@indigoai-us/hq-cli 5.345.32 → 5.345.34

package/dist/hq-cloud-sync-runner/package.json

@@ -1 +1 @@
-{"name":"hq-cli-daemon-sync-runner","type":"module","version":"6.18.33","bundleSha256":"ac95a726e29b0c0db65da6753d3c4e249f3f8a0cf7d56fe7579ac1804a14f34f","formatVersion":1}
+{"name":"hq-cli-daemon-sync-runner","type":"module","version":"6.18.33","bundleSha256":"75c61dfadcd4d28795d082e0cc867b09f2b825baa3db95f662c51e9dce299412","formatVersion":1}

package/dist/lib/daemon/remote-control.js

@@ -24,6 +24,7 @@ import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
 const TMUX_SOCKET = "hq-daemon";
+const TMUX_CREATOR_OPTION = "@hq-remote-control-creator";
 export const TMUX_SESSION = "remote-control";
 export const CODEX_TMUX_SESSION = "codex-remote-control";
 export function remoteControlArgs(opts) {
@@ -204,7 +205,56 @@ function safePaneTail(output) {
 }
 export async function runRemoteControlHost(deps) {
     const tmux = (...args) => deps.run(deps.tmux, ["-L", TMUX_SOCKET, ...args]);
-    const killSession = () => tmux("kill-session", "-t", deps.session);
+    const invokerPid = process.pid;
+    const killSession = () => {
+        if (tmux("has-session", "-t", deps.session).status !== 0)
+            return true;
+        const rawCreator = tmux("show-option", "-qv", "-t", deps.session, TMUX_CREATOR_OPTION);
+        let creator = null;
+        let legacyRecordReason = "no creator record";
+        if (rawCreator.status === 0 && rawCreator.stdout.trim() !== "") {
+            try {
+                const value = JSON.parse(rawCreator.stdout);
+                if (Number.isSafeInteger(value.pid) && value.pid > 0 && typeof value.cwd === "string") {
+                    creator = { pid: value.pid, cwd: value.cwd };
+                }
+                else {
+                    legacyRecordReason = "malformed creator record";
+                }
+            }
+            catch {
+                legacyRecordReason = "malformed creator record";
+            }
+        }
+        else if (rawCreator.status !== 0) {
+            legacyRecordReason = "malformed creator record";
+        }
+        if (!creator) {
+            deps.log(`remote-control tmux session has ${legacyRecordReason}; using bridge-owner liveness fallback; invoker pid=${invokerPid} cwd=${JSON.stringify(deps.cwd)}`);
+            const owner = foreignClaudeOwner(deps);
+            if (owner !== null) {
+                deps.log(`remote-control refused to kill legacy tmux session with live Claude bridge owner pid=${owner}; invoker pid=${invokerPid} cwd=${JSON.stringify(deps.cwd)}`);
+                return false;
+            }
+            const panePid = tmux("display-message", "-p", "-t", deps.session, "#{pane_pid}");
+            const paneCwd = tmux("display-message", "-p", "-t", deps.session, "#{pane_current_path}");
+            const victimPid = panePid.status === 0 && /^\d+$/.test(panePid.stdout.trim())
+                ? panePid.stdout.trim()
+                : "unknown";
+            const victimCwd = paneCwd.status === 0 && paneCwd.stdout.trim() !== ""
+                ? paneCwd.stdout.trim()
+                : "unknown";
+            deps.log(`remote-control kill tmux session victim pid=${victimPid} cwd=${JSON.stringify(victimCwd)} invoker pid=${invokerPid} cwd=${JSON.stringify(deps.cwd)}`);
+            return tmux("kill-session", "-t", deps.session).status === 0;
+        }
+        const sameInvoker = creator.pid === invokerPid && creator.cwd === deps.cwd;
+        if (!sameInvoker && (deps.pidAlive ?? processAlive)(creator.pid)) {
+            deps.log(`remote-control refused to kill live tmux session creator pid=${creator.pid} cwd=${JSON.stringify(creator.cwd)}; invoker pid=${invokerPid} cwd=${JSON.stringify(deps.cwd)}`);
+            return false;
+        }
+        deps.log(`remote-control kill tmux session victim pid=${creator.pid} cwd=${JSON.stringify(creator.cwd)} invoker pid=${invokerPid} cwd=${JSON.stringify(deps.cwd)}`);
+        return tmux("kill-session", "-t", deps.session).status === 0;
+    };
     /** When the session last printed anything, in ms; null when tmux cannot say. */
     const lastActivity = () => {
         const r = tmux("display-message", "-p", "-t", deps.session, "#{window_activity}");
@@ -213,7 +263,8 @@ export async function runRemoteControlHost(deps) {
     };
     // Remove this daemon's leftover private session before checking the process
     // pointer, so its previous command is not mistaken for a foreign owner.
-    killSession();
+    if (!killSession())
+        return 1;
     let waitingFor = null;
     for (;;) {
         if (deps.signal.aborted)
@@ -233,6 +284,14 @@ export async function runRemoteControlHost(deps) {
         deps.log(`could not create the tmux session: ${created.stderr.trim() || `tmux exited ${created.status}`}`);
         return 1;
     }
+    const creatorRecord = JSON.stringify({ pid: invokerPid, cwd: deps.cwd });
+    const recorded = tmux("set-option", "-t", deps.session, TMUX_CREATOR_OPTION, creatorRecord);
+    if (recorded.status !== 0) {
+        deps.log(`remote-control could not record session creator; invoker pid=${invokerPid} cwd=${JSON.stringify(deps.cwd)}`);
+        deps.log(`remote-control kill tmux session victim pid=${invokerPid} cwd=${JSON.stringify(deps.cwd)} invoker pid=${invokerPid} cwd=${JSON.stringify(deps.cwd)}`);
+        tmux("kill-session", "-t", deps.session);
+        return 1;
+    }
     const retained = tmux("set-window-option", "-t", deps.session, "remain-on-exit", "on");
     const started = retained.status === 0
         ? tmux("respawn-pane", "-k", "-t", deps.session, ...deps.argv)
@@ -242,7 +301,7 @@ export async function runRemoteControlHost(deps) {
         deps.log(`could not start the tmux session: ${started.stderr.trim() || `tmux exited ${started.status}`}`);
         return 1;
     }
-    deps.log(`${deps.label} started in ${deps.cwd}`);
+    deps.log(`${deps.label} started in ${JSON.stringify(deps.cwd)} (creator pid ${invokerPid})`);
     const startedWith = deps.binaryFingerprint();
     let updatedAt = null;
     for (;;) {

