@indigoai-us/hq-cli 5.61.0 → 5.62.0

package/dist/commands/agents.d.ts

@@ -0,0 +1,109 @@
+/**
+ * `hq agents` — manage a company's cloud (fleet) agents from the terminal
+ * instead of the web console. Mirrors the console's `AgentsClient`
+ * (hq-console `src/lib/agents-client.ts`), targeting the hq-pro `/v1/agents`
+ * control plane on `DEFAULT_VAULT_API_URL` via the shared `vaultApiFetch`
+ * helper. No new HTTP client, no console-SDK import — same auth + company
+ * resolution stack as `members.ts`.
+ *
+ * Subcommands:
+ *   hq agents list                 — roster for the company
+ *   hq agents status <uid>         — setup state + runtime detail
+ *   hq agents rename <uid> <name>  — set the agent's display name
+ *   hq agents set <uid> [...]      — patch profile (name/title/description)
+ *   hq agents config <uid> [...]   — patch runtime config (model/effort/tier)
+ *   hq agents start|stop <uid>     — EC2 start/stop
+ *   hq agents retry <uid>          — resume setup from first non-done step
+ *   hq agents rm <uid> --yes       — deprovision (destructive; flag-guarded)
+ *
+ * Agents are company-scoped. `--company <slug>` may sit on the group
+ * (`hq agents --company acme list`) or on a subcommand
+ * (`hq agents list --company acme`); when omitted, resolution falls back to
+ * the caller's single active membership (same as `members.ts`).
+ */
+import { Command } from "commander";
+/** Reasoning-effort values hq-pro accepts on `runtime-config`. */
+export declare const VALID_EFFORTS: Set<string>;
+/** Service-tier (speed) values hq-pro accepts on `runtime-config`. */
+export declare const VALID_TIERS: Set<string>;
+/**
+ * A non-2xx from the `/v1/agents` control plane. Carries the HTTP status and
+ * the registry error `code` (when present) so callers can branch — notably a
+ * 404 on `list`, which hq-pro returns for a company that has the agents
+ * feature flag OFF (`src/agents/feature-flag.ts`).
+ */
+export declare class AgentsHttpError extends Error {
+    status: number;
+    code?: string;
+    constructor(status: number, message: string, code?: string);
+}
+/** Roster row from `GET /v1/agents` — a superset is returned; we keep what we render. */
+export interface CompanyAgentView {
+    uid: string;
+    name: string;
+    slug: string;
+    companyUid: string;
+    entityStatus?: string;
+    agentStatus?: string;
+    setupPhase?: string;
+    provider?: string;
+    codexModel?: string;
+    codexReasoningEffort?: string;
+    codexServiceTier?: string;
+    profile?: {
+        displayName?: string;
+        title?: string;
+        description?: string;
+    };
+    [key: string]: unknown;
+}
+export interface ProfilePatch {
+    displayName?: string;
+    title?: string;
+    description?: string;
+}
+export interface RuntimeConfigPatch {
+    codexModel?: string;
+    codexReasoningEffort?: string;
+    codexServiceTier?: string;
+}
+/**
+ * Authenticated JSON round-trip against the agents control plane. Throws
+ * `AgentsHttpError` on any non-2xx (never swallows — hq-never-swallow-errors),
+ * decoding hq-pro's `{ error | message, code }` envelope for the reason.
+ */
+export declare function agentsRequest<T>(opts: {
+    token: string;
+    path: string;
+    method?: string;
+    body?: Record<string, unknown>;
+    query?: Record<string, string>;
+}): Promise<T>;
+export declare function listAgents(token: string, companyUid: string): Promise<CompanyAgentView[]>;
+export declare function getAgentStatus(token: string, agentUid: string): Promise<Record<string, unknown>>;
+export declare function patchAgentProfile(token: string, agentUid: string, patch: ProfilePatch): Promise<{
+    uid: string;
+    profile: ProfilePatch;
+    slackUpdated: boolean;
+}>;
+export declare function patchAgentRuntimeConfig(token: string, agentUid: string, patch: RuntimeConfigPatch): Promise<{
+    uid: string;
+    codexModel?: string;
+    codexReasoningEffort?: string;
+    codexServiceTier?: string;
+    applied: boolean;
+}>;
+export declare function startStopAgent(token: string, agentUid: string, action: "start" | "stop"): Promise<{
+    uid: string;
+    runtime?: Record<string, unknown>;
+}>;
+export declare function retryAgent(token: string, agentUid: string): Promise<Record<string, unknown>>;
+export declare function deprovisionAgent(token: string, agentUid: string): Promise<{
+    uid: string;
+    setupState?: string;
+    terminal?: boolean;
+}>;
+/** Human-readable "hot-applied to the running box" vs "saved for next launch". */
+export declare function appliedHint(applied: boolean): string;
+export declare function registerAgentsCommand(program: Command): void;
+//# sourceMappingURL=agents.d.ts.map

package/dist/commands/agents.js

@@ -0,0 +1,385 @@
+/**
+ * `hq agents` — manage a company's cloud (fleet) agents from the terminal
+ * instead of the web console. Mirrors the console's `AgentsClient`
+ * (hq-console `src/lib/agents-client.ts`), targeting the hq-pro `/v1/agents`
+ * control plane on `DEFAULT_VAULT_API_URL` via the shared `vaultApiFetch`
+ * helper. No new HTTP client, no console-SDK import — same auth + company
+ * resolution stack as `members.ts`.
