@indigoai-us/hq-cli 5.60.0 → 5.62.0

package/dist/lib/db/local.d.ts

@@ -0,0 +1,49 @@
+/**
+ * Local vault SQLite open/create (C1).
+ *
+ * File lives at ~/.hq/db/{company}/vault.db with WAL journal mode.
+ * Never returns or logs remote connection strings.
+ */
+import Database from "better-sqlite3";
+import { type LocalDbPathEnv } from "./paths.js";
+export type LocalDb = Database.Database;
+export interface OpenLocalDbOptions extends LocalDbPathEnv {
+    /** When true, do not create the file if missing (throws). Default false. */
+    readonly?: boolean;
+}
+export interface LocalDbStatus {
+    company: string;
+    tier: "local";
+    path: string;
+    exists: boolean;
+    healthy: boolean;
+    journalMode: string | null;
+    /** Migration ledger head when present; null if ledger not initialized. */
+    schemaVersion: string | null;
+    /** Fingerprint of path for logs that prefer not to echo full home paths. */
+    pathFingerprint: string;
+}
+/**
+ * Short non-reversible fingerprint of a path (for status display).
+ * Not a secret — just avoids dumping full home paths when preferred.
+ */
+export declare function fingerprintPath(filePath: string): string;
+/**
+ * Open (and create if missing) the company local vault DB with WAL mode.
+ * Idempotent: reopening an existing file does not recreate or wipe it.
+ */
+export declare function openLocalDb(companySlug: string, opts?: OpenLocalDbOptions): LocalDb;
+/**
+ * Read migration head from platform ledger if the table exists.
+ */
+export declare function readMigrationHead(db: LocalDb): string | null;
+/**
+ * Ensure local DB exists (create if needed), report status, close handle.
+ * Safe for CLI status: never includes connection strings.
+ */
+export declare function ensureAndStatusLocalDb(companySlug: string, opts?: LocalDbPathEnv): LocalDbStatus;
+/**
+ * Format status for CLI stdout (no secrets).
+ */
+export declare function formatLocalDbStatus(status: LocalDbStatus): string;
+//# sourceMappingURL=local.d.ts.map

