs = teamDirs.filter((t) => t.meta.team_slug === options.team);
                 if (teamDirs.length === 0) {
                     console.log(chalk.red(`Team "${options.team}" not found. Available teams:`));
-                    for (const t of discoverTeamDirs(hqRoot)) {
+                    for (const t of discoverTeamDirs(hqRoot).teams) {
                         console.log(`  - ${t.meta.team_slug} (${t.meta.team_name})`);
                     }
                     process.exit(1);

package/dist/commands/update.js

@@ -5,6 +5,7 @@
 import * as path from 'path';
 import { findHqRoot, readManifest, readLock, writeLock, getModulesDir } from '../utils/manifest.js';
 import { fetchRepo, pullRepo, getCurrentCommit, isRepo } from '../utils/git.js';
+import { restartDaemonServiceIfInstalled } from "../lib/mesh/live/daemon/install.js";
 export function registerUpdateCommand(program) {
     program
         .command('update [module-name]')
@@ -49,6 +50,11 @@ export function registerUpdateCommand(program) {
                 }
             }
             writeLock(hqRoot, lock);
+            // An installed daemon is a separate Node process. Refresh it
+            // best-effort after a successful update without making the update fail.
+            const restart = restartDaemonServiceIfInstalled({ hqRoot });
+            if (restart.message)
+                console.log(restart.message);
             console.log('\nLock file updated.');
         }
         catch (error) {

package/dist/commands/vault-retention-flag.d.ts

@@ -0,0 +1,3 @@
+export declare const VAULT_RETENTION_SETTINGS_FLAG = "cli.vault-retention-settings";
+export declare function vaultRetentionSettingsEnabled(companyUid?: string, idToken?: string): boolean | Promise<boolean>;
+//# sourceMappingURL=vault-retention-flag.d.ts.map

package/dist/commands/vault-retention-flag.js

@@ -0,0 +1,9 @@
+import { resolveCompanyFlagGate, resolveProcessFlagGate } from "../lib/flag-registry.js";
+export const VAULT_RETENTION_SETTINGS_FLAG = "cli.vault-retention-settings";
+export function vaultRetentionSettingsEnabled(companyUid, idToken) {
+    if (companyUid && idToken) {
+        return resolveCompanyFlagGate(companyUid, idToken, VAULT_RETENTION_SETTINGS_FLAG, { fallback: false }, () => false);
+    }
+    return resolveProcessFlagGate(VAULT_RETENTION_SETTINGS_FLAG, { fallback: false }, () => false);
+}
+//# sourceMappingURL=vault-retention-flag.js.map

package/dist/commands/vault-retention.d.ts

@@ -0,0 +1,11 @@
+import { Command } from "commander";
+import { vaultApiFetch } from "../utils/vault-api.js";
+type Dependencies = {
+    enabled: (companyUid?: string, token?: string) => boolean | Promise<boolean>;
+    token: () => Promise<string>;
+    companyUid: (token: string, slug: string | undefined) => Promise<string>;
+    request: typeof vaultApiFetch;
+};
+export declare function registerVaultRetentionCommand(program: Command, deps?: Dependencies): void;
+export {};
+//# sourceMappingURL=vault-retention.d.ts.map

