@indigoai-us/hq-cli 5.345.110 → 5.345.112

package/dist/lib/capacity/ledger.d.ts

@@ -174,6 +174,13 @@ export interface NowAccount {
     observedAt?: string | null;
     reason: string | null;
     fixCommand: string | null;
+    /**
+     * True when the account is expired and the newest usage reading predates the
+     * token expiry. The router must not trust `limits` on this account: the
+     * numbers were recorded before the token lapsed and the collector has not
+     * been able to refresh them since.
+     */
+    usageStale?: boolean;
     limits: NowLimit[];
 }
 export interface NowProvider {
@@ -372,7 +379,9 @@ export interface LedgerOptions {
 export declare function capacityOptionsFromEnv(env?: NodeJS.ProcessEnv): LedgerOptions;
 export declare function capacityRoot(env?: NodeJS.ProcessEnv, home?: string): string;
 /** Shown for a credential that exists and is past expiry. Never a login. */
-export declare const EXPIRED_REASON = "expired: refreshes the next time Claude Code is used with this account";
+export declare const EXPIRED_REASON = "expired: hq capacity renews it on the next collect";
+/** The token endpoint rejected the stored refresh token. The human must sign in again. */
+export declare const SIGN_IN_REVOKED_REASON = "signed out: sign-in revoked";
 export declare function isExpiredReason(reason: string | null | undefined): boolean;
 export declare function isAccountFailureReason(reason: string): boolean;
 /** Exact command for an account that has no usable credential. */

package/dist/lib/capacity/ledger.js

@@ -189,12 +189,17 @@ const SIGNED_OUT_PREFIX = "signed out:";
 const EXPIRED_PREFIX = "expired:";
 /** Ledger text written before expired and signed-out were different states. */
 const LEGACY_EXPIRED_REASON = "signed out: token expired";
+/** Ledger text written before hq capacity refreshed Claude tokens itself. */
+const LEGACY_EXPIRED_REASON_V2 = "expired: refreshes the next time Claude Code is used with this account";
 /** Shown for a credential that exists and is past expiry. Never a login. */
-export const EXPIRED_REASON = "expired: refreshes the next time Claude Code is used with this account";
+export const EXPIRED_REASON = "expired: hq capacity renews it on the next collect";
+/** The token endpoint rejected the stored refresh token. The human must sign in again. */
+export const SIGN_IN_REVOKED_REASON = "signed out: sign-in revoked";
 export function isExpiredReason(reason) {
     if (!reason)
         return false;
     return reason === LEGACY_EXPIRED_REASON
+        || reason === LEGACY_EXPIRED_REASON_V2
         || reason === "unavailable: token_expired"
         || reason.startsWith(EXPIRED_PREFIX);
 }
@@ -1034,6 +1039,7 @@ function clusterAccounts(provider, events) {
                     ? "ok"
                     : "unknown";
         const home = homes[0] ?? null;
+        const usageStale = expired && (!Number.isFinite(latestReadingAt) || (problem?.at ?? 0) > latestReadingAt);
         accounts.push({
             accountId,
             labels: ordered.length > 0 ? ordered : [primary],
@@ -1049,6 +1055,7 @@ function clusterAccounts(provider, events) {
                 : isSignedOut
                     ? capacityLoginCommand(provider.provider, primary)
                     : null,
+            usageStale: usageStale ? true : undefined,
             limits,
         });
     }

package/dist/lib/capacity/project.js

@@ -186,6 +186,7 @@ function mergeGroup(group, homes, labels, provider) {
     const observedAt = latestObserved(group.map((piece) => piece.account));
     const organization = latestOrganization(group.map((piece) => piece.account));
     const accountId = (ok[0] ?? group[0])?.account.accountId ?? labels[0] ?? provider;
+    const usageStale = group.some((piece) => piece.account.usageStale === true);
     if (ok.length > 0) {
         let state = "ok";
         for (const limit of limits) {
@@ -203,6 +204,7 @@ function mergeGroup(group, homes, labels, provider) {
             observedAt,
             reason: null,
             fixCommand: null,
+            usageStale: usageStale ? true : undefined,
             limits,
         };
     }
@@ -220,6 +222,7 @@ function mergeGroup(group, homes, labels, provider) {
         observedAt,
         reason: problem?.reason ?? null,
         fixCommand: problem?.fixCommand ?? null,
+        usageStale: usageStale ? true : undefined,
         limits,
     };
 }