package/dist/lib/db/local.js

@@ -0,0 +1,106 @@
+/**
+ * Local vault SQLite open/create (C1).
+ *
+ * File lives at ~/.hq/db/{company}/vault.db with WAL journal mode.
+ * Never returns or logs remote connection strings.
+ */
+
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="3cf7d852-6ced-5521-a8de-8da889a5b97c")}catch(e){}}();
+import fs from "node:fs";
+import Database from "better-sqlite3";
+import { ensureLocalDbDir, resolveLocalDbPath, } from "./paths.js";
+const MIGRATIONS_TABLE = "hq_schema_migrations";
+/**
+ * Short non-reversible fingerprint of a path (for status display).
+ * Not a secret — just avoids dumping full home paths when preferred.
+ */
+export function fingerprintPath(filePath) {
+    let h = 2166136261;
+    for (let i = 0; i < filePath.length; i++) {
+        h ^= filePath.charCodeAt(i);
+        h = Math.imul(h, 16777619);
+    }
+    return `fp_${(h >>> 0).toString(16).padStart(8, "0")}`;
+}
+/**
+ * Open (and create if missing) the company local vault DB with WAL mode.
+ * Idempotent: reopening an existing file does not recreate or wipe it.
+ */
+export function openLocalDb(companySlug, opts) {
+    const dbPath = resolveLocalDbPath(companySlug, opts);
+    const exists = fs.existsSync(dbPath);
+    if (!exists) {
+        if (opts?.readonly) {
+            throw new Error(`local vault DB not found for company ${JSON.stringify(companySlug)} at ${dbPath}`);
+        }
+        ensureLocalDbDir(companySlug, opts);
+    }
+    const db = new Database(dbPath);
+    // WAL for concurrent readers; safe for agent/CLI workloads.
+    db.pragma("journal_mode = WAL");
+    db.pragma("foreign_keys = ON");
+    return db;
+}
+/**
+ * Read migration head from platform ledger if the table exists.
+ */
+export function readMigrationHead(db) {
+    try {
+        const row = db
+            .prepare(`SELECT name FROM sqlite_master WHERE type='table' AND name=?`)
+            .get(MIGRATIONS_TABLE);
+        if (!row?.name)
+            return null;
+        const head = db
+            .prepare(`SELECT version FROM ${MIGRATIONS_TABLE} ORDER BY version DESC LIMIT 1`)
+            .get();
+        return head?.version ?? null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Ensure local DB exists (create if needed), report status, close handle.
+ * Safe for CLI status: never includes connection strings.
+ */
+export function ensureAndStatusLocalDb(companySlug, opts) {
+    const dbPath = resolveLocalDbPath(companySlug, opts);
+    const db = openLocalDb(companySlug, opts);
+    try {
+        const journalMode = String(db.pragma("journal_mode", { simple: true }));
+        const schemaVersion = readMigrationHead(db);
+        // Touch a trivial query to prove the handle is healthy.
+        db.prepare("SELECT 1 AS ok").get();
+        return {
+            company: companySlug.trim().toLowerCase(),
+            tier: "local",
+            path: dbPath,
+            exists: true,
+            healthy: true,
+            journalMode,
+            schemaVersion,
+            pathFingerprint: fingerprintPath(dbPath),
+        };
+    }
+    finally {
+        db.close();
+    }
+}
+/**
+ * Format status for CLI stdout (no secrets).
+ */
+export function formatLocalDbStatus(status) {
+    const lines = [
+        `company: ${status.company}`,
+        `tier: ${status.tier}`,
+        `healthy: ${status.healthy ? "yes" : "no"}`,
+        `path: ${status.path}`,
+        `pathFingerprint: ${status.pathFingerprint}`,
+        `journalMode: ${status.journalMode ?? "unknown"}`,
+        `schemaVersion: ${status.schemaVersion ?? "(none)"}`,
+    ];
+    return lines.join("\n");
+}
+//# sourceMappingURL=local.js.map
+//# debugId=3cf7d852-6ced-5521-a8de-8da889a5b97c

package/dist/lib/db/migrate.d.ts

@@ -0,0 +1,41 @@
+/**
+ * Vault text migrations for local SQLite (vault-databases US-005).
+ *
+ * Migrations live as reviewable text under:
+ *   companies/{company}/db/migrations/*.sql
+ * Applied versions are recorded in hq_schema_migrations inside the local DB.
+ */
+import type { LocalDb } from "./local.js";
+import type { LocalDbPathEnv } from "./paths.js";
+export declare const MIGRATIONS_TABLE = "hq_schema_migrations";
+export interface MigrateOptions extends LocalDbPathEnv {
+    company: string;
+    /**
+     * Absolute path to HQ root containing companies/{co}/db/migrations.
+     * Required for vault-relative migrations.
+     */
+    hqRoot: string;
+}
+export interface MigrateResult {
+    company: string;
+    migrationsDir: string;
+    applied: string[];
+    skipped: string[];
+    head: string | null;
+}
+export declare function resolveMigrationsDir(hqRoot: string, companySlug: string): string;
+/**
+ * Ensure migrations directory exists (creates empty dir on first migrate).
+ */
+export declare function ensureMigrationsDir(hqRoot: string, companySlug: string): string;
+/**
+ * List pending migration files in lexical/version order (filename sort).
+ */
+export declare function listMigrationFiles(migrationsDir: string): string[];
+export declare function ensureMigrationsLedger(db: LocalDb): void;
+export declare function listAppliedVersions(db: LocalDb): Set<string>;
+/**
+ * Apply pending migrations. On failure, does not mark the failed file applied.
+ */
+export declare function migrateLocalDb(opts: MigrateOptions): MigrateResult;
+//# sourceMappingURL=migrate.d.ts.map