+ *
+ * Subcommands:
+ *   hq agents list                 — roster for the company
+ *   hq agents status <uid>         — setup state + runtime detail
+ *   hq agents rename <uid> <name>  — set the agent's display name
+ *   hq agents set <uid> [...]      — patch profile (name/title/description)
+ *   hq agents config <uid> [...]   — patch runtime config (model/effort/tier)
+ *   hq agents start|stop <uid>     — EC2 start/stop
+ *   hq agents retry <uid>          — resume setup from first non-done step
+ *   hq agents rm <uid> --yes       — deprovision (destructive; flag-guarded)
+ *
+ * Agents are company-scoped. `--company <slug>` may sit on the group
+ * (`hq agents --company acme list`) or on a subcommand
+ * (`hq agents list --company acme`); when omitted, resolution falls back to
+ * the caller's single active membership (same as `members.ts`).
+ */
+
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="8a374059-a137-5cce-94ad-9e2647fc37c5")}catch(e){}}();
+import chalk from "chalk";
+import { ensureCognitoToken } from "../utils/cognito-session.js";
+import { vaultApiFetch, getCompanyUid } from "../utils/vault-api.js";
+/** Reasoning-effort values hq-pro accepts on `runtime-config`. */
+export const VALID_EFFORTS = new Set([
+    "minimal",
+    "low",
+    "medium",
+    "high",
+    "xhigh",
+]);
+/** Service-tier (speed) values hq-pro accepts on `runtime-config`. */
+export const VALID_TIERS = new Set(["default", "priority"]);
+/**
+ * A non-2xx from the `/v1/agents` control plane. Carries the HTTP status and
+ * the registry error `code` (when present) so callers can branch — notably a
+ * 404 on `list`, which hq-pro returns for a company that has the agents
+ * feature flag OFF (`src/agents/feature-flag.ts`).
+ */
+export class AgentsHttpError extends Error {
+    status;
+    code;
+    constructor(status, message, code) {
+        super(message);
+        this.name = "AgentsHttpError";
+        this.status = status;
+        this.code = code;
+    }
+}
+/**
+ * Authenticated JSON round-trip against the agents control plane. Throws
+ * `AgentsHttpError` on any non-2xx (never swallows — hq-never-swallow-errors),
+ * decoding hq-pro's `{ error | message, code }` envelope for the reason.