package/dist/lib/db/control-plane.d.ts

@@ -24,6 +24,33 @@ export interface RemoteStatusResponse {
         secretRef: string;
     } | null;
 }
+export interface RemoteUsageResponse {
+    companyUid: string;
+    dpuUsed: number;
+    dpuCap: number;
+    storageBytes: number;
+    storageCap: number;
+    pctDpu: number;
+    pctStorage: number;
+    period: string;
+    measuredAt: string | null;
+}
+/**
+ * Scoped temporary AWS credentials for one app's database role. The control
+ * plane would issue these from `POST /v1/db/apps/{appId}/session`.
+ */
+export interface RemoteAppSession {
+    endpoint: string;
+    region: string;
+    role: string;
+    schema: string;
+    credentials: {
+        accessKeyId: string;
+        secretAccessKey: string;
+        sessionToken: string;
+        expiration?: string;
+    };
+}
 export interface ControlPlaneClientOptions {
     baseUrl: string;
     /** Bearer access token */
@@ -41,5 +68,10 @@ export declare class ControlPlaneDbClient {
         region?: string;
     }): Promise<RemoteProvisionResponse>;
     status(companyUid: string): Promise<RemoteStatusResponse>;
+    usage(companyUid: string): Promise<RemoteUsageResponse>;
+    appSession(input: {
+        companyUid: string;
+        appId: string;
+    }): Promise<RemoteAppSession>;
 }
 //# sourceMappingURL=control-plane.d.ts.map

