@indigoai-us/hq-cli 5.342.11 → 5.342.13

package/dist/utils/package-use-lease.js

@@ -1,4 +1,4 @@
-import { createHash } from "node:crypto";
+import { createHash, randomBytes } from "node:crypto";
 import { mkdirSync, readFileSync, realpathSync, renameSync, rmSync, writeFileSync, } from "node:fs";
 import os from "node:os";
 import path from "node:path";
@@ -6,6 +6,8 @@ import { fileURLToPath } from "node:url";
 import { performance } from "node:perf_hooks";
 const CLI_NAME = "@indigoai-us/hq-cli";
 const UPDATE_REQUEST = "update.pending.json";
+export const PACKAGE_USE_LEASE_HANDOFF_ENV = "HQ_CLI_PACKAGE_USE_LEASE_HANDOFF";
+const HANDOFF_TIMEOUT_MS = 2_000;
 export class PackageUseUpdatePendingError extends Error {
     constructor(message) {
         super(message);
@@ -172,6 +174,93 @@ export function acquirePackageUseLease(prefix, hqVersion, stateDirectory) {
     }
     throw new PackageUseUpdatePendingError("An HQ CLI update is waiting for the package lease; retry when it finishes");
 }
+/**
+ * Create a bounded, per-reexec rendezvous in the current lease directory.
+ * The child confirms readiness only after publishing its own atomic lease.
+ */
+export function createPackageUseLeaseHandoff(lease, timeoutMs = HANDOFF_TIMEOUT_MS) {
+    const directory = path.dirname(lease.leasePath);
+    const markerPath = path.join(directory, `.reexec-${process.pid}-${randomBytes(12).toString("hex")}.handoff`);
+    let cleaned = false;
+    const cleanup = () => {
+        if (cleaned)
+            return;
+        cleaned = true;
+        process.removeListener("exit", cleanup);
+        try {
+            rmSync(markerPath, { force: true });
+            rmSync(`${markerPath}.tmp`, { force: true });
+        }
+        catch (error) {
+            process.stderr.write(`hq-cli package-use lease handoff cleanup failed (${errorLabel(error)})\n`);
+        }
+    };
+    process.once("exit", cleanup);
+    return {
+        envValue: markerPath,
+        async waitForChild(pid, childAlive) {
+            const deadline = Date.now() + timeoutMs;
+            while (childAlive() && Date.now() <= deadline) {
+                try {
+                    const marker = JSON.parse(readFileSync(markerPath, "utf8"));
+                    if (marker.pid === pid && Number.isSafeInteger(marker.start_time_ms) && typeof marker.lease_name === "string") {
+                        const leasePath = path.join(directory, marker.lease_name);
+                        if (path.basename(leasePath) === marker.lease_name) {
+                            const record = JSON.parse(readFileSync(leasePath, "utf8"));
+                            if (record.pid === pid && record.start_time_ms === marker.start_time_ms)
+                                return true;
+                        }
+                    }
+                }
+                catch (error) {
+                    if (error.code !== "ENOENT" && !(error instanceof SyntaxError)) {
+                        process.stderr.write(`hq-cli package-use lease handoff check failed (${errorLabel(error)})\n`);
+                    }
+                }
+                await new Promise((resolve) => setTimeout(resolve, 25));
+            }
+            return false;
+        },
+        cleanup,
+    };
+}
+export function createCurrentPackageUseLeaseHandoff(timeoutMs = HANDOFF_TIMEOUT_MS) {
+    return currentPackageUseLease ? createPackageUseLeaseHandoff(currentPackageUseLease, timeoutMs) : null;
+}
+/** Publish this process's lease identity to a parent waiting in the same prefix. */
+export function publishPackageUseLeaseHandoff(lease, env = process.env) {
+    const markerPath = env[PACKAGE_USE_LEASE_HANDOFF_ENV];
+    if (!markerPath)
+        return false;
+    const directory = path.dirname(lease.leasePath);
+    if (path.dirname(path.resolve(markerPath)) !== path.resolve(directory)) {
+        delete env[PACKAGE_USE_LEASE_HANDOFF_ENV];
+        return false;
+    }
+    const match = /^(\d+)-(\d+)\.json$/.exec(path.basename(lease.leasePath));
+    if (!match || Number(match[1]) !== process.pid) {
+        delete env[PACKAGE_USE_LEASE_HANDOFF_ENV];
+        return false;
+    }
+    const record = {
+        pid: process.pid,
+        start_time_ms: Number(match[2]),
+        lease_name: path.basename(lease.leasePath),
+    };
+    const tempPath = `${markerPath}.tmp`;
+    try {
+        writeFileSync(tempPath, `${JSON.stringify(record)}\n`, { flag: "wx", mode: 0o600 });
+        renameSync(tempPath, markerPath);
+        delete env[PACKAGE_USE_LEASE_HANDOFF_ENV];
+        return true;
+    }
+    catch (error) {
+        rmSync(tempPath, { force: true });
+        delete env[PACKAGE_USE_LEASE_HANDOFF_ENV];
+        process.stderr.write(`hq-cli package-use lease handoff publish failed (${errorLabel(error)})\n`);
+        return false;
+    }
+}
 function exists(file) {
     try {
         readFileSync(file);
@@ -198,6 +287,7 @@ export function acquireCurrentPackageUseLease() {
     }
     const lease = acquirePackageUseLease(prefix, pkg.version);
     currentPackageUseLease = lease;
+    publishPackageUseLeaseHandoff(lease);
     return lease;
 }
 /** Release this process's package-use lease after a long-running command has loaded its package modules. */
@@ -260,5 +350,8 @@ export function currentPackageUseUpdateRequested() {
 }
 export const __test__ = {
     waitForUpdateRequest,
+    setCurrentPackageUseLease(lease) {
+        currentPackageUseLease = lease;
+    },
 };
 //# sourceMappingURL=package-use-lease.js.map