package/dist/commands/vault-retention.js

@@ -0,0 +1,69 @@
+import { ensureCognitoToken } from "../utils/cognito-session.js";
+import { markExpectedUserError } from "../utils/expected-cli-error.js";
+import { getCompanyUid, vaultApiFetch } from "../utils/vault-api.js";
+import { vaultRetentionSettingsEnabled } from "./vault-retention-flag.js";
+const defaultDependencies = {
+    enabled: vaultRetentionSettingsEnabled,
+    token: ensureCognitoToken,
+    companyUid: getCompanyUid,
+    request: vaultApiFetch,
+};
+export function registerVaultRetentionCommand(program, deps = defaultDependencies) {
+    const vault = program.command("vault").description("Manage HQ vault settings");
+    const retention = vault
+        .command("retention")
+        .description("Get or set the default retention for future vault object versions")
+        .option("--company <slug>", "Company vault slug (omit for your personal vault)");
+    const companyOf = (command) => command.opts().company ??
+        retention.opts().company;
+    retention
+        .command("get")
+        .description("Show the vault's default retention in days")
+        .action(async function () {
+        await execute(this, "GET");
+    });
+    retention
+        .command("set")
+        .description("Set the vault's default retention in days (1-30)")
+        .argument("<days>")
+        .action(async function (rawDays) {
+        const days = Number(rawDays);
+        if (!Number.isInteger(days) || days < 1 || days > 30) {
+            throw new Error("days must be an integer from 1 through 30");
+        }
+        await execute(this, "PUT", days);
+    });
+    async function execute(command, method, days) {
+        const slug = companyOf(command);
+        let token;
+        let companyUid;
+        if (slug) {
+            token = await deps.token();
+            companyUid = await deps.companyUid(token, slug);
+            if (!(await deps.enabled(companyUid, token))) {
+                throw markExpectedUserError(new Error("Vault retention settings are not enabled for this company."));
+            }
+        }
+        else {
+            if (!(await deps.enabled())) {
+                throw markExpectedUserError(new Error("Vault retention settings are not enabled for this company."));
+            }
+            token = await deps.token();
+        }
+        const query = companyUid ? { companyUid } : undefined;
+        const response = await deps.request({
+            token,
+            path: "/vault/retention",
+            method,
+            ...(query ? { query } : {}),
+            ...(days === undefined ? {} : { body: { days } }),
+        });
+        if (!response.ok) {
+            const body = (await response.json().catch(() => ({})));
+            throw new Error(body.error ?? body.message ?? response.statusText);
+        }
+        const body = (await response.json());
+        process.stdout.write(`${body.days} days\n`);
+    }
+}
+//# sourceMappingURL=vault-retention.js.map

package/dist/commands/version.d.ts

@@ -0,0 +1,10 @@
+/**
+ * hq version — labelled HQ vs CLI vs latest hq-core.
+ *
+ * Bare `hq --version` is intercepted on the fast path in index.ts and prints
+ * only the CLI semver. This registrar exists so `hq --help` lists the command
+ * and so `hq version` / `hq version --json` still work if the fast path is skipped.
+ */
+import { Command } from "commander";
+export declare function registerVersionCommand(program: Command): void;
+//# sourceMappingURL=version.d.ts.map

package/dist/commands/version.js

@@ -0,0 +1,11 @@
+import { runVersionCommand } from "../utils/version-report.js";
+export function registerVersionCommand(program) {
+    program
+        .command("version")
+        .description("Show HQ, CLI, and latest hq-core versions")
+        .option("--json", "Output the same payload as JSON")
+        .action(async () => {
+        await runVersionCommand(process.argv);
+    });
+}
+//# sourceMappingURL=version.js.map

package/dist/commands/whoami.d.ts

@@ -2,5 +2,27 @@
  * hq whoami — displays current user or 'not logged in'
  */
 import { Command } from 'commander';
+import { type PlanLimitStatus } from "../lib/billing/plan-lock.js";
+export declare const CLI_LIMIT_INVITE_TEAMMATE_FLAG = "cli.limit-invite-teammate-v1";
+export interface WhoamiTokenIdentity {
+    email?: string;
+    sub?: string;
+    delegatedEmail?: string;
+    delegatedSub?: string;
+    entityType?: string;
+    entityUid?: string;
+}
+export interface WhoamiDisplayIdentity {
+    email?: string;
+    sub?: string;
+}
+/**
+ * Resolves the person represented by an ID token without pairing a delegated
+ * email with the token subject of the delegating machine.
+ */
+export declare function resolveWhoamiIdentity(identity: WhoamiTokenIdentity): WhoamiDisplayIdentity;
+export declare function renderWhoamiPlanBlock(status: PlanLimitStatus, opts?: {
+    inviteTeammateEnabled?: boolean;
+}): string | null;
 export declare function registerWhoamiCommand(program: Command): void;
 //# sourceMappingURL=whoami.d.ts.map