package/dist/lib/db/migrate.js

@@ -0,0 +1,104 @@
+/**
+ * Vault text migrations for local SQLite (vault-databases US-005).
+ *
+ * Migrations live as reviewable text under:
+ *   companies/{company}/db/migrations/*.sql
+ * Applied versions are recorded in hq_schema_migrations inside the local DB.
+ */
+
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="d8abc231-bc36-5aad-a942-acbb0b86ea96")}catch(e){}}();
+import fs from "node:fs";
+import path from "node:path";
+import { openLocalDb, readMigrationHead } from "./local.js";
+import { normalizeCompanySlugForLocalDb } from "./paths.js";
+export const MIGRATIONS_TABLE = "hq_schema_migrations";
+export function resolveMigrationsDir(hqRoot, companySlug) {
+    const slug = normalizeCompanySlugForLocalDb(companySlug);
+    return path.join(hqRoot, "companies", slug, "db", "migrations");
+}
+/**
+ * Ensure migrations directory exists (creates empty dir on first migrate).
+ */
+export function ensureMigrationsDir(hqRoot, companySlug) {
+    const dir = resolveMigrationsDir(hqRoot, companySlug);
+    fs.mkdirSync(dir, { recursive: true });
+    return dir;
+}
+/**
+ * List pending migration files in lexical/version order (filename sort).
+ */
+export function listMigrationFiles(migrationsDir) {
+    if (!fs.existsSync(migrationsDir))
+        return [];
+    return fs
+        .readdirSync(migrationsDir)
+        .filter((f) => f.endsWith(".sql"))
+        .sort((a, b) => a.localeCompare(b, "en"));
+}
+export function ensureMigrationsLedger(db) {
+    db.exec(`
+    CREATE TABLE IF NOT EXISTS ${MIGRATIONS_TABLE} (
+      version TEXT PRIMARY KEY NOT NULL,
+      applied_at TEXT NOT NULL DEFAULT (datetime('now'))
+    );
+  `);
+}
+export function listAppliedVersions(db) {
+    ensureMigrationsLedger(db);
+    const rows = db
+        .prepare(`SELECT version FROM ${MIGRATIONS_TABLE} ORDER BY version`)
+        .all();
+    return new Set(rows.map((r) => r.version));
+}
+/**
+ * Apply pending migrations. On failure, does not mark the failed file applied.
+ */
+export function migrateLocalDb(opts) {
+    const company = normalizeCompanySlugForLocalDb(opts.company);
+    if (!opts.hqRoot?.trim()) {
+        throw new Error("hqRoot is required for vault migrations");
+    }
+    const migrationsDir = ensureMigrationsDir(opts.hqRoot, company);
+    const files = listMigrationFiles(migrationsDir);
+    const db = openLocalDb(company, opts);
+    const applied = [];
+    const skipped = [];
+    try {
+        ensureMigrationsLedger(db);
+        const already = listAppliedVersions(db);
+        for (const file of files) {
+            const version = file.replace(/\.sql$/i, "");
+            if (already.has(version) || already.has(file)) {
+                skipped.push(file);
+                continue;
+            }
+            const fullPath = path.join(migrationsDir, file);
+            const sql = fs.readFileSync(fullPath, "utf8");
+            const run = db.transaction(() => {
+                db.exec(sql);
+                db.prepare(`INSERT INTO ${MIGRATIONS_TABLE} (version) VALUES (?)`).run(version);
+            });
+            try {
+                run();
+                applied.push(file);
+                already.add(version);
+            }
+            catch (err) {
+                const msg = err instanceof Error ? err.message : String(err);
+                throw new Error(`migration failed: ${file} — ${msg} (not marked applied)`);
+            }
+        }
+        return {
+            company,
+            migrationsDir,
+            applied,
+            skipped,
+            head: readMigrationHead(db),
+        };
+    }
+    finally {
+        db.close();
+    }
+}
+//# sourceMappingURL=migrate.js.map
+//# debugId=d8abc231-bc36-5aad-a942-acbb0b86ea96