package/dist/lib/db/control-plane.js

@@ -78,5 +78,55 @@ export class ControlPlaneDbClient {
         }
         return JSON.parse(text);
     }
+    async usage(companyUid) {
+        const token = await this.getAccessToken();
+        const url = `${this.baseUrl}/v1/db/usage?companyUid=${encodeURIComponent(companyUid)}`;
+        const res = await this.fetchImpl(url, {
+            method: "GET",
+            headers: { Authorization: `Bearer ${token}` },
+            signal: AbortSignal.timeout(DB_STATUS_TIMEOUT_MS),
+        });
+        const text = await res.text();
+        assertNoPostgresUrl("usage", text);
+        if (!res.ok)
+            throw httpError("usage", res.status, text);
+        return JSON.parse(text);
+    }
+    async appSession(input) {
+        const token = await this.getAccessToken();
+        const url = `${this.baseUrl}/v1/db/apps/${encodeURIComponent(input.appId)}/session`;
+        const res = await this.fetchImpl(url, {
+            method: "POST",
+            headers: {
+                Authorization: `Bearer ${token}`,
+                "Content-Type": "application/json",
+            },
+            body: JSON.stringify({ companyUid: input.companyUid }),
+            signal: AbortSignal.timeout(DB_STATUS_TIMEOUT_MS),
+        });
+        const text = await res.text();
+        if (!res.ok)
+            throw httpError("session", res.status, text);
+        return JSON.parse(text);
+    }
+}
+function httpError(label, status, text) {
+    let msg = `${label} failed (${status})`;
+    let code;
+    try {
+        const j = JSON.parse(text);
+        if (typeof j.error === "string")
+            msg = j.error;
+        if (typeof j.code === "string")
+            code = j.code;
+    }
+    catch {
+        /* keep */
+    }
+    const err = new Error(msg);
+    err.status = status;
+    if (code)
+        err.code = code;
+    return err;
 }
 //# sourceMappingURL=control-plane.js.map

package/dist/lib/db/redact.d.ts

@@ -0,0 +1,4 @@
+/** Strip connection strings, signed-URL parameters, and token-like strings. */
+export declare function redactSecrets(text: string): string;
+export declare function safeErrorMessage(error: unknown): string;
+//# sourceMappingURL=redact.d.ts.map

package/dist/lib/db/redact.js

@@ -0,0 +1,17 @@
+const SECRET_PATTERNS = [
+    /postgres(?:ql)?:\/\/\S*/gi,
+    /X-Amz-[A-Za-z-]+=?[^\s&"']*/gi,
+    /Security-Token=?[^\s&"']*/gi,
+    /\b[A-Za-z0-9+/_=-]{40,}\b/g,
+];
+/** Strip connection strings, signed-URL parameters, and token-like strings. */
+export function redactSecrets(text) {
+    let out = text;
+    for (const pattern of SECRET_PATTERNS)
+        out = out.replace(pattern, "[redacted]");
+    return out;
+}
+export function safeErrorMessage(error) {
+    return redactSecrets(error instanceof Error ? error.message : "Unknown error");
+}
+//# sourceMappingURL=redact.js.map

package/dist/lib/db/remote-engine.d.ts

@@ -0,0 +1,67 @@
+import type { ControlPlaneDbClient, RemoteAppSession } from "./control-plane.js";
+/**
+ * Source of short-lived, app-scoped database credentials. The control plane
+ * route behind it, `POST /v1/db/apps/{appId}/session`, does not exist yet.
+ */
+export interface DbCredentialProvider {
+    getSession(input: {
+        companyUid: string;
+        appId: string;
+    }): Promise<RemoteAppSession>;
+}
+export declare function controlPlaneCredentialProvider(client: Pick<ControlPlaneDbClient, "appSession">): DbCredentialProvider;
+export interface RemoteQueryResult {
+    rowCount: number | null;
+    fields: {
+        name: string;
+    }[];
+    rows: Record<string, unknown>[];
+}
+export interface RemoteClient {
+    connect(): Promise<void>;
+    query(sql: string, params?: unknown[]): Promise<RemoteQueryResult | RemoteQueryResult[]>;
+    end(): Promise<void>;
+}
+export interface RemoteClientConfig {
+    host: string;
+    port: number;
+    user: string;
+    password: string;
+    database: string;
+    ssl: {
+        rejectUnauthorized: boolean;
+    };
+}
+export interface RemoteEngineDeps {
+    provider: DbCredentialProvider;
+    tokenFactory?: (session: RemoteAppSession) => Promise<string>;
+    clientFactory?: (config: RemoteClientConfig) => RemoteClient;
+}
+export declare function quoteIdent(name: string): string;
+export interface RemoteAppConnection {
+    schema: string;
+    query(sql: string, params?: unknown[]): Promise<RemoteQueryResult[]>;
+    close(): Promise<void>;
+}
+/** Open a connection as the app role with `search_path` set to the app schema. */
+export declare function openRemoteAppConnection(deps: RemoteEngineDeps, input: {
+    companyUid: string;
+    appId: string;
+}): Promise<RemoteAppConnection>;
+export interface RemoteSqlOutcome {
+    results: RemoteQueryResult[];
+    readonly: boolean;
+}
+/** Run SQL in the app schema. Without `write`, the SQL runs inside BEGIN READ ONLY and is rolled back. */
+export declare function runRemoteSql(conn: RemoteAppConnection, sql: string, write: boolean): Promise<RemoteSqlOutcome>;
+export declare function formatRemoteResults(outcome: RemoteSqlOutcome): string;
+export interface DumpSummary {
+    tables: number;
+    rows: number;
+}
+/**
+ * Stream a schema dump (DDL then INSERTs) to `write`. Reads data in chunks
+ * of DUMP_CHUNK_ROWS rows ordered by primary key.
+ */
+export declare function dumpRemoteSchema(conn: RemoteAppConnection, write: (text: string) => void): Promise<DumpSummary>;
+//# sourceMappingURL=remote-engine.d.ts.map