package/dist/utils/resident-package-preload.d.ts

@@ -1,4 +1,4 @@
-export type ResidentPackagePath = "auth-login" | "bot" | "childWrapper" | "coreJobRun" | "login" | "mcp" | "daemon";
+export type ResidentPackagePath = "agent-kit" | "agent-mcp" | "auth-login" | "bot" | "childWrapper" | "coreJobRun" | "login" | "mcp" | "daemon" | "mesh-daemon" | "lanes-watch" | "monitor-wait" | "monitor-run";
 /** Package imports reachable lazily from each resident command's runtime graph. */
 export declare const RESIDENT_PACKAGE_MODULES: Record<ResidentPackagePath, readonly string[]>;
 export declare class ResidentPackagePreloadError extends Error {
@@ -10,4 +10,11 @@ export declare class ResidentPackagePreloadError extends Error {
 export declare function reportResidentPackagePreloadFailure(error: unknown): void;
 /** Resolve every lazy package module before a resident command releases its lease. */
 export declare function preloadResidentPackageModules(residentPath: ResidentPackagePath, load?: () => Promise<unknown>): Promise<void>;
+export interface ResidentCommandLeaseOptions {
+    preload?: () => Promise<void>;
+    reportFailure?: (error: unknown) => void;
+    release?: () => void;
+}
+/** Start a resident loop only after its declared lazy package imports are loaded. */
+export declare function runResidentCommandWithPackageLease<T>(residentPath: ResidentPackagePath, run: () => Promise<T>, options?: ResidentCommandLeaseOptions): Promise<T>;
 //# sourceMappingURL=resident-package-preload.d.ts.map