package/dist/lib/db/paths.d.ts

@@ -0,0 +1,56 @@
+/**
+ * Vault database path conventions (C1 local tier).
+ *
+ * Canonical layout (locked by vault-databases PRD):
+ *   ~/.hq/db/{companySlug}/vault.db
+ *
+ * Binary DB files are machine-local. They must never live under companies/
+ * so hq-sync / git cannot treat them as vault text. Migrations remain vault
+ * text at companies/{co}/db/migrations/*.sql (handled by migrate stories).
+ */
+/** Default filename for the per-company local vault SQLite file. */
+export declare const LOCAL_VAULT_DB_FILENAME = "vault.db";
+/**
+ * Glob-style ignore patterns for binary / local DB artifacts.
+ * Apply in gitignore and hq-sync ignore configuration for any tree that
+ * might accidentally host these files. Primary storage is under ~/.hq/db/
+ * (outside the vault), but skills must still ignore stray `*.db` / `.data/`.
+ */
+export declare const LOCAL_DB_IGNORE_PATTERNS: readonly string[];
+export interface LocalDbPathEnv {
+    /** Override home directory (tests inject temp dirs). Defaults to os.homedir(). */
+    home?: string;
+}
+/**
+ * Resolve the machine-local root that holds all company vault DBs:
+ * `{home}/.hq/db`.
+ */
+export declare function resolveLocalDbRoot(env?: LocalDbPathEnv): string;
+/**
+ * Normalize and validate a company slug used in the local path.
+ * Tenant isolation still requires HQ identity/membership at the command layer;
+ * this only rejects empty / path-traversal slugs so we never open arbitrary paths.
+ */
+export declare function normalizeCompanySlugForLocalDb(companySlug: string): string;
+/**
+ * Canonical path for a company's local vault SQLite file:
+ * `~/.hq/db/{companySlug}/vault.db`.
+ */
+export declare function resolveLocalDbPath(companySlug: string, env?: LocalDbPathEnv): string;
+/**
+ * Directory that contains the company's vault.db (and WAL side files).
+ */
+export declare function resolveLocalDbDir(companySlug: string, env?: LocalDbPathEnv): string;
+/**
+ * Ensure the company local DB directory exists and is writable.
+ * Creates parent directories recursively. Does not create the .db file
+ * and does not write secrets into the tree.
+ *
+ * @returns absolute path of the directory
+ */
+export declare function ensureLocalDbDir(companySlug: string, env?: LocalDbPathEnv): string;
+/**
+ * Human-readable documentation of ignore rules for operators and agents.
+ */
+export declare function describeLocalDbIgnoreRules(): string;
+//# sourceMappingURL=paths.d.ts.map