package/dist/lib/db/control-plane.d.ts

@@ -107,6 +107,23 @@ export interface RemoteAppSession {
         expiration?: string;
     };
 }
+export interface PersonalProvisionResponse {
+    ok: boolean;
+    personUid: string;
+    status: "ready" | "provisioning" | "existing";
+    region: string;
+    idempotent: boolean;
+}
+export interface PersonalStatusResponse {
+    personUid: string;
+    remote: {
+        engineId: string;
+        region: string;
+        status: string;
+        resourceArn: string;
+    } | null;
+}
+export type PersonalSession = RemoteAppSession;
 export interface RemoteDestroyAppResponse {
     ok: boolean;
     appId: string;
@@ -129,6 +146,11 @@ export declare class ControlPlaneDbClient {
         companySlug: string;
         region?: string;
     }): Promise<RemoteProvisionResponse>;
+    personalProvision(input?: {
+        region?: string;
+    }): Promise<PersonalProvisionResponse>;
+    personalStatus(): Promise<PersonalStatusResponse>;
+    personalSession(): Promise<PersonalSession>;
     status(companyUid: string): Promise<RemoteStatusResponse>;
     appUsage(companyUid: string, appId: string): Promise<RemoteAppUsageResponse>;
     usage(companyUid: string): Promise<RemoteUsageResponse>;

package/dist/lib/db/control-plane.js

@@ -54,6 +54,53 @@ export class ControlPlaneDbClient {
         }
         return JSON.parse(text);
     }
+    async personalProvision(input = {}) {
+        const token = await this.getAccessToken();
+        const res = await this.fetchImpl(`${this.baseUrl}/v1/db/personal/provision`, {
+            method: "POST",
+            headers: {
+                Authorization: `Bearer ${token}`,
+                "Content-Type": "application/json",
+            },
+            body: JSON.stringify(input),
+            signal: AbortSignal.timeout(DB_PROVISION_TIMEOUT_MS),
+        });
+        const text = await res.text();
+        assertNoPostgresUrl("personal provision", text);
+        if (!res.ok)
+            throw personalHttpError("personal provision", res.status, text);
+        return JSON.parse(text);
+    }
+    async personalStatus() {
+        const token = await this.getAccessToken();
+        const res = await this.fetchImpl(`${this.baseUrl}/v1/db/personal/status`, {
+            method: "GET",
+            headers: { Authorization: `Bearer ${token}` },
+            signal: AbortSignal.timeout(DB_STATUS_TIMEOUT_MS),
+        });
+        const text = await res.text();
+        assertNoPostgresUrl("personal status", text);
+        if (!res.ok)
+            throw personalHttpError("personal status", res.status, text);
+        return JSON.parse(text);
+    }
+    async personalSession() {
+        const token = await this.getAccessToken();
+        const res = await this.fetchImpl(`${this.baseUrl}/v1/db/personal/session`, {
+            method: "POST",
+            headers: {
+                Authorization: `Bearer ${token}`,
+                "Content-Type": "application/json",
+            },
+            body: JSON.stringify({}),
+            signal: AbortSignal.timeout(DB_STATUS_TIMEOUT_MS),
+        });
+        const text = await res.text();
+        assertNoPostgresUrl("personal session", text);
+        if (!res.ok)
+            throw personalHttpError("personal session", res.status, text);
+        return JSON.parse(text);
+    }
     async status(companyUid) {
         const token = await this.getAccessToken();
         const url = `${this.baseUrl}/v1/db/status?companyUid=${encodeURIComponent(companyUid)}`;
@@ -168,4 +215,7 @@ function httpError(label, status, text) {
         err.reason = reason;
     return err;
 }
+function personalHttpError(label, status, text) {
+    return Object.assign(httpError(label, status, text), { personalRoute: true });
+}
 //# sourceMappingURL=control-plane.js.map

package/dist/lib/db/remote-engine.d.ts

@@ -1,3 +1,4 @@
+import { type QueryConfig } from "pg";
 import type { ControlPlaneDbClient, RemoteAppSession } from "./control-plane.js";
 /**
  * Source of short-lived, app-scoped database credentials. The control plane
@@ -20,6 +21,7 @@ export interface RemoteQueryResult {
 export interface RemoteClient {
     connect(): Promise<void>;
     query(sql: string, params?: unknown[]): Promise<RemoteQueryResult | RemoteQueryResult[]>;
+    querySingleStatement(sql: string): Promise<RemoteQueryResult | RemoteQueryResult[]>;
     end(): Promise<void>;
 }
 export interface RemoteClientConfig {
@@ -37,10 +39,14 @@ export interface RemoteEngineDeps {
     tokenFactory?: (session: RemoteAppSession) => Promise<string>;
     clientFactory?: (config: RemoteClientConfig) => RemoteClient;
 }
+export declare function extendedQueryConfig(sql: string): QueryConfig & {
+    queryMode: "extended";
+};
 export declare function quoteIdent(name: string): string;
 export interface RemoteAppConnection {
     schema: string;
     query(sql: string, params?: unknown[]): Promise<RemoteQueryResult[]>;
+    querySingleStatement(sql: string): Promise<RemoteQueryResult[]>;
     close(): Promise<void>;
 }
 /** Open a connection as the app role with `search_path` set to the app schema. */
@@ -48,13 +54,15 @@ export declare function openRemoteAppConnection(deps: RemoteEngineDeps, input: {
     companyUid: string;
     appId: string;
 }): Promise<RemoteAppConnection>;
+/** Open a DSQL connection from a control-plane session with a caller-selected schema guard. */
+export declare function openRemoteSessionConnection(deps: RemoteEngineDeps, session: RemoteAppSession, isAllowedSchema: (schema: string) => boolean): Promise<RemoteAppConnection>;
 export interface RemoteSqlOutcome {
     results: RemoteQueryResult[];
     readonly: boolean;
 }
 /** Run SQL in the app schema. Without `write`, the SQL runs inside BEGIN READ ONLY and is rolled back. */
 export declare function runRemoteSql(conn: RemoteAppConnection, sql: string, write: boolean): Promise<RemoteSqlOutcome>;
-export declare function formatRemoteResults(outcome: RemoteSqlOutcome): string;
+export declare function formatRemoteResults(outcome: RemoteSqlOutcome, format?: "jsonl" | "table"): string;
 export interface DumpSummary {
     tables: number;
     rows: number;