package/dist/utils/resident-package-preload.js

@@ -1,5 +1,8 @@
+import { releaseCurrentPackageUseLease, releasePackageUseLeaseAfterResidentPreload, } from "./package-use-lease.js";
 /** Package imports reachable lazily from each resident command's runtime graph. */
 export const RESIDENT_PACKAGE_MODULES = {
+    "agent-kit": ["../sentry.js", "../lib/plan-limit-nag.js", "../utils/plan-gate-error.js", "open"],
+    "agent-mcp": ["../sentry.js", "../lib/plan-limit-nag.js", "../utils/plan-gate-error.js", "../commands/access.js", "open"],
     login: [
         "../lib/mesh/api.js",
         "../lib/work-context/config.js",
@@ -40,8 +43,31 @@ export const RESIDENT_PACKAGE_MODULES = {
         "../utils/staged-npm-install.js",
         "open",
     ],
+    "mesh-daemon": ["../sentry.js", "../lib/plan-limit-nag.js", "../utils/plan-gate-error.js", "open"],
+    "lanes-watch": ["../sentry.js", "../lib/plan-limit-nag.js", "../utils/plan-gate-error.js", "open"],
+    "monitor-wait": ["../sentry.js", "../lib/plan-limit-nag.js", "../utils/plan-gate-error.js", "open"],
+    "monitor-run": ["../commands/lanes.js", "../lib/plan-limit-nag.js", "../utils/plan-gate-error.js", "../sentry.js", "open"],
 };
 const LOADERS = {
+    "agent-kit": [
+        async () => {
+            const { preloadSentrySdk } = await import("../sentry.js");
+            preloadSentrySdk();
+        },
+        () => import("../lib/plan-limit-nag.js"),
+        () => import("../utils/plan-gate-error.js"),
+        () => import("open"),
+    ],
+    "agent-mcp": [
+        async () => {
+            const { preloadSentrySdk } = await import("../sentry.js");
+            preloadSentrySdk();
+        },
+        () => import("../lib/plan-limit-nag.js"),
+        () => import("../utils/plan-gate-error.js"),
+        () => import("../commands/access.js"),
+        () => import("open"),
+    ],
     login: [
         () => import("../lib/mesh/api.js"),
         () => import("../lib/work-context/config.js"),
@@ -101,6 +127,43 @@ const LOADERS = {
         () => import("../utils/staged-npm-install.js"),
         () => import("open"),
     ],
+    "mesh-daemon": [
+        async () => {
+            const { preloadSentrySdk } = await import("../sentry.js");
+            preloadSentrySdk();
+        },
+        () => import("../lib/plan-limit-nag.js"),
+        () => import("../utils/plan-gate-error.js"),
+        () => import("open"),
+    ],
+    "lanes-watch": [
+        async () => {
+            const { preloadSentrySdk } = await import("../sentry.js");
+            preloadSentrySdk();
+        },
+        () => import("../lib/plan-limit-nag.js"),
+        () => import("../utils/plan-gate-error.js"),
+        () => import("open"),
+    ],
+    "monitor-wait": [
+        async () => {
+            const { preloadSentrySdk } = await import("../sentry.js");
+            preloadSentrySdk();
+        },
+        () => import("../lib/plan-limit-nag.js"),
+        () => import("../utils/plan-gate-error.js"),
+        () => import("open"),
+    ],
+    "monitor-run": [
+        () => import("../commands/lanes.js"),
+        () => import("../lib/plan-limit-nag.js"),
+        () => import("../utils/plan-gate-error.js"),
+        async () => {
+            const { preloadSentrySdk } = await import("../sentry.js");
+            preloadSentrySdk();
+        },
+        () => import("open"),
+    ],
 };
 export class ResidentPackagePreloadError extends Error {
     moduleSpecifier;
@@ -141,4 +204,9 @@ export async function preloadResidentPackageModules(residentPath, load) {
         }
     }));
 }
+/** Start a resident loop only after its declared lazy package imports are loaded. */
+export async function runResidentCommandWithPackageLease(residentPath, run, options = {}) {
+    await releasePackageUseLeaseAfterResidentPreload(options.preload ?? (() => preloadResidentPackageModules(residentPath)), options.reportFailure ?? reportResidentPackagePreloadFailure, options.release ?? releaseCurrentPackageUseLease);
+    return run();
+}
 //# sourceMappingURL=resident-package-preload.js.map

package/dist/utils/self-update.d.ts

@@ -56,6 +56,7 @@
  * Opt-outs: `HQ_NO_UPDATE_CHECK=1` (the shared knob that also silences
  * version-check), `hq rescue --no-self-update`, and the re-exec guard env.
  */
+import { spawn } from "node:child_process";
 import * as fs from "node:fs";
 import { type RunningInstall, type UpdateResult } from "./version-gate.js";
 import { type RestartDaemonResult } from "../lib/mesh/live/daemon/install.js";
@@ -145,6 +146,10 @@ export interface SelfUpdateDeps {
     renamePath?: typeof fs.renameSync;
     runner?: (cmd: string, args: string[], env?: NodeJS.ProcessEnv) => UpdateResult;
     reexec?: (argv: string[], env: NodeJS.ProcessEnv) => number | null;
+    /** Async process-spawn seam for lease handoff tests. */
+    spawnReexec?: typeof spawn;
+    /** stdin TTY probe for re-exec signal forwarding tests. */
+    stdinIsTTY?: () => boolean;
     acquireLock?: () => (() => void) | null;
     /**
      * Read-your-writes convergence check run after a "successful" install:

package/dist/utils/self-update.js

@@ -56,7 +56,7 @@
  * Opt-outs: `HQ_NO_UPDATE_CHECK=1` (the shared knob that also silences
  * version-check), `hq rescue --no-self-update`, and the re-exec guard env.
  */
-import { spawnSync } from "node:child_process";
+import { spawn } from "node:child_process";
 import { randomBytes } from "node:crypto";
 import * as fs from "node:fs";
 import * as path from "node:path";
@@ -70,6 +70,7 @@ import { canStageInstall, stagedNpmInstall } from "./staged-install.js";
 import { acquireUpdateLock as acquireSharedUpdateLock } from "./update-lock.js";
 import { markLatestIneffective } from "./version-check.js";
 import { restartDaemonServiceIfInstalled } from "../lib/mesh/live/daemon/install.js";
+import { createCurrentPackageUseLeaseHandoff, PACKAGE_USE_LEASE_HANDOFF_ENV, releaseCurrentPackageUseLease, } from "./package-use-lease.js";
 /**
  * Set on the re-exec'd child so it can never self-update (and re-exec) again.
  * One update + one re-exec per user invocation, ever.
@@ -596,18 +597,101 @@ export function acquireUpdateLock(now = Date.now()) {
  * command. Returns the child's exit status, or null when the child could not be
  * started at all (e.g. `hq` not on PATH in a minimal-PATH parent).
  */
-function reexecHq(argv, env) {
+async function reexecHq(argv, env, spawnProcess = spawn, stdinIsTTY = () => process.stdin.isTTY === true) {
     const plan = buildSpawnPlan("hq", argv);
-    const result = spawnSync(plan.cmd, plan.args, {
-        stdio: "inherit",
-        shell: plan.shell,
-        env,
-    });
-    if (result.error)
+    const handoff = createCurrentPackageUseLeaseHandoff();
+    const childEnv = handoff
+        ? { ...env, [PACKAGE_USE_LEASE_HANDOFF_ENV]: handoff.envValue }
+        : env;
+    let childForSignals;
+    let childSpawned = false;
+    let childClosed = false;
+    let spawnedChild;
+    const pendingSignals = [];
+    const reexecSignals = process.platform === "win32"
+        ? ["SIGINT", "SIGTERM"]
+        : ["SIGINT", "SIGTERM", "SIGHUP"];
+    const forwardSignal = (signal) => {
+        if (signal === "SIGINT" && stdinIsTTY())
+            return;
+        if (childClosed)
+            return;
+        if (!childForSignals || !childSpawned) {
+            pendingSignals.push(signal);
+            return;
+        }
+        if (childForSignals.exitCode === null && childForSignals.signalCode === null) {
+            childForSignals.kill(signal);
+        }
+    };
+    const signalHandlers = new Map(reexecSignals.map((signal) => [signal, () => forwardSignal(signal)]));
+    for (const [signal, handler] of signalHandlers)
+        process.on(signal, handler);
+    const removeSignalHandlers = () => {
+        for (const [signal, handler] of signalHandlers)
+            process.removeListener(signal, handler);
+    };
+    // spawnSync left default parent signal handling in place, so a parent-only
+    // SIGTERM or SIGHUP could terminate it. Forward stop signals to the async
+    // child while keeping this process waiting for the child's exit status.
+    try {
+        spawnedChild = spawnProcess(plan.cmd, plan.args, {
+            stdio: "inherit",
+            shell: plan.shell,
+            env: childEnv,
+        });
+        childForSignals = spawnedChild;
+    }
+    catch (error) {
+        removeSignalHandlers();
+        handoff?.cleanup();
+        process.stderr.write(`hq-cli re-exec spawn failed (${reexecErrorClass(error)})\n`);
         return null;
-    // A signal-killed child has status null; surface it as a failure exit rather
-    // than pretending the command completed.
-    return result.status ?? 1;
+    }
+    return new Promise((resolve) => {
+        let alive = true;
+        let spawnFailed = false;
+        spawnedChild.once("error", (error) => {
+            spawnFailed = true;
+            process.stderr.write(`hq-cli re-exec spawn failed (${reexecErrorClass(error)})\n`);
+        });
+        spawnedChild.once("spawn", () => {
+            childSpawned = true;
+            for (const signal of pendingSignals.splice(0)) {
+                if (spawnedChild.exitCode === null && spawnedChild.signalCode === null)
+                    spawnedChild.kill(signal);
+            }
+            if (!handoff || spawnedChild.pid === undefined)
+                return;
+            void handoff.waitForChild(spawnedChild.pid, () => alive).then((matched) => {
+                if (matched && alive) {
+                    releaseCurrentPackageUseLease();
+                    handoff.cleanup();
+                }
+            }).catch((error) => {
+                process.stderr.write(`hq-cli package-use lease handoff wait failed (${error instanceof Error ? error.name : "unknown"})\n`);
+            });
+        });
+        spawnedChild.once("close", (code, _signal) => {
+            alive = false;
+            childClosed = true;
+            pendingSignals.length = 0;
+            removeSignalHandlers();
+            handoff?.cleanup();
+            // The former spawnSync path returned null on spawn failure and 1 for a signal.
+            resolve(spawnFailed ? null : code ?? 1);
+        });
+    });
+}
+function reexecErrorClass(error) {
+    if (error && typeof error === "object") {
+        const code = error.code;
+        if (typeof code === "string" && /^[A-Z0-9_]{1,32}$/.test(code))
+            return code;
+        if (error instanceof Error)
+            return error.name;
+    }
+    return "unknown";
 }
 async function updateAndReexec(argv, flavor, known, deps) {
     const env = deps.env ?? process.env;
@@ -829,7 +913,11 @@ async function updateAndReexec(argv, flavor, known, deps) {
         return { action: "updated", latest };
     }
     const childEnv = { ...env, [REEXEC_GUARD_ENV]: "1" };
-    const status = (deps.reexec ?? reexecHq)([...argv.slice(2)], childEnv);
+    const status = deps.spawnReexec
+        ? await reexecHq([...argv.slice(2)], childEnv, deps.spawnReexec, deps.stdinIsTTY)
+        : deps.reexec
+            ? deps.reexec([...argv.slice(2)], childEnv)
+            : await reexecHq([...argv.slice(2)], childEnv, spawn, deps.stdinIsTTY);
     if (status === null) {
         console.error(chalk.yellow(`⚠ Updated hq-cli to ${latest}, but couldn't re-launch \`hq\` from PATH; ` +
             `continuing the ${flavor.noun} on ${current}.`));