package/dist/lib/db/remote-engine.js

@@ -0,0 +1,165 @@
+import { DsqlSigner } from "@aws-sdk/dsql-signer";
+import pg from "pg";
+const SCHEMA_PATTERN = /^app_[a-z0-9_]+$/;
+const DUMP_CHUNK_ROWS = 500;
+export function controlPlaneCredentialProvider(client) {
+    return { getSession: (input) => client.appSession(input) };
+}
+async function defaultToken(session) {
+    const signer = new DsqlSigner({
+        hostname: session.endpoint,
+        region: session.region,
+        credentials: {
+            accessKeyId: session.credentials.accessKeyId,
+            secretAccessKey: session.credentials.secretAccessKey,
+            sessionToken: session.credentials.sessionToken,
+        },
+    });
+    return signer.getDbConnectAuthToken();
+}
+function defaultClient(config) {
+    return new pg.Client(config);
+}
+export function quoteIdent(name) {
+    return `"${name.replace(/"/g, '""')}"`;
+}
+/** Open a connection as the app role with `search_path` set to the app schema. */
+export async function openRemoteAppConnection(deps, input) {
+    const session = await deps.provider.getSession(input);
+    if (!SCHEMA_PATTERN.test(session.schema)) {
+        throw new Error("Control plane returned an unexpected schema name");
+    }
+    const password = await (deps.tokenFactory ?? defaultToken)(session);
+    const client = (deps.clientFactory ?? defaultClient)({
+        host: session.endpoint,
+        port: 5432,
+        user: session.role,
+        password,
+        database: "postgres",
+        ssl: { rejectUnauthorized: true },
+    });
+    await client.connect();
+    try {
+        await client.query(`SET search_path TO ${quoteIdent(session.schema)}`);
+    }
+    catch (error) {
+        await client.end().catch(() => undefined);
+        throw error;
+    }
+    return {
+        schema: session.schema,
+        async query(sql, params) {
+            const res = await client.query(sql, params);
+            return Array.isArray(res) ? res : [res];
+        },
+        close: () => client.end(),
+    };
+}
+/** Run SQL in the app schema. Without `write`, the SQL runs inside BEGIN READ ONLY and is rolled back. */
+export async function runRemoteSql(conn, sql, write) {
+    await conn.query(write ? "BEGIN" : "BEGIN READ ONLY");
+    try {
+        const results = await conn.query(sql);
+        await conn.query(write ? "COMMIT" : "ROLLBACK");
+        return { results, readonly: !write };
+    }
+    catch (error) {
+        await conn.query("ROLLBACK").catch(() => undefined);
+        throw error;
+    }
+}
+export function formatRemoteResults(outcome) {
+    const blocks = outcome.results.map((r) => {
+        if (r.fields.length === 0)
+            return JSON.stringify({ rows: r.rowCount ?? 0 });
+        if (r.rows.length === 0) {
+            return JSON.stringify({ columns: r.fields.map((f) => f.name), rows: 0 });
+        }
+        return r.rows.map((row) => JSON.stringify(row)).join("\n");
+    });
+    return blocks.join("\n");
+}
+function sqlLiteral(value) {
+    if (value === null || value === undefined)
+        return "NULL";
+    if (typeof value === "number" || typeof value === "bigint")
+        return String(value);
+    if (typeof value === "boolean")
+        return value ? "TRUE" : "FALSE";
+    if (value instanceof Date)
+        return `'${value.toISOString()}'`;
+    if (Buffer.isBuffer(value))
+        return `'\\x${value.toString("hex")}'`;