package/dist/commands/whoami.js

@@ -4,12 +4,38 @@
 import chalk from 'chalk';
 import { loadCachedTokens, isExpiring, loadMachineCreds, } from '@indigoai-us/hq-cloud';
 import { peekIdToken as decodeIdToken } from "../utils/id-token.js";
-import { resolveCognitoTokenSource } from "../utils/cognito-session.js";
+import { ensureCognitoToken, loadMachineCachedTokens, resolveCognitoTokenSource, } from "../utils/cognito-session.js";
+import { colorizePlanLimitNotice, fetchPlanLimitStatus, renderPlanLine, renderPlanLimitNotice, } from "../lib/billing/plan-lock.js";
+import { resolveCompanyFlagGate, } from "../lib/flag-registry.js";
+import { queuePlanLimitInviteTeammateExposure } from "../utils/cli-telemetry.js";
+export const CLI_LIMIT_INVITE_TEAMMATE_FLAG = "cli.limit-invite-teammate-v1";
+/**
+ * Resolves the person represented by an ID token without pairing a delegated
+ * email with the token subject of the delegating machine.
+ */
+export function resolveWhoamiIdentity(identity) {
+    if (identity.email !== undefined && identity.sub !== undefined) {
+        return { email: identity.email, sub: identity.sub };
+    }
+    if (identity.delegatedEmail !== undefined && identity.delegatedSub !== undefined) {
+        return { email: identity.delegatedEmail, sub: identity.delegatedSub };
+    }
+    if (identity.email !== undefined || identity.sub !== undefined) {
+        return { email: identity.email, sub: identity.sub };
+    }
+    return {};
+}
 function peekIdToken(idToken) {
     const decoded = decodeIdToken(idToken);
     return {
         email: typeof decoded.email === "string" ? decoded.email : undefined,
         sub: typeof decoded.sub === "string" ? decoded.sub : undefined,
+        delegatedEmail: typeof decoded["custom:delegatedEmail"] === "string"
+            ? decoded["custom:delegatedEmail"]
+            : undefined,
+        delegatedSub: typeof decoded["custom:delegatedSub"] === "string"
+            ? decoded["custom:delegatedSub"]
+            : undefined,
         entityType: typeof decoded["custom:entityType"] === "string"
             ? decoded["custom:entityType"]
             : undefined,
@@ -18,17 +44,122 @@ function peekIdToken(idToken) {
             : undefined,
     };
 }
+/**
+ * starter-plan-hard-limits / US-011 — read the workspace plan-limit nag for
+ * `--company <slug>` (the bind notice).
+ *
+ * hq-pro owns the numbers (`GET /v1/billing/usage-limits`); this only reads
+ * them. Best-effort by construction: no session, a network failure, or a
+ * company the caller is not a member of all resolve to null — reported as
+ * UNKNOWN and rendered as nothing, never as a guessed over-limit or a guessed
+ * all-clear, and never as a command failure. The command exists to answer
+ * "who am I"; the plan line is decoration on top.
+ */
+async function readPlanLimits(company) {
+    const slug = company?.trim();
+    if (!slug)
+        return null;
+    try {
+        // NEVER interactive: this runs inside `--json` (before the authenticated
+        // check) and inside hq-core's per-turn plan-limit refresh hook. With the
+        // default `interactive: true`, a box with no cached session would launch a
+        // browser sign-in and block the caller instead of resolving to UNKNOWN.
+        const token = await ensureCognitoToken({ interactive: false });
+        const status = await fetchPlanLimitStatus(token, slug);
+        if (!status)
+            return null;
+        return {
+            status,
+            idToken: loadCachedTokens()?.idToken,
+        };
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Human rendering of the plan state: the full over-limit block when the
+ * workspace is over its Starter limits, the one-line `Plan: Starter — …`
+ * orientation when it is Starter and healthy, and nothing at all otherwise.
+ */
+function shouldOfferInviteTeammateSuggestion(status) {
+    if (!status.over ||
+        status.plan !== "free" ||
+        status.members?.used !== 1 ||
+        !status.companyUid) {
+        return false;
+    }
+    return true;
+}
+async function inviteTeammateSuggestionEnabled(status, idToken) {
+    if (!shouldOfferInviteTeammateSuggestion(status) || !status.companyUid) {
+        return false;
+    }
+    return resolveCompanyFlagGate(status.companyUid, idToken ?? "", CLI_LIMIT_INVITE_TEAMMATE_FLAG, { fallback: false }, () => false);
+}
+export function renderWhoamiPlanBlock(status, opts = {}) {
+    if (status.over) {
+        const inviteTeammateEnabled = opts.inviteTeammateEnabled === true;
+        return colorizePlanLimitNotice(renderPlanLimitNotice(status, { inviteTeammateEnabled }));
+    }
+    return renderPlanLine(status);
+}
+async function printPlanBlock(company) {
