@indigoai-us/hq-cli 5.60.0 → 5.62.0

package/dist/commands/workers.js

@@ -0,0 +1,229 @@
+
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="a4a2bf8b-0a33-57ba-a565-412a14132c99")}catch(e){}}();
+import chalk from "chalk";
+import * as fs from "fs";
+import * as path from "path";
+import * as yaml from "js-yaml";
+import { ensureCognitoToken } from "../utils/cognito-session.js";
+import { vaultApiFetch, getCompanyUid } from "./secrets.js";
+import { GROUP_ID_PATTERN, EMAIL_PATTERN, normalizeFilePrefix } from "./_patterns.js";
+import { findHqRoot } from "../utils/manifest.js";
+/** Read + parse the worker registry. Empty array if it does not exist. */
+export function readWorkerRegistry(hqRoot) {
+    const p = path.join(hqRoot, "core/workers/registry.yaml");
+    if (!fs.existsSync(p))
+        return [];
+    const doc = yaml.load(fs.readFileSync(p, "utf8"));
+    return doc?.workers ?? [];
+}
+/**
+ * Best-effort active company: workspace/sessions/.current -> meta.yaml
+ * company_slug. Undefined when no session context is set. Pure/read-only.
+ */
+export function resolveActiveCompany(hqRoot) {
+    try {
+        const currentFile = path.join(hqRoot, "workspace/sessions/.current");
+        const current = fs.readFileSync(currentFile, "utf8").trim();
+        if (!current)
+            return undefined;
+        const metaPath = path.join(hqRoot, "workspace/sessions", current, "meta.yaml");
+        if (!fs.existsSync(metaPath))
+            return undefined;
+        const meta = yaml.load(fs.readFileSync(metaPath, "utf8"));
+        const co = meta?.company_slug;
+        return typeof co === "string" && co ? co : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Membership-aware access filter for worker discovery: public workers always;
+ * company workers only for the active company. Mirrors the /run skill and the
+ * inject-worker-suggestion hook so all three surfaces agree.
+ */
+export function filterAccessibleWorkers(workers, activeCompany) {
+    return workers.filter((w) => {
+        if (w.visibility === "public")
+            return true;
+        if (!w.company)
+            return false;
+        return activeCompany !== undefined && w.company === activeCompany;
+    });
+}
+/**
+ * The company-relative vault prefix for a worker, e.g.
+ * companies/indigo/workers/deal-brain/ -> workers/deal-brain/. Returns null for
+ * a worker with no company (public/shared — not shareable via ACL).
+ */
+export function workerVaultPrefix(w) {
+    if (!w.company)
+        return null;
+    const companyRoot = `companies/${w.company}/`;
+    const rel = w.path.startsWith(companyRoot)
+        ? w.path.slice(companyRoot.length)
+        : w.path;
+    return normalizeFilePrefix(rel);
+}
+/** Classify a share principal (@all | email | grp_*) — null when invalid. */
+export function classifyPrincipal(principal) {
+    if (principal === "@all") {
+        return { granteeType: "company-wide", granteeId: "", label: "everyone in the company" };
+    }
+    if (EMAIL_PATTERN.test(principal)) {
+        const id = principal.trim().toLowerCase();
+        return { granteeType: "email", granteeId: id, label: id };
+    }
+    if (GROUP_ID_PATTERN.test(principal)) {
+        return { granteeType: "group", granteeId: principal, label: principal };
+    }
+    return null;
+}
+/**
+ * Record a grant locally in the worker's tool-owned .grants.yaml sidecar. Kept
+ * out of worker.yaml so we never rewrite a hand-authored file; the registry
+ * generator unions this sidecar into the registry `grants:` field. Idempotent.