+    const text = typeof value === "object" ? JSON.stringify(value) : String(value);
+    return `'${text.replace(/'/g, "''")}'`;
+}
+function columnDdl(c) {
+    const parts = [quoteIdent(c.column_name), c.data_type];
+    if (c.column_default !== null)
+        parts.push(`DEFAULT ${c.column_default}`);
+    if (c.is_nullable === "NO")
+        parts.push("NOT NULL");
+    return parts.join(" ");
+}
+/**
+ * Stream a schema dump (DDL then INSERTs) to `write`. Reads data in chunks
+ * of DUMP_CHUNK_ROWS rows ordered by primary key.
+ */
+export async function dumpRemoteSchema(conn, write) {
+    const [cols] = await conn.query(`SELECT table_name, column_name, data_type, is_nullable, column_default
+       FROM information_schema.columns
+      WHERE table_schema = $1
+      ORDER BY table_name, ordinal_position`, [conn.schema]);
+    const [pks] = await conn.query(`SELECT kcu.table_name, kcu.column_name
+       FROM information_schema.table_constraints tc
+       JOIN information_schema.key_column_usage kcu
+         ON tc.constraint_name = kcu.constraint_name AND tc.table_schema = kcu.table_schema
+      WHERE tc.table_schema = $1 AND tc.constraint_type = 'PRIMARY KEY'
+      ORDER BY kcu.table_name, kcu.ordinal_position`, [conn.schema]);
+    const [indexes] = await conn.query(`SELECT tablename, indexdef FROM pg_indexes WHERE schemaname = $1 ORDER BY tablename, indexname`, [conn.schema]);
+    const byTable = new Map();
+    for (const row of cols.rows) {
+        const list = byTable.get(row.table_name) ?? [];
+        list.push(row);
+        byTable.set(row.table_name, list);
+    }
+    const pkByTable = new Map();
+    for (const row of pks.rows) {
+        const list = pkByTable.get(row.table_name) ?? [];
+        list.push(row.column_name);
+        pkByTable.set(row.table_name, list);
+    }
+    write(`-- hq db dump for schema ${conn.schema}\n\n`);
+    let totalRows = 0;
+    for (const [table, columns] of byTable) {
+        const pk = pkByTable.get(table) ?? [];
+        const defs = columns.map(columnDdl);
+        if (pk.length > 0)
+            defs.push(`PRIMARY KEY (${pk.map(quoteIdent).join(", ")})`);
+        write(`CREATE TABLE ${quoteIdent(table)} (\n  ${defs.join(",\n  ")}\n);\n\n`);
+    }
+    for (const row of indexes.rows) {
+        if (/_pkey\b/.test(row.indexdef))
+            continue;
+        write(`${row.indexdef.replace(/^CREATE (UNIQUE )?INDEX /, "CREATE $1INDEX ASYNC ")};\n`);
+    }
+    for (const [table, columns] of byTable) {
+        const pk = pkByTable.get(table) ?? [];
+        const order = (pk.length > 0 ? pk : columns.map((c) => c.column_name))
+            .map(quoteIdent)
+            .join(", ");
+        const names = columns.map((c) => quoteIdent(c.column_name)).join(", ");
+        for (let offset = 0;; offset += DUMP_CHUNK_ROWS) {
+            const [page] = await conn.query(`SELECT * FROM ${quoteIdent(table)} ORDER BY ${order} LIMIT ${DUMP_CHUNK_ROWS} OFFSET ${offset}`);
+            for (const row of page.rows) {
+                const values = columns.map((c) => sqlLiteral(row[c.column_name])).join(", ");
+                write(`INSERT INTO ${quoteIdent(table)} (${names}) VALUES (${values});\n`);
+            }
+            totalRows += page.rows.length;
+            if (page.rows.length < DUMP_CHUNK_ROWS)
+                break;
+        }
+    }
+    return { tables: byTable.size, rows: totalRows };
+}
+//# sourceMappingURL=remote-engine.js.map