+    const planLimits = await readPlanLimits(company);
+    if (!planLimits)
+        return;
+    const { status, idToken } = planLimits;
+    const inviteTeammateEnabled = await inviteTeammateSuggestionEnabled(status, idToken);
+    const block = renderWhoamiPlanBlock(status, { inviteTeammateEnabled });
+    if (!block)
+        return;
+    console.log(block);
+    if (inviteTeammateEnabled && status.companyUid) {
+        queuePlanLimitInviteTeammateExposure(status.companyUid);
+    }
+}
 export function registerWhoamiCommand(program) {
     program
         .command('whoami')
         .description('Show the currently authenticated user')
-        .action(async () => {
+        .option('--json', 'Output identity metadata as JSON (never tokens)')
+        .option('--company <slug>', 'Also report this company\'s workspace plan state (Starter nag)')
+        .action(async (opts) => {
         try {
             // Effective source (same as auth status / ensureCognitoToken): env
             // opt-in, fresh-box default-creds when no usable person session, or
             // after a definitive person-refresh rejection marked the session rejected.
             const machine = resolveCognitoTokenSource() === "machine";
             const cached = loadCachedTokens();
+            if (opts.json) {
+                const machineCreds = machine ? loadMachineCreds() : null;
+                const identityCache = machine ? loadMachineCachedTokens() : cached;
+                const identity = identityCache ? peekIdToken(identityCache.idToken) : {};
+                const displayedIdentity = resolveWhoamiIdentity(identity);
+                const claims = identityCache ? decodeIdToken(identityCache.idToken) : {};
+                // Modern credentials carry the canonical UID. Legacy caches may only
+                // supply a UID when their subject is bound to the selected username.
+                const boundLegacyAgent = machineCreds && identity.entityType === 'agent'
+                    && (claims['cognito:username'] === machineCreds.username
+                        || claims.username === machineCreds.username || claims.sub === machineCreds.username)
+                    ? identity.entityUid ?? null : null;
+                const agentUid = machineCreds?.entityUid !== undefined
+                    ? (machineCreds.entityUid.startsWith('agt_') ? machineCreds.entityUid : null)
+                    : boundLegacyAgent;
+                // planLimits is additive: absent-or-null means UNKNOWN.
+                const planLimits = await readPlanLimits(opts.company);
+                console.log(JSON.stringify({
+                    schemaVersion: 1,
+                    authenticated: machine ? Boolean(machineCreds) : Boolean(cached && !isExpiring(cached, 0)),
+                    tokenSource: machine ? 'machine' : 'person',
+                    email: machine ? null : displayedIdentity.email ?? null,
+                    personUid: !machine && identity.entityType === 'person' ? identity.entityUid ?? null : null,
+                    agentUid,
+                    username: machineCreds?.username ?? null,
+                    planLimits,
+                }, null, 2));
+                return;
+            }
             if (machine) {
                 // Machine identities (company agents) mint sessions on demand from
                 // long-lived creds — report the machine identity honestly even when
@@ -39,6 +170,7 @@ export function registerWhoamiCommand(program) {
                     : undefined;
                 console.log(`Machine identity ${username}${entityUid ? ` (agent ${entityUid})` : ''} — sessions mint automatically`);
                 console.log(`token source: machine`);
+                await printPlanBlock(opts.company);
                 return;
             }
             if (!cached) {
@@ -46,12 +178,13 @@ export function registerWhoamiCommand(program) {
                 return;
             }
             if (isExpiring(cached, 0)) {
-                const who = peekIdToken(cached.idToken).email ?? 'unknown';
+                const who = resolveWhoamiIdentity(peekIdToken(cached.idToken)).email ?? 'unknown';
                 console.log(chalk.yellow(`Session expired for ${who}. Run 'hq login' to re-authenticate.`));
                 return;
             }
-            const { email, sub } = peekIdToken(cached.idToken);
+            const { email, sub } = resolveWhoamiIdentity(peekIdToken(cached.idToken));
             console.log(`Logged in as ${email ?? 'unknown'}${sub ? ` (${sub})` : ''}`);
+            await printPlanBlock(opts.company);
         }
         catch (error) {
             console.error(chalk.red('Error:'), error instanceof Error ? error.message : 'Unknown error');