package/docs/anywhere-runtime.md

@@ -73,7 +73,9 @@ the named-pipe transport without Unix mode or owner fields. Use `hq doctor
 --json` for the same fields as structured details. The hqd health operation is
 read-only and available while the runtime flag is off; it reports only the
 current directory's binding and never returns authentication tokens. A Unix
-socket that cannot be verified as user-only produces a warning. If an older
+socket that cannot be verified as user-only produces a warning. When a Unix
+socket is unreachable, doctor recommends installing the daemon service if it is
+absent or restarting it if it is installed. If an older
 resident daemon does not support the health operation, doctor falls back to
 `ping` for reachability, version and uptime, then warns that a restart is needed
 for full diagnostics.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.342.11",
+  "version": "5.342.13",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {
@@ -59,7 +59,7 @@
     "js-yaml": "^4.1.0",
     "mqtt": "5.15.2",
     "open": "^10.1.0",
-    "semver": "^7.6.3",
+    "semver": "^7.8.5",
     "simple-git": "^3.27.0",
     "smol-toml": "1.6.1",
     "varlock": "1.21.1"
@@ -69,11 +69,11 @@
     "@types/better-sqlite3": "^7.6.13",
     "@types/js-yaml": "^4.0.9",
     "@types/node": "^22.0.0",
-    "@types/semver": "^7.5.8",
+    "@types/semver": "^7.8.0",
     "@vitest/coverage-v8": "4.1.6",
     "aedes": "1.1.2",
     "aws-sdk-client-mock": "^4.1.0",
-    "esbuild": "0.27.0",
+    "esbuild": "0.28.2",
     "eslint": "^10.5.0",
     "husky": "^9.1.7",
     "lint-staged": "^15.5.2",