package/dist/lib/db/remote-engine.js

@@ -18,7 +18,15 @@ async function defaultToken(session) {
     return signer.getDbConnectAuthToken();
 }
 function defaultClient(config) {
-    return new pg.Client(config);
+    const client = new pg.Client(config);
+    return Object.assign(client, {
+        querySingleStatement(sql) {
+            return client.query(extendedQueryConfig(sql));
+        },
+    });
+}
+export function extendedQueryConfig(sql) {
+    return { text: sql, queryMode: "extended" };
 }
 export function quoteIdent(name) {
     return `"${name.replace(/"/g, '""')}"`;
@@ -26,7 +34,11 @@ export function quoteIdent(name) {
 /** Open a connection as the app role with `search_path` set to the app schema. */
 export async function openRemoteAppConnection(deps, input) {
     const session = await deps.provider.getSession(input);
-    if (!SCHEMA_PATTERN.test(session.schema)) {
+    return openRemoteSessionConnection(deps, session, (schema) => SCHEMA_PATTERN.test(schema));
+}
+/** Open a DSQL connection from a control-plane session with a caller-selected schema guard. */
+export async function openRemoteSessionConnection(deps, session, isAllowedSchema) {
+    if (!isAllowedSchema(session.schema)) {
         throw new Error("Control plane returned an unexpected schema name");
     }
     const password = await (deps.tokenFactory ?? defaultToken)(session);
@@ -52,6 +64,10 @@ export async function openRemoteAppConnection(deps, input) {
             const res = await client.query(sql, params);
             return Array.isArray(res) ? res : [res];
         },
+        async querySingleStatement(sql) {
+            const res = await client.querySingleStatement(sql);
+            return Array.isArray(res) ? res : [res];
+        },
         close: () => client.end(),
     };
 }
@@ -59,7 +75,7 @@ export async function openRemoteAppConnection(deps, input) {
 export async function runRemoteSql(conn, sql, write) {
     await conn.query(write ? "BEGIN" : "BEGIN READ ONLY");
     try {
-        const results = await conn.query(sql);
+        const results = await conn.querySingleStatement(sql);
         await conn.query(write ? "COMMIT" : "ROLLBACK");
         return { results, readonly: !write };
     }
@@ -68,7 +84,19 @@ export async function runRemoteSql(conn, sql, write) {
         throw error;
     }
 }
-export function formatRemoteResults(outcome) {
+export function formatRemoteResults(outcome, format = "jsonl") {
+    if (format === "table") {
+        return outcome.results.map((result) => {
+            const columns = result.fields.map((field) => field.name);
+            if (columns.length === 0)
+                return "(no columns)";
+            const header = columns.join("\t");
+            const rows = result.rows
+                .map((row) => columns.map((column) => String(row[column] ?? "")).join("\t"))
+                .join("\n");
+            return rows ? `${header}\n${rows}` : header;
+        }).join("\n");
+    }
     const blocks = outcome.results.map((r) => {
         if (r.fields.length === 0)
             return JSON.stringify({ rows: r.rowCount ?? 0 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.345.110",
+  "version": "5.345.112",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {
@@ -48,7 +48,7 @@
     "@aws-sdk/client-iot-data-plane": "^3.1096.0",
     "@aws-sdk/client-s3": "^3.1049.0",
     "@aws-sdk/dsql-signer": "^3.1146.0",
-    "@indigoai-us/hq-cloud": "~6.18.69",
+    "@indigoai-us/hq-cloud": "~6.18.71",
     "@indigoai-us/hq-flags-client": "^0.1.2",
     "@modelcontextprotocol/sdk": "1.29.0",
     "@sentry/node": "^10.49.0",