+ */
+export function writeGrantSidecar(hqRoot, workerPath, principalLabel) {
+    const dir = path.join(hqRoot, workerPath);
+    const sidecar = path.join(dir, ".grants.yaml");
+    let grants = [];
+    if (fs.existsSync(sidecar)) {
+        const doc = yaml.load(fs.readFileSync(sidecar, "utf8"));
+        if (Array.isArray(doc?.grants))
+            grants = doc.grants.filter((g) => typeof g === "string");
+    }
+    if (!grants.includes(principalLabel))
+        grants.push(principalLabel);
+    const header = "# Worker access grants — tool-owned, written by `hq workers share`.\n" +
+        "# Unioned into core/workers/registry.yaml `grants:` by the registry generator.\n";
+    fs.writeFileSync(sidecar, header + yaml.dump({ grants }), "utf8");
+}
+async function runWorkersShare(workerId, opts) {
+    const hqRoot = findHqRoot();
+    const worker = readWorkerRegistry(hqRoot).find((w) => w.id === workerId);
+    if (!worker) {
+        console.error(chalk.red(`Worker '${workerId}' not found in registry.`), "\nRun 'hq workers list' to see accessible workers.");
+        process.exit(1);
+    }
+    const prefix = workerVaultPrefix(worker);
+    if (!prefix) {
+        console.error(chalk.red(`'${workerId}' is a shared/public worker (visibility ${worker.visibility}).`), "\nPublic workers already ship to every HQ install — only company-scoped workers are shared with `hq workers share`.");
+        process.exit(1);
+    }
+    const permission = opts.permission ?? "read";
+    if (!["read", "write"].includes(permission)) {
+        console.error(chalk.red(`Invalid permission '${permission}': must be read or write`));
+        process.exit(1);
+    }
+    const classified = classifyPrincipal(opts.with);
+    if (!classified) {
+        console.error(chalk.red(`Invalid principal '${opts.with}': must be '@all', an email address, or a group id matching grp_<alphanumeric>`));
+        process.exit(1);
+    }
+    const companySlug = opts.company ?? worker.company;
+    const token = await ensureCognitoToken();
+    const companyUid = await getCompanyUid(token, companySlug);
+    const body = {
+        prefix,
+        granteeType: classified.granteeType,
+        granteeId: classified.granteeId,
+        permission,
+    };
+    let res = await vaultApiFetch({
+        token,
+        path: `/files/${encodeURIComponent(companyUid)}/acl/grant`,
+        method: "POST",
+        body,
+    });
+    // No ACL row for this prefix yet — auto-create one with this grant.
+    if (res.status === 404) {
+        res = await vaultApiFetch({
+            token,
+            path: `/files/${encodeURIComponent(companyUid)}/acl`,
+            method: "POST",
+            body: {
+                prefix,
+                entries: [
+                    {
+                        granteeType: classified.granteeType,
+                        granteeId: classified.granteeId,
+                        permission,
+                    },
+                ],
+            },
+        });
+    }
+    if (!res.ok) {
+        const text = await res.text().catch(() => "");
+        console.error(chalk.red(`Failed to share worker (HTTP ${res.status}). ${text}`));
+        process.exit(1);
+    }
+    writeGrantSidecar(hqRoot, worker.path, classified.label);
+    console.log(chalk.green("✓"), `Shared worker '${workerId}' with ${classified.label} (${permission}).`);
+    console.log(chalk.dim(`  Vault prefix ${prefix} granted in company '${companySlug}'. It will sync to granted members and appear in their /run list.`));
+}
+function runWorkersList(opts) {
+    const hqRoot = findHqRoot();
+    const activeCompany = opts.company ?? resolveActiveCompany(hqRoot);
+    let workers = filterAccessibleWorkers(readWorkerRegistry(hqRoot), activeCompany);
+    if (opts.shared)
+        workers = workers.filter((w) => Boolean(w.grants && w.grants.trim()));
+    if (opts.mine)
+        workers = workers.filter((w) => Boolean(w.company) && w.company === activeCompany);
+    if (workers.length === 0) {
+        console.log("No accessible workers.");
+        return;
+    }