package/dist/lib/db/paths.js

@@ -0,0 +1,103 @@
+/**
+ * Vault database path conventions (C1 local tier).
+ *
+ * Canonical layout (locked by vault-databases PRD):
+ *   ~/.hq/db/{companySlug}/vault.db
+ *
+ * Binary DB files are machine-local. They must never live under companies/
+ * so hq-sync / git cannot treat them as vault text. Migrations remain vault
+ * text at companies/{co}/db/migrations/*.sql (handled by migrate stories).
+ */
+
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="92e78769-940e-5fc9-a47e-7fbcc4415a3b")}catch(e){}}();
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+/** Default filename for the per-company local vault SQLite file. */
+export const LOCAL_VAULT_DB_FILENAME = "vault.db";
+/**
+ * Glob-style ignore patterns for binary / local DB artifacts.
+ * Apply in gitignore and hq-sync ignore configuration for any tree that
+ * might accidentally host these files. Primary storage is under ~/.hq/db/
+ * (outside the vault), but skills must still ignore stray `*.db` / `.data/`.
+ */
+export const LOCAL_DB_IGNORE_PATTERNS = [
+    "**/*.db",
+    "**/*.db-wal",
+    "**/*.db-shm",
+    "**/*.db-journal",
+    "**/.data/**",
+    // Explicit machine-local root (if a tool ever materializes a relative copy)
+    "**/.hq/db/**",
+];
+/**
+ * Resolve the machine-local root that holds all company vault DBs:
+ * `{home}/.hq/db`.
+ */
+export function resolveLocalDbRoot(env) {
+    const home = (env?.home ?? os.homedir()).trim();
+    if (!home) {
+        throw new Error("cannot resolve local DB root: home directory is empty (set home or os.homedir())");
+    }
+    return path.join(home, ".hq", "db");
+}
+/**
+ * Normalize and validate a company slug used in the local path.
+ * Tenant isolation still requires HQ identity/membership at the command layer;
+ * this only rejects empty / path-traversal slugs so we never open arbitrary paths.
+ */
+export function normalizeCompanySlugForLocalDb(companySlug) {
+    const slug = companySlug.trim().toLowerCase();
+    if (!slug) {
+        throw new Error("company slug is required for local DB path resolution");
+    }
+    if (slug.includes("/") ||
+        slug.includes("\\") ||
+        slug.includes("..") ||
+        slug === "." ||
+        slug.includes("\0")) {
+        throw new Error(`invalid company slug for local DB path: ${JSON.stringify(companySlug)}`);
+    }
+    return slug;
+}
+/**
+ * Canonical path for a company's local vault SQLite file:
+ * `~/.hq/db/{companySlug}/vault.db`.
+ */
+export function resolveLocalDbPath(companySlug, env) {
+    const slug = normalizeCompanySlugForLocalDb(companySlug);
+    return path.join(resolveLocalDbRoot(env), slug, LOCAL_VAULT_DB_FILENAME);
+}
+/**
+ * Directory that contains the company's vault.db (and WAL side files).
+ */
+export function resolveLocalDbDir(companySlug, env) {
+    return path.dirname(resolveLocalDbPath(companySlug, env));
+}
+/**
+ * Ensure the company local DB directory exists and is writable.
+ * Creates parent directories recursively. Does not create the .db file
+ * and does not write secrets into the tree.
+ *
+ * @returns absolute path of the directory
+ */
+export function ensureLocalDbDir(companySlug, env) {
+    const dir = resolveLocalDbDir(companySlug, env);
+    fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+    // Verify writable without leaving secrets or DB content behind.
+    fs.accessSync(dir, fs.constants.W_OK);
+    return dir;
+}
+/**
+ * Human-readable documentation of ignore rules for operators and agents.
+ */
+export function describeLocalDbIgnoreRules() {
+    return [
+        "Local vault databases live at ~/.hq/db/{company}/vault.db (outside the vault tree).",
+        "Never place *.db under companies/ — binary DB state is not vault-synced.",
+        "Ignore patterns:",
+        ...LOCAL_DB_IGNORE_PATTERNS.map((p) => `  - ${p}`),
+    ].join("\n");
+}
+//# sourceMappingURL=paths.js.map
+//# debugId=92e78769-940e-5fc9-a47e-7fbcc4415a3b