package/dist/commands/workers.d.ts

@@ -1,18 +1,6 @@
 import { Command } from "commander";
-export interface RegistryWorker {
-    id: string;
-    path: string;
-    type: string;
-    visibility: string;
-    company?: string;
-    team?: string;
-    status?: string;
-    description?: string;
-    triggers?: string;
-    grants?: string;
-}
-/** Read + parse the worker registry. Empty array if it does not exist. */
-export declare function readWorkerRegistry(hqRoot: string): RegistryWorker[];
+export { readWorkerRegistry, type RegistryWorker } from "../lib/workers-registry/read.js";
+import { type RegistryWorker } from "../lib/workers-registry/read.js";
 /**
  * Best-effort active company: workspace/sessions/.current -> meta.yaml
  * company_slug. Undefined when no session context is set. Pure/read-only.

package/dist/commands/workers.js

@@ -5,16 +5,10 @@ import * as yaml from "js-yaml";
 import { parseUserYaml } from "../utils/user-yaml-error.js";
 import { ensureCognitoToken } from "../utils/cognito-session.js";
 import { vaultApiFetch, getCompanyUid } from "./secrets.js";
-import { GROUP_ID_PATTERN, EMAIL_PATTERN, normalizeFilePrefix } from "./_patterns.js";
+import { GROUP_ID_PATTERN, EMAIL_PATTERN, toSharedFolderGlob } from "./_patterns.js";
 import { findHqRoot } from "../utils/manifest.js";
-/** Read + parse the worker registry. Empty array if it does not exist. */
-export function readWorkerRegistry(hqRoot) {
-    const p = path.join(hqRoot, "core/workers/registry.yaml");
-    if (!fs.existsSync(p))
-        return [];
-    const doc = parseUserYaml(fs.readFileSync(p, "utf8"), p);
-    return doc?.workers ?? [];
-}
+export { readWorkerRegistry } from "../lib/workers-registry/read.js";
+import { readWorkerRegistry } from "../lib/workers-registry/read.js";
 /**
  * Best-effort active company: workspace/sessions/.current -> meta.yaml
  * company_slug. Undefined when no session context is set. Pure/read-only.
@@ -62,7 +56,10 @@ export function workerVaultPrefix(w) {
     const rel = w.path.startsWith(companyRoot)
         ? w.path.slice(companyRoot.length)
         : w.path;
-    return normalizeFilePrefix(rel);
+    // Worker sharing intentionally covers every child in the generated worker
+    // directory. Keep that conversion explicit: a user-supplied trailing slash
+    // on an ACL command instead means a private folder.
+    return toSharedFolderGlob(rel);
 }
 /** Classify a share principal (@all | email | grp_*) — null when invalid. */
 export function classifyPrincipal(principal) {

package/dist/fast-core.d.ts

@@ -1,16 +1,16 @@
 /**
- * Fast-path dispatcher for relocated scaffold scripts.
+ * Fast-path dispatcher for selected core commands.
  *
  * Reached from the entrypoint BEFORE `main.ts` (and its heavy command graph) is
- * ever imported, so a hot `hq core hq-session` / `hq core checkpoint-stop-gate`
- * dispatches in roughly node's own startup time. It imports only the light root
- * resolver and the bundled-script runner. The slower commander registration in
- * `core.ts` remains the complete path for any invocation this does not match.
+ * ever imported, so hot hook commands avoid the full commander graph. Shell
+ * entries use the bundled-script runner; native entries import their one handler
+ * module. The registration in `core.ts` remains the complete fallback path.
  */
+export declare function readStdinIfPiped(stream: NodeJS.ReadStream): Promise<string>;
 /**
- * Run the fast-path scaffold script named in `argv` and exit with its code.
+ * Run the fast-path core command named in `argv` and exit with its code.
  * Only call when {@link isFastCoreRequest} is true; a non-match returns without
  * doing anything.
  */
-export declare function runFastCore(argv: readonly string[]): void;
+export declare function runFastCore(argv: readonly string[]): Promise<void>;
 //# sourceMappingURL=fast-core.d.ts.map