package/dist/lib/db/usage-format.d.ts

@@ -0,0 +1,4 @@
+import type { RemoteUsageResponse } from "./control-plane.js";
+export declare function formatBytes(bytes: number): string;
+export declare function formatUsage(usage: RemoteUsageResponse): string;
+//# sourceMappingURL=usage-format.d.ts.map

package/dist/lib/db/usage-format.js

@@ -0,0 +1,41 @@
+const UNITS = ["bytes", "KB", "MB", "GB", "TB"];
+export function formatBytes(bytes) {
+    if (!Number.isFinite(bytes) || bytes <= 0)
+        return "0 bytes";
+    let value = bytes;
+    let unit = 0;
+    while (value >= 1024 && unit < UNITS.length - 1) {
+        value /= 1024;
+        unit += 1;
+    }
+    const rounded = unit === 0 ? String(Math.round(value)) : value.toFixed(value >= 10 ? 0 : 1);
+    return `${rounded} ${UNITS[unit]}`;
+}
+function percent(pct) {
+    if (!Number.isFinite(pct))
+        return "0%";
+    return `${pct >= 10 ? Math.round(pct) : Math.round(pct * 10) / 10}%`;
+}
+export function formatUsage(usage) {
+    const lines = [
+        `Database usage for ${usage.period}`,
+        `Compute: ${usage.dpuUsed.toLocaleString("en-US")} of ${usage.dpuCap.toLocaleString("en-US")} units used (${percent(usage.pctDpu)})`,
+        `Storage: ${formatBytes(usage.storageBytes)} of ${formatBytes(usage.storageCap)} used (${percent(usage.pctStorage)})`,
+    ];
+    if (usage.measuredAt === null) {
+        lines.push("Not measured yet, so usage shows as 0. Check again in about 15 minutes.");
+    }
+    else {
+        lines.push(`Last measured ${usage.measuredAt}. Numbers can lag by a few minutes.`);
+    }
+    const over = [
+        usage.pctDpu >= 100 ? "compute" : null,
+        usage.pctStorage >= 100 ? "storage" : null,
+    ].filter(Boolean);
+    if (over.length > 0)
+        lines.push(`Over the cap for ${over.join(" and ")}.`);
+    else if (usage.pctDpu >= 80 || usage.pctStorage >= 80)
+        lines.push("Close to a cap (80% or more).");
+    return lines.join("\n");
+}
+//# sourceMappingURL=usage-format.js.map

package/dist/lib/index-render/shared.d.ts

@@ -28,7 +28,9 @@ export declare function titleize(slug: string): string;
 export declare function date(now?: Date): string;
 export declare function timestamp(now?: Date): string;
 /** Write via a same-directory temporary file, then atomically replace the destination. */
-export declare function atomicWrite(file: string, content: string): void;
+export declare function atomicWrite(file: string, content: string | Buffer, options?: {
+    mode?: number;
+}): void;
 export declare function write(context: RenderContext, relative: string, content: string): string;
 /** Drop keep fences, the generated stamp, and the rolling date so two generated bodies can be compared. */
 export declare function generatedFingerprint(content: string): string;

package/dist/lib/index-render/shared.js

@@ -78,11 +78,14 @@ export function titleize(slug) {
 export function date(now = new Date()) { return now.toISOString().slice(0, 10); }
 export function timestamp(now = new Date()) { return now.toISOString().replace(/\.\d{3}Z$/, "Z"); }
 /** Write via a same-directory temporary file, then atomically replace the destination. */
-export function atomicWrite(file, content) {
+export function atomicWrite(file, content, options = {}) {
     fs.mkdirSync(path.dirname(file), { recursive: true });
     const temporary = path.join(path.dirname(file), `.${path.basename(file)}.${process.pid}.${Math.random().toString(16).slice(2)}.tmp`);
     try {
-        fs.writeFileSync(temporary, content, "utf8");
+        if (typeof content === "string")
+            fs.writeFileSync(temporary, content, { encoding: "utf8", mode: options.mode });
+        else
+            fs.writeFileSync(temporary, content, { mode: options.mode });
         fs.renameSync(temporary, file);
     }
     catch (error) {