package/dist/lib/db/remote-engine.d.ts

@@ -0,0 +1,58 @@
+/**
+ * Pluggable remote vault DB engine interface (vault-databases US-007).
+ *
+ * Default shipped adapter id: aurora-dsql.
+ * This module is interface + registry only — no production AWS provision here.
+ */
+/** Connection material written only to secrets stores — never CLI stdout. */
+export interface RemoteConnectionSecretPayload {
+    /** Opaque secret body (e.g. JSON with host/user/password or IAM token recipe). */
+    payload: Record<string, unknown>;
+    /** Suggested vault/Secrets Manager key suffix (namespaced by company elsewhere). */
+    secretNameHint: string;
+}
+export interface RemoteProvisionRequest {
+    companyUid: string;
+    companySlug: string;
+    region?: string;
+    /** Engine-specific options (cluster params, etc.). */
+    options?: Record<string, unknown>;
+}
+export interface RemoteProvisionResult {
+    engineId: string;
+    resourceArn: string;
+    region: string;
+    status: "ready" | "provisioning" | "failed" | "existing";
+    /** Secret payload to store — callers must not print. */
+    connectionSecret: RemoteConnectionSecretPayload;
+}
+export interface RemoteHealth {
+    engineId: string;
+    resourceArn: string;
+    healthy: boolean;
+    status: string;
+    checkedAt: string;
+}
+/**
+ * Remote Postgres-class engine adapter.
+ * Implementations live in control plane (hq-pro) for real AWS; CLI may mock.
+ */
+export interface RemoteDbEngine {
+    readonly id: string;
+    provision(req: RemoteProvisionRequest): Promise<RemoteProvisionResult>;
+    deprovision(companyUid: string, resourceArn: string): Promise<void>;
+    connectionSecretPayload(companyUid: string, resourceArn: string): Promise<RemoteConnectionSecretPayload>;
+    healthCheck(resourceArn: string): Promise<RemoteHealth>;
+}
+/** Default engine selection (PRD decision). */
+export declare const DEFAULT_REMOTE_ENGINE_ID = "aurora-dsql";
+export declare function registerRemoteEngine(engine: RemoteDbEngine): void;
+export declare function getRemoteEngine(id?: string): RemoteDbEngine;
+export declare function listRemoteEngineIds(): string[];
+/** Clear registry (tests only). */
+export declare function _resetRemoteEngineRegistryForTests(): void;
+/**
+ * In-memory mock engine for unit tests — no AWS.
+ */
+export declare function createMockRemoteEngine(id?: string): RemoteDbEngine;
+//# sourceMappingURL=remote-engine.d.ts.map

package/dist/lib/db/remote-engine.js

@@ -0,0 +1,90 @@
+/**
+ * Pluggable remote vault DB engine interface (vault-databases US-007).
+ *
+ * Default shipped adapter id: aurora-dsql.
+ * This module is interface + registry only — no production AWS provision here.
+ */
+/** Default engine selection (PRD decision). */
+
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="738ccb65-e1d0-5466-b98e-a96058bda113")}catch(e){}}();
+export const DEFAULT_REMOTE_ENGINE_ID = "aurora-dsql";
+const registry = new Map();
+export function registerRemoteEngine(engine) {
+    registry.set(engine.id, engine);
+}
+export function getRemoteEngine(id = DEFAULT_REMOTE_ENGINE_ID) {
+    const engine = registry.get(id);
+    if (!engine) {
+        throw new Error(`remote DB engine not registered: ${id} (available: ${[...registry.keys()].join(", ") || "none"})`);
+    }
+    return engine;
+}
+export function listRemoteEngineIds() {
+    return [...registry.keys()];
+}
+/** Clear registry (tests only). */
+export function _resetRemoteEngineRegistryForTests() {
+    registry.clear();
+}
+/**
+ * In-memory mock engine for unit tests — no AWS.
+ */
+export function createMockRemoteEngine(id = "mock") {
+    const resources = new Map();
+    return {
+        id,
+        async provision(req) {
+            const existing = [...resources.entries()].find(([, v]) => v.companyUid === req.companyUid);
+            if (existing) {
+                const [arn, meta] = existing;
+                return {
+                    engineId: id,
+                    resourceArn: arn,
+                    region: meta.region,
+                    status: "existing",
+                    connectionSecret: {
+                        payload: { mock: true, companyUid: req.companyUid },
+                        secretNameHint: `db/remote/${req.companySlug}`,
+                    },
+                };
+            }
+            const arn = `arn:mock:db:${req.companyUid}`;
+            const region = req.region ?? "us-east-1";
+            resources.set(arn, { companyUid: req.companyUid, region });
+            return {
+                engineId: id,
+                resourceArn: arn,
+                region,
+                status: "ready",
+                connectionSecret: {
+                    payload: { mock: true, companyUid: req.companyUid },
+                    secretNameHint: `db/remote/${req.companySlug}`,
+                },
+            };
+        },
+        async deprovision(companyUid, resourceArn) {
+            const meta = resources.get(resourceArn);
+            if (meta && meta.companyUid === companyUid) {
+                resources.delete(resourceArn);
+            }
+        },
+        async connectionSecretPayload(companyUid, resourceArn) {
+            return {
+                payload: { mock: true, companyUid, resourceArn },
+                secretNameHint: `db/remote/${companyUid}`,
+            };
+        },
+        async healthCheck(resourceArn) {
+            const ok = resources.has(resourceArn);
+            return {
+                engineId: id,
+                resourceArn,
+                healthy: ok,
+                status: ok ? "ready" : "missing",
+                checkedAt: new Date().toISOString(),
+            };
+        },
+    };
+}
+//# sourceMappingURL=remote-engine.js.map
+//# debugId=738ccb65-e1d0-5466-b98e-a96058bda113