package/dist/lib/db/remote-engine.d.ts

@@ -1,58 +0,0 @@
-/**
- * Pluggable remote vault DB engine interface (vault-databases US-007).
- *
- * Default shipped adapter id: aurora-dsql.
- * This module is interface + registry only — no production AWS provision here.
- */
-/** Connection material written only to secrets stores — never CLI stdout. */
-export interface RemoteConnectionSecretPayload {
-    /** Opaque secret body (e.g. JSON with host/user/password or IAM token recipe). */
-    payload: Record<string, unknown>;
-    /** Suggested vault/Secrets Manager key suffix (namespaced by company elsewhere). */
-    secretNameHint: string;
-}
-export interface RemoteProvisionRequest {
-    companyUid: string;
-    companySlug: string;
-    region?: string;
-    /** Engine-specific options (cluster params, etc.). */
-    options?: Record<string, unknown>;
-}
-export interface RemoteProvisionResult {
-    engineId: string;
-    resourceArn: string;
-    region: string;
-    status: "ready" | "provisioning" | "failed" | "existing";
-    /** Secret payload to store — callers must not print. */
-    connectionSecret: RemoteConnectionSecretPayload;
-}
-export interface RemoteHealth {
-    engineId: string;
-    resourceArn: string;
-    healthy: boolean;
-    status: string;
-    checkedAt: string;
-}
-/**
- * Remote Postgres-class engine adapter.
- * Implementations live in control plane (hq-pro) for real AWS; CLI may mock.
- */
-export interface RemoteDbEngine {
-    readonly id: string;
-    provision(req: RemoteProvisionRequest): Promise<RemoteProvisionResult>;
-    deprovision(companyUid: string, resourceArn: string): Promise<void>;
-    connectionSecretPayload(companyUid: string, resourceArn: string): Promise<RemoteConnectionSecretPayload>;
-    healthCheck(resourceArn: string): Promise<RemoteHealth>;
-}
-/** Default engine selection (PRD decision). */
-export declare const DEFAULT_REMOTE_ENGINE_ID = "aurora-dsql";
-export declare function registerRemoteEngine(engine: RemoteDbEngine): void;
-export declare function getRemoteEngine(id?: string): RemoteDbEngine;
-export declare function listRemoteEngineIds(): string[];
-/** Clear registry (tests only). */
-export declare function _resetRemoteEngineRegistryForTests(): void;
-/**
- * In-memory mock engine for unit tests — no AWS.
- */
-export declare function createMockRemoteEngine(id?: string): RemoteDbEngine;
-//# sourceMappingURL=remote-engine.d.ts.map