+    const publicWorkers = workers.filter((w) => w.visibility === "public");
+    const companyWorkers = workers.filter((w) => w.visibility !== "public");
+    console.log(chalk.bold("Available Workers:"));
+    const printGroup = (title, list) => {
+        if (list.length === 0)
+            return;
+        console.log(`\n  ${chalk.cyan(title)}:`);
+        for (const w of list.sort((a, b) => a.id.localeCompare(b.id))) {
+            const desc = (w.description ?? "").slice(0, 72);
+            const shared = w.grants && w.grants.trim() ? chalk.dim(`  [shared: ${w.grants}]`) : "";
+            console.log(`    ${w.id.padEnd(24)} ${desc}${shared}`);
+        }
+    };
+    printGroup("Public", publicWorkers);
+    if (activeCompany)
+        printGroup(activeCompany, companyWorkers);
+    console.log(chalk.dim("\nUsage: hq run {worker-id} [skill] [args]"));
+    console.log(chalk.dim("Share a company worker: hq workers share {worker-id} --with {grp_<name>|@all} --permission read"));
+}
+export function registerWorkersCommand(program) {
+    const workers = program
+        .command("workers")
+        .description("Discover and share HQ workers")
+        .option("--company <slug>", "Company slug (resolves to companyUid)");
+    workers
+        .command("list")
+        .description("List workers you can access (public + your active company's)")
+        .option("--mine", "Only this company's workers")
+        .option("--shared", "Only workers that have been shared with someone")
+        .action((opts) => {
+        runWorkersList({ ...opts, company: workers.opts().company });
+    });
+    workers
+        .command("share <workerId>")
+        .description("Grant a teammate, group, or @all access to a company worker")
+        .requiredOption("--with <principal>", "Email address, group id (grp_<name>), or '@all' to share with every active company member")
+        .option("--permission <level>", "Permission level: read | write (default: read)")
+        .action(async (workerId, opts) => {
+        try {
+            await runWorkersShare(workerId, {
+                ...opts,
+                company: workers.opts().company,
+            });
+        }
+        catch (err) {
+            console.error(chalk.red("Error:"), err instanceof Error ? err.message : String(err));
+            process.exit(1);
+        }
+    });
+}
+//# sourceMappingURL=workers.js.map
+//# debugId=a4a2bf8b-0a33-57ba-a565-412a14132c99

package/dist/index.d.ts

@@ -1,6 +1,8 @@
 #!/usr/bin/env node
-/**
- * HQ CLI - Module management, package management, and cloud sync for HQ
- */
 import "./node-preflight.js";
+declare function isVersionRequest(argv: readonly string[]): boolean;
+export declare const __test__: {
+    isVersionRequest: typeof isVersionRequest;
+};
+export {};
 //# sourceMappingURL=index.d.ts.map

package/dist/index.js

@@ -1,247 +1,21 @@
 #!/usr/bin/env node
-/**
- * HQ CLI - Module management, package management, and cloud sync for HQ
- */
 // MUST be first: guard the Node version before any dependency that needs a
 // Node 20+ API (e.g. util.styleText) or a newer native ABI is evaluated.
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="8839ee7d-9f6d-54fe-8f90-99ad858e349e")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="8fdfd788-4c00-50bc-9ed0-579ed9d5f903")}catch(e){}}();
 import "./node-preflight.js";
-import { Command } from "commander";
-import { initSentry, Sentry } from "./sentry.js";
-import { registerAddCommand } from "./commands/add.js";
-import { registerSyncCommand } from "./commands/sync.js";
-import { registerListCommand } from "./commands/list.js";
-import { registerUpdateCommand } from "./commands/update.js";
-import { registerCloudCommands } from "./commands/cloud.js";
-import { registerSyncModeCommand } from "./commands/sync-mode.js";
-import { registerSyncNarrowCommand } from "./commands/sync-narrow.js";
-import { registerCloudProvisionCommands } from "./commands/cloud-provision.js";
-import { registerCloudDemoteCommands } from "./commands/cloud-demote.js";
-import { registerLoginCommand } from "./commands/login.js";