package/dist/lib/db/remote-sql.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Remote SQL via secrets-exec style injection (US-010).
+ *
+ * Connection string never appears in argv, logs, or stdout.
+ * Local remains default when --remote is absent (handled by command layer).
+ */
+export interface RemoteSqlOptions {
+    company: string;
+    sql: string;
+    /** Injected secret material — never log. */
+    getConnectionConfig: () => Promise<Record<string, unknown>>;
+    /** Execute against remote; tests inject mock. */
+    execute?: (config: Record<string, unknown>, sql: string) => Promise<Record<string, unknown>[]>;
+}
+export interface RemoteSqlResult {
+    rows: Record<string, unknown>[];
+}
+/**
+ * Run SQL on remote tier using vault-bound credentials.
+ */
+export declare function runRemoteSql(opts: RemoteSqlOptions): Promise<RemoteSqlResult>;
+//# sourceMappingURL=remote-sql.d.ts.map

package/dist/lib/db/remote-sql.js

@@ -0,0 +1,39 @@
+/**
+ * Remote SQL via secrets-exec style injection (US-010).
+ *
+ * Connection string never appears in argv, logs, or stdout.
+ * Local remains default when --remote is absent (handled by command layer).
+ */
+
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="07948af3-ec73-5a1a-bf8a-d0197090af40")}catch(e){}}();
+function assertNoLeak(label, value) {
+    const s = typeof value === "string" ? value : JSON.stringify(value);
+    if (/postgres:\/\//i.test(s) || /postgresql:\/\//i.test(s)) {
+        throw new Error(`${label}: connection string leak blocked`);
+    }
+}
+/**
+ * Run SQL on remote tier using vault-bound credentials.
+ */
+export async function runRemoteSql(opts) {
+    if (!opts.sql?.trim()) {
+        throw new Error("SQL statement is required");
+    }
+    let config;
+    try {
+        config = await opts.getConnectionConfig();
+    }
+    catch (e) {
+        const msg = e instanceof Error ? e.message : "no remote binding";
+        throw new Error(`remote SQL unavailable: ${msg}. Run \`hq db provision --company ${opts.company}\` first.`);
+    }
+    assertNoLeak("connection config", config);
+    if (!opts.execute) {
+        throw new Error("remote SQL executor not configured in this build (adapter pending live DSQL wire-up)");
+    }
+    const rows = await opts.execute(config, opts.sql);
+    assertNoLeak("remote sql rows", rows);
+    return { rows };
+}
+//# sourceMappingURL=remote-sql.js.map
+//# debugId=07948af3-ec73-5a1a-bf8a-d0197090af40