package/dist/lib/db/remote-engine.js

@@ -1,87 +0,0 @@
-/**
- * Pluggable remote vault DB engine interface (vault-databases US-007).
- *
- * Default shipped adapter id: aurora-dsql.
- * This module is interface + registry only — no production AWS provision here.
- */
-/** Default engine selection (PRD decision). */
-export const DEFAULT_REMOTE_ENGINE_ID = "aurora-dsql";
-const registry = new Map();
-export function registerRemoteEngine(engine) {
-    registry.set(engine.id, engine);
-}
-export function getRemoteEngine(id = DEFAULT_REMOTE_ENGINE_ID) {
-    const engine = registry.get(id);
-    if (!engine) {
-        throw new Error(`remote DB engine not registered: ${id} (available: ${[...registry.keys()].join(", ") || "none"})`);
-    }
-    return engine;
-}
-export function listRemoteEngineIds() {
-    return [...registry.keys()];
-}
-/** Clear registry (tests only). */
-export function _resetRemoteEngineRegistryForTests() {
-    registry.clear();
-}
-/**
- * In-memory mock engine for unit tests — no AWS.
- */
-export function createMockRemoteEngine(id = "mock") {
-    const resources = new Map();
-    return {
-        id,
-        async provision(req) {
-            const existing = [...resources.entries()].find(([, v]) => v.companyUid === req.companyUid);
-            if (existing) {
-                const [arn, meta] = existing;
-                return {
-                    engineId: id,
-                    resourceArn: arn,
-                    region: meta.region,
-                    status: "existing",
-                    connectionSecret: {
-                        payload: { mock: true, companyUid: req.companyUid },
-                        secretNameHint: `db/remote/${req.companySlug}`,
-                    },
-                };
-            }
-            const arn = `arn:mock:db:${req.companyUid}`;
-            const region = req.region ?? "us-east-1";
-            resources.set(arn, { companyUid: req.companyUid, region });
-            return {
-                engineId: id,
-                resourceArn: arn,
-                region,
-                status: "ready",
-                connectionSecret: {
-                    payload: { mock: true, companyUid: req.companyUid },
-                    secretNameHint: `db/remote/${req.companySlug}`,
-                },
-            };
-        },
-        async deprovision(companyUid, resourceArn) {
-            const meta = resources.get(resourceArn);
-            if (meta && meta.companyUid === companyUid) {
-                resources.delete(resourceArn);
-            }
-        },
-        async connectionSecretPayload(companyUid, resourceArn) {
-            return {
-                payload: { mock: true, companyUid, resourceArn },
-                secretNameHint: `db/remote/${companyUid}`,
-            };
-        },
-        async healthCheck(resourceArn) {
-            const ok = resources.has(resourceArn);
-            return {
-                engineId: id,
-                resourceArn,
-                healthy: ok,
-                status: ok ? "ready" : "missing",
-                checkedAt: new Date().toISOString(),
-            };
-        },
-    };
-}
-//# sourceMappingURL=remote-engine.js.map

package/dist/lib/db/remote-sql.d.ts

@@ -1,22 +0,0 @@
-/**
- * Remote SQL helper with injected credentials and executor (US-010).
- *
- * Connection string never appears in argv, logs, or stdout.
- * The CLI command does not currently wire this helper to a remote executor.
- */
-export interface RemoteSqlOptions {
-    company: string;
-    sql: string;
-    /** Injected secret material — never log. */
-    getConnectionConfig: () => Promise<Record<string, unknown>>;
-    /** Execute against remote; tests inject mock. */
-    execute?: (config: Record<string, unknown>, sql: string) => Promise<Record<string, unknown>[]>;
-}
-export interface RemoteSqlResult {
-    rows: Record<string, unknown>[];
-}
-/**
- * Run SQL on remote tier using vault-bound credentials.
- */
-export declare function runRemoteSql(opts: RemoteSqlOptions): Promise<RemoteSqlResult>;
-//# sourceMappingURL=remote-sql.d.ts.map

package/dist/lib/db/remote-sql.js

@@ -1,36 +0,0 @@
-/**
- * Remote SQL helper with injected credentials and executor (US-010).
- *
- * Connection string never appears in argv, logs, or stdout.
- * The CLI command does not currently wire this helper to a remote executor.
- */
-function assertNoLeak(label, value) {
-    const s = typeof value === "string" ? value : JSON.stringify(value);
-    if (/postgres:\/\//i.test(s) || /postgresql:\/\//i.test(s)) {
-        throw new Error(`${label}: connection string leak blocked`);
-    }
-}
-/**
- * Run SQL on remote tier using vault-bound credentials.
- */
-export async function runRemoteSql(opts) {
-    if (!opts.sql?.trim()) {
-        throw new Error("SQL statement is required");
-    }
-    let config;
-    try {
-        config = await opts.getConnectionConfig();
-    }
-    catch (e) {
-        const msg = e instanceof Error ? e.message : "no remote binding";
-        throw new Error(`remote SQL unavailable: ${msg}`);
-    }
-    assertNoLeak("connection config", config);
-    if (!opts.execute) {
-        throw new Error("remote SQL executor not configured in this build (adapter pending live DSQL wire-up)");
-    }
-    const rows = await opts.execute(config, opts.sql);
-    assertNoLeak("remote sql rows", rows);
-    return { rows };
-}
-//# sourceMappingURL=remote-sql.js.map