-import { registerLogoutCommand } from "./commands/logout.js";
-import { registerWhoamiCommand } from "./commands/whoami.js";
-import { registerOnboardCommand } from "./commands/onboard.js";
-import { registerPackageInstallCommand } from "./commands/pkg-install.js";
-import { registerPackageRemoveCommand } from "./commands/pkg-remove.js";
-import { registerPackageUpdateCommand } from "./commands/pkg-update.js";
-import { registerPackageListCommand } from "./commands/pkg-list.js";
-import { registerPacksCommand } from "./commands/packs.js";
-import { registerPublishCommand } from "./commands/publish.js";
-import { registerCreatorsCommand } from "./commands/creators.js";
-import { registerTeamSyncCommand } from "./commands/team-sync.js";
-import { registerAuthCommands } from "./commands/auth.js";
-import { registerApiKeysCommand } from "./commands/api-keys.js";
-import { registerSecretsCommand } from "./commands/secrets.js";
-import { registerRunCommand } from "./commands/run.js";
-import { registerGroupsCommand } from "./commands/groups.js";
-import { registerGroupGrantsCommand } from "./commands/group-grants.js";
-import { registerFilesCommand } from "./commands/files.js";
-import { registerFilesBrowseCommands } from "./commands/files-browse.js";
-import { registerMembersCommand } from "./commands/members.js";
-import { registerPeopleCommand } from "./commands/people.js";
-import { registerDmCommand } from "./commands/dm.js";
-import { registerChannelsCommand } from "./commands/channels.js";
-import { registerFeedbackCommand } from "./commands/feedback.js";
-import { registerMeetingsCommand } from "./commands/meetings.js";
-import { registerSourcesCommand } from "./commands/sources.js";
-import { registerSignalsCommand } from "./commands/signals.js";
-import { registerReindexCommand } from "./commands/reindex.js";
-import { registerRescueCommand } from "./commands/rescue.js";
-import { registerMcpCommand } from "./commands/mcp-status.js";
-import { registerCrmCommand } from "./commands/crm.js";
-import { registerCompanyCommand } from "./commands/company.js";
-import { sanitizeArgv } from "./utils/feedback-diagnostics.js";
-import { environmentalFsErrorMessage } from "./utils/environmental-error.js";
-import { isEpipe } from "./utils/epipe.js";
-import { isInterceptedProcessExit } from "./utils/intercepted-process-exit.js";
-import { maybeWarnNewVersion, refreshVersionCache, } from "./utils/version-check.js";
-import { enforceVersionGate, shouldSkipGate, } from "./utils/version-gate.js";
 import { CLI_VERSION } from "./cli-version.js";
-// Swallow EPIPE when a downstream reader (e.g. `source <(…)`, `| head`) closes
-// the pipe early. This covers the ASYNC path — an 'error' event emitted on the
-// stream. The SYNCHRONOUS path (a `write EPIPE` thrown straight out of
-// console.log inside a command) is handled in the top-level catch below; both
-// share `isEpipe` (HQ-6B).
-const onPipeError = (err) => {
-    if (isEpipe(err)) {
-        process.exit(0);
-    }
-    throw err;
-};
-process.stdout.on("error", onPipeError);
-process.stderr.on("error", onPipeError);
-initSentry();
-maybeWarnNewVersion();
-const program = new Command();
-program
-    .name("hq")
-    .description("HQ management CLI — modules, packages, and cloud sync")
-    .version(CLI_VERSION);
-// Module management subcommand group
-const modulesCmd = program
-    .command("modules")
-    .description("Module management commands");
-registerAddCommand(modulesCmd);
-registerSyncCommand(modulesCmd);
-registerListCommand(modulesCmd);
-registerUpdateCommand(modulesCmd);
-// Package management subcommand group
-const packagesCmd = program
-    .command("packages")
-    .description("Package management commands");
-registerPackageInstallCommand(packagesCmd);
-registerPackageRemoveCommand(packagesCmd);
-registerPackageUpdateCommand(packagesCmd);
-registerPackageListCommand(packagesCmd);
-// Content-pack lifecycle (core/packages/hq-pack-*). Distinct from the registry
-// `packages` system above. Available as both `hq packages packs …` (grouped)
-// and `hq packs …` (top-level convenience).