package/dist/lib/lanes/depth-cap.d.ts

@@ -0,0 +1,7 @@
+export interface LaneDepthCap {
+    max: number;
+    source: "default" | "company";
+}
+/** Read the optional maxLaneDepth from companies/<slug>/.hq/config.json. */
+export declare function laneDepthCap(hqRoot: string, companySlug?: string | null): LaneDepthCap;
+//# sourceMappingURL=depth-cap.d.ts.map

package/dist/lib/lanes/depth-cap.js

@@ -0,0 +1,41 @@
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { LanesError } from "./errors.js";
+import { MAX_LANE_DEPTH } from "./constants.js";
+/** Read the optional maxLaneDepth from companies/<slug>/.hq/config.json. */
+export function laneDepthCap(hqRoot, companySlug) {
+    if (!companySlug)
+        return { max: MAX_LANE_DEPTH, source: "default" };
+    if (!/^[a-z0-9][a-z0-9_-]*$/.test(companySlug)) {
+        throw new LanesError("lane_depth_config_invalid", `Invalid company slug for lane depth config: ${JSON.stringify(companySlug)}`, { company: companySlug });
+    }
+    const file = path.join(hqRoot, "companies", companySlug, ".hq", "config.json");
+    let raw;
+    try {
+        raw = fs.readFileSync(file, "utf8");
+    }
+    catch (err) {
+        if (err.code === "ENOENT")
+            return { max: MAX_LANE_DEPTH, source: "default" };
+        throw new LanesError("lane_depth_config_unreadable", `Failed to read company lane depth config ${file}: ${err instanceof Error ? err.message : String(err)}`, { company: companySlug, path: file });
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch (err) {
+        throw new LanesError("lane_depth_config_invalid", `Invalid JSON in company config ${file}: ${err instanceof Error ? err.message : String(err)}`, { company: companySlug, path: file });
+    }
+    if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
+        throw new LanesError("lane_depth_config_invalid", `Company config ${file} must be a JSON object`, { company: companySlug, path: file });
+    }
+    const value = parsed.maxLaneDepth;
+    if (value === undefined)
+        return { max: MAX_LANE_DEPTH, source: "default" };
+    if (typeof value !== "number" || !Number.isInteger(value) || value < 1 || value > 8) {
+        process.stderr.write(`hq lanes: lane_depth_cap_invalid company=${companySlug} maxLaneDepth=${JSON.stringify(value)}; using default ${MAX_LANE_DEPTH}\n`);
+        return { max: MAX_LANE_DEPTH, source: "default" };
+    }
+    return { max: value, source: "company" };
+}
+//# sourceMappingURL=depth-cap.js.map

package/dist/lib/lanes/keep-alive.d.ts

@@ -58,6 +58,18 @@ export declare function hasPendingKeepAliveWork(hqRoot: string, lane: Pick<LaneR
 export declare function undeliveredAnsweredQuestions(lane: Pick<LaneRecord, "lane_id" | "company">, questions: readonly QuestionRecord[]): QuestionRecord[];
 /** Missing registry means no retired lanes; every present invalid file fails closed. */
 export declare function loadRetiredLaneIds(hqRoot: string): ReadonlySet<string>;
+export interface RetiredLaneEntry {
+    lane: string;
+    index: number;
+    retired_at?: string;
+}
+/** Preserve registry metadata for diagnostics while validating the same shape as the eligibility reader. */
+export declare function loadRetiredLaneEntries(hqRoot: string): RetiredLaneEntry[];
+/** Return the matching registry row using the same bare/host-suffixed ID semantics as keepAliveExclusion. */
+export declare function findRetiredLaneEntry(hqRoot: string, laneId: string): (RetiredLaneEntry & {
+    path: string;
+}) | undefined;
+export declare function matchesRetiredLaneEntry(entry: RetiredLaneEntry, laneId: string): boolean;
 export declare function keepAliveSupersededBy<T extends KeepAliveLane>(lane: T, lanes: readonly T[], lineageAware?: boolean, companyForLane?: (lane: T) => T["company"]): T | undefined;
 export declare function keepAliveExclusion<T extends KeepAliveLane>(lane: T, lanes: readonly T[], retiredLaneIds: ReadonlySet<string>, lineageAware?: boolean, companyForLane?: (lane: T) => T["company"]): "retired" | "superseded" | undefined;
 export declare function leadLaneKeepAliveBackoffMs(attempt: number): number;