-registerPacksCommand(packagesCmd);
-registerPacksCommand(program);
-// Top-level shortcuts for package commands
-// "hq install <slug>" = "hq packages install <slug>"
-// "hq remove <slug>"  = "hq packages remove <slug>"
-registerPackageInstallCommand(program);
-registerPackageRemoveCommand(program);
-// Marketplace publish (top-level — packer + authenticated upload, US-004)
-// "hq publish <skill-or-worker-path>" packages and submits a pack to the
-// marketplace via POST /v1/listings.
-registerPublishCommand(program);
-// `hq creators apply` — request verified-creator access (required to publish).
-registerCreatorsCommand(program);
-// Cloud sync subcommand group
-const syncCmd = program
-    .command("sync")
-    .description("Cloud sync commands — sync HQ to S3 for mobile access");
-registerCloudCommands(syncCmd);
-registerSyncModeCommand(syncCmd);
-registerSyncNarrowCommand(syncCmd);
-// Cloud provisioning subcommand group (entity + bucket + initial sync)
-// Distinct from `hq sync` which assumes provisioning has already happened.
-const cloudCmd = program
-    .command("cloud")
-    .description("Cloud commands — provision entities and manage cloud-backed companies");
-registerCloudProvisionCommands(cloudCmd);
-registerCloudDemoteCommands(cloudCmd);
-// Team commands (top-level)
-registerTeamSyncCommand(program);
-// Auth commands (top-level — Cognito OAuth)
-registerLoginCommand(program);
-registerLogoutCommand(program);
-registerWhoamiCommand(program);
-registerAuthCommands(program);
-// Secrets management (subcommand group — hq secrets set|get|list|delete|exec|generate-link|cache)
-registerSecretsCommand(program);
-// API key management (subcommand group — hq api-keys create|list|revoke)
-registerApiKeysCommand(program);
-// Schema-driven dev runner — hq run [options] -- <cmd>
-registerRunCommand(program);
-// Groups management (subcommand group — hq groups create|delete|add|remove|list|members)
-registerGroupsCommand(program);
-// Cross-company group grants (subcommand group —
-// hq group-grants grant|revoke|outbound|inbound)
-registerGroupGrantsCommand(program);
-// Files ACL management (subcommand group — hq files share|unshare|acl)
-// `registerFilesCommand` returns the `files` group so we can attach the
-// browse-vs-sync subcommands (`hq files browse`/`cat`) onto the same group.
-const filesCmd = registerFilesCommand(program);
-registerFilesBrowseCommands(filesCmd);
-// Membership management (subcommand group — hq members invite|list|revoke)
-registerMembersCommand(program);
-// People directory (subcommand group — hq people list|search|resolve), reading
-// the local companies/<co>/people store scoped to one company.
-registerPeopleCommand(program);
-registerDmCommand(program);
-registerChannelsCommand(program);
-// Onboarding (top-level — Cognito + vault-service provisioning)
-registerOnboardCommand(program);
-// Feedback (subcommand group — hq feedback bug|feature)
-registerFeedbackCommand(program);
-// Meetings (subcommand group — hq meetings list|get|search|transcript|notes)
-registerMeetingsCommand(program);
-// Sources read surface (subcommand group — hq sources list|get|channels|entities)
-registerSourcesCommand(program);
-// Signals read surface (subcommand group — hq signals list|get|types|entities)
-registerSignalsCommand(program);
-// Skill/personal-overlay mirroring + workers-registry regen. Invoked by the
-// hq-core reindex hook shim (Stop / PostToolUse) and by sync()/rescue() after
-// they change on-disk sources. Keeps a `master-sync` alias for one release.
-// Implementation lives in @indigoai-us/hq-cloud.
-registerReindexCommand(program);
-// Drift-preserving HQ-core re-sync (top-level — `hq rescue`). CLI sibling of
-// the HQ Sync app's "Update / Restore" pill; drives the same replace-rescue.sh
-// shipped from @indigoai-us/hq-cloud.
-registerRescueCommand(program);
-// MCP pack observability (subcommand group — `hq mcp status`). Read-only
-// provenance-based status across BOTH Claude + Codex runtimes (reads `_hqPack`
-// off the configs, NOT linkStatus), with secret-redacted output + `--json`.
-registerMcpCommand(program);
-// Native CRM entity upsert (subcommand group — `hq crm entity upsert`). Wraps
-// POST /crm/entities (the ontology write gate) so an authenticated company
-// member can create/update canonical CRM entities in the company vault.
-registerCrmCommand(program);
-// Company settings (subcommand group — `hq company settings set`). Owner-only
-// toggles for crmEnabled / ontologyEnabled via PUT /company-settings.
-registerCompanyCommand(program);
-(async () => {
-    try {
-        Sentry.addBreadcrumb({
-            category: "command",
-            message: sanitizeArgv(process.argv.slice(2)).join(" "),
-            level: "info",
-        });
-        // Hard version gate: ask hq-pro whether this CLI is below the floor and
-        // auto-update if so (exits the process on update). Skipped for inspection
-        // flags (`--version`, `--help`) so users debugging a broken install can
-        // still introspect what they have. Silent on any failure — never blocks
-        // the CLI on a flaky network or hq-pro hiccup. See `utils/version-gate.ts`.
-        if (!shouldSkipGate(process.argv)) {
-            await enforceVersionGate();
-        }
-        await program.parseAsync();
-    }
-    catch (err) {
-        // A broken pipe (EPIPE) means the reader of `hq`'s output closed it early
-        // (`hq … | head`, `source <(hq …)`, a parent that exited). That is normal
-        // Unix behavior with no user-facing degradation — exit cleanly (0) and
-        // skip Sentry capture instead of shipping a fatal (HQ-6B). A synchronous
-        // `write EPIPE` thrown out of console.log lands here rather than on the
-        // stream 'error' listener above.
-        if (isEpipe(err)) {
-            process.exitCode = 0;
-        }
-        else if (isInterceptedProcessExit(err)) {
-            // A security/audit FUZZ harness replaced `process.exit` with a throw so it
-            // can keep exercising the binary. Commander calling `process.exit` for
-            // normal CLI control flow (e.g. an unknown command → exit 1) then surfaces
-            // here as that synthetic marker. It is a test-harness artifact, NOT an
-            // hq-cli defect — a real user's `process.exit` just exits, so nothing is
-            // thrown or captured. Skip Sentry capture (no signal, no user-facing
-            // degradation) and preserve the intended non-zero exit (HQ-CLI-3).
-            process.exitCode = 1;
-        }
-        else {
-            // A full disk / exhausted quota / read-only filesystem is the user's
-            // machine, not an HQ code defect. Surface a clear, actionable message and
-            // skip Sentry capture so one full disk doesn't flood the tracker with
-            // identical, unfixable crash reports (HQ-CLI-2). Genuine errors still go
-            // to Sentry and still exit 1.
-            const envMsg = environmentalFsErrorMessage(err);
-            if (envMsg) {
-                process.stderr.write(`hq: ${envMsg}\n`);
-            }
-            else {
-                Sentry.captureException(err);
-            }
-            process.exitCode = 1;
-        }
-    }
-    finally {
-        // Release health: finalize the per-run session before the flush.
-        Sentry.endSession();
-        await Promise.allSettled([refreshVersionCache(), Sentry.flush(2000)]);
-    }
-})();
+function isVersionRequest(argv) {
+    const args = argv.slice(2);
+    return args.length === 1 && (args[0] === "--version" || args[0] === "-V" || args[0] === "-v");
+}
+if (isVersionRequest(process.argv)) {
+    process.stdout.write(`${CLI_VERSION}\n`);
+}
+else {
+    const { runCli } = await import("./main.js");
+    await runCli();
+}
+export const __test__ = { isVersionRequest };
 //# sourceMappingURL=index.js.map
-//# debugId=8839ee7d-9f6d-54fe-8f90-99ad858e349e
+//# debugId=8fdfd788-4c00-50bc-9ed0-579ed9d5f903

package/dist/lib/db/control-plane.d.ts

@@ -0,0 +1,45 @@
+/**
+ * Control-plane client for remote vault DB (US-009).
+ * Injectable fetch for tests — never logs response bodies that might hold secrets.
+ */
+export interface RemoteProvisionResponse {
+    ok: boolean;
+    companyUid: string;
+    companySlug: string;
+    engineId: string;
+    resourceArn: string;
+    region: string;
+    status: string;
+    secretRef: string;
+    idempotent: boolean;
+}
+export interface RemoteStatusResponse {
+    companyUid: string;
+    companySlug?: string;
+    remote: {
+        engineId: string;
+        resourceArn: string;
+        region: string;
+        status: string;
+        secretRef: string;
+    } | null;
+}
+export interface ControlPlaneClientOptions {
+    baseUrl: string;
+    /** Bearer access token */
+    getAccessToken: () => Promise<string>;
+    fetchImpl?: typeof fetch;
+}
+export declare class ControlPlaneDbClient {
+    private readonly baseUrl;
+    private readonly getAccessToken;
+    private readonly fetchImpl;
+    constructor(opts: ControlPlaneClientOptions);
+    provision(input: {
+        companyUid: string;
+        companySlug: string;
+        region?: string;
+    }): Promise<RemoteProvisionResponse>;
+    status(companyUid: string): Promise<RemoteStatusResponse>;
+}
+//# sourceMappingURL=control-plane.d.ts.map

package/dist/lib/db/control-plane.js

@@ -0,0 +1,81 @@
+/**
+ * Control-plane client for remote vault DB (US-009).
+ * Injectable fetch for tests — never logs response bodies that might hold secrets.
+ */
+
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="b2bf60fc-6b3a-5534-af8e-3b92b9518e29")}catch(e){}}();
+function assertNoPostgresUrl(label, text) {
+    if (/postgres:\/\//i.test(text) || /postgresql:\/\//i.test(text)) {
+        throw new Error(`${label}: control plane returned a connection string (refusing to surface)`);
+    }
+}
+export class ControlPlaneDbClient {
+    baseUrl;
+    getAccessToken;
+    fetchImpl;
+    constructor(opts) {
+        this.baseUrl = opts.baseUrl.replace(/\/$/, "");
+        this.getAccessToken = opts.getAccessToken;
+        this.fetchImpl = opts.fetchImpl ?? fetch;
+    }
+    async provision(input) {
+        const token = await this.getAccessToken();
+        const res = await this.fetchImpl(`${this.baseUrl}/v1/db/provision`, {
+            method: "POST",
+            headers: {
+                Authorization: `Bearer ${token}`,
+                "Content-Type": "application/json",
+            },
+            body: JSON.stringify(input),
+        });
+        const text = await res.text();
+        assertNoPostgresUrl("provision", text);
+        if (!res.ok) {
+            let msg = `provision failed (${res.status})`;
+            let code;
+            try {
+                const j = JSON.parse(text);
+                if (j.error)
+                    msg = j.error;
+                if (j.code)
+                    code = j.code;
+            }
+            catch {
+                /* keep */
+            }
+            const err = new Error(msg);
+            err.status = res.status;
+            if (code)
+                err.code = code;
+            throw err;
+        }
+        return JSON.parse(text);
+    }
+    async status(companyUid) {
+        const token = await this.getAccessToken();
+        const url = `${this.baseUrl}/v1/db/status?companyUid=${encodeURIComponent(companyUid)}`;
+        const res = await this.fetchImpl(url, {
+            method: "GET",
+            headers: { Authorization: `Bearer ${token}` },
+        });
+        const text = await res.text();
+        assertNoPostgresUrl("status", text);
+        if (!res.ok) {
+            let msg = `status failed (${res.status})`;
+            try {
+                const j = JSON.parse(text);
+                if (j.error)
+                    msg = j.error;
+            }
+            catch {
+                /* keep */
+            }
+            const err = new Error(msg);
+            err.status = res.status;
+            throw err;
+        }
+        return JSON.parse(text);
+    }
+}
+//# sourceMappingURL=control-plane.js.map
+//# debugId=b2bf60fc-6b3a-5534-af8e-3b92b9518e29