+ */
+export async function agentsRequest(opts) {
+    const res = await vaultApiFetch(opts);
+    if (!res.ok) {
+        const body = (await res.json().catch(() => ({})));
+        throw new AgentsHttpError(res.status, body.error ?? body.message ?? res.statusText, body.code);
+    }
+    return (await res.json());
+}
+export async function listAgents(token, companyUid) {
+    const data = await agentsRequest({
+        token,
+        path: "/v1/agents",
+        query: { companyUid },
+    });
+    return data.agents ?? [];
+}
+export async function getAgentStatus(token, agentUid) {
+    return agentsRequest({
+        token,
+        path: `/v1/agents/${encodeURIComponent(agentUid)}/status`,
+    });
+}
+export async function patchAgentProfile(token, agentUid, patch) {
+    return agentsRequest({
+        token,
+        path: `/v1/agents/${encodeURIComponent(agentUid)}/profile`,
+        method: "PATCH",
+        body: patch,
+    });
+}
+export async function patchAgentRuntimeConfig(token, agentUid, patch) {
+    return agentsRequest({
+        token,
+        path: `/v1/agents/${encodeURIComponent(agentUid)}/runtime-config`,
+        method: "PATCH",
+        body: patch,
+    });
+}
+export async function startStopAgent(token, agentUid, action) {
+    return agentsRequest({
+        token,
+        path: `/v1/agents/${encodeURIComponent(agentUid)}/${action}`,
+        method: "POST",
+    });
+}
+export async function retryAgent(token, agentUid) {
+    return agentsRequest({
+        token,
+        path: `/v1/agents/${encodeURIComponent(agentUid)}/retry`,
+        method: "POST",
+    });
+}
+export async function deprovisionAgent(token, agentUid) {
+    return agentsRequest({
+        token,
+        path: `/v1/agents/${encodeURIComponent(agentUid)}`,
+        method: "DELETE",
+    });
+}
+/** Human-readable "hot-applied to the running box" vs "saved for next launch". */
+export function appliedHint(applied) {
+    return applied
+        ? "applied to the running box now"
+        : "saved — takes effect on the agent's next launch";
+}
+// ---------------------------------------------------------------------------
+// Command registration
+// ---------------------------------------------------------------------------
+function fail(err) {
+    if (err instanceof AgentsHttpError) {
+        console.error(chalk.red(err.message));
+    }
+    else {
+        console.error(chalk.red("Error:"), err instanceof Error ? err.message : String(err));
+    }
+    process.exit(1);
+}
+export function registerAgentsCommand(program) {
+    const agents = program
+        .command("agents")
+        .description("Manage a company's cloud (fleet) agents")
+        .option("--company <slug>", "Company slug (resolves to companyUid)");
+    // `--company` may live on the group or the subcommand; the subcommand value
+    // wins so `hq agents list --company acme` works as well as
+    // `hq agents --company acme list`.
+    const companyOf = (sub) => sub.opts().company ??
+        agents.opts().company;
+    agents
+        .command("list")
+        .description("List the company's agents")
+        .option("--company <slug>", "Company slug (resolves to companyUid)")
+        .option("--json", "Emit raw JSON")
+        .action(async function (opts) {
+        try {
+            const token = await ensureCognitoToken();
+            const companyUid = await getCompanyUid(token, companyOf(this));
+            let roster;
+            try {
+                roster = await listAgents(token, companyUid);
+            }
+            catch (err) {
+                // A 404 here means the company doesn't have the agents feature
+                // enabled (hq-pro returns 404 on every /v1/agents route for a
+                // flag-OFF company) — surface that plainly rather than a raw error.
+                if (err instanceof AgentsHttpError && err.status === 404) {
+                    console.log(chalk.gray("No cloud agents are available for this company (the agents feature isn't enabled here)."));
+                    return;
+                }
+                throw err;
+            }
+            if (opts.json) {
+                process.stdout.write(JSON.stringify(roster, null, 2) + "\n");
+                return;
+            }
+            if (roster.length === 0) {
+                console.log(chalk.gray("No agents found for this company."));
+                return;
+            }
+            const nameW = Math.max(4, ...roster.map((a) => (a.name ?? "").length));
+            const slugW = Math.max(4, ...roster.map((a) => (a.slug ?? "").length));
+            const statusW = Math.max(6, ...roster.map((a) => (a.agentStatus ?? "").length));
+            const modelW = Math.max(5, ...roster.map((a) => (a.codexModel ?? "").length));
+            console.log(chalk.bold([
+                "NAME".padEnd(nameW),
+                "SLUG".padEnd(slugW),
+                "STATUS".padEnd(statusW),
+                "MODEL".padEnd(modelW),
+                "UID",
+            ].join("  ")));
+            for (const a of roster) {
+                console.log([
+                    (a.name ?? "").padEnd(nameW),
+                    (a.slug ?? "").padEnd(slugW),
+                    (a.agentStatus ?? "").padEnd(statusW),
+                    (a.codexModel ?? "").padEnd(modelW),
+                    a.uid,
+                ].join("  "));
+            }
+        }
+        catch (err) {
+            fail(err);
+        }
+    });
+    agents
+        .command("status <agentUid>")
+        .description("Show an agent's setup state and runtime detail")
+        .option("--company <slug>", "Company slug (resolves to companyUid)")
+        .option("--json", "Emit raw JSON")
+        .action(async function (agentUid, opts) {
+        try {
+            const token = await ensureCognitoToken();
+            const status = await getAgentStatus(token, agentUid);
+            if (opts.json) {
+                process.stdout.write(JSON.stringify(status, null, 2) + "\n");
+                return;
+            }
+            // Pretty but faithful: dump the top-level fields as key: value.
+            for (const [k, v] of Object.entries(status)) {
+                const rendered = v && typeof v === "object" ? JSON.stringify(v) : String(v);
+                console.log(`${chalk.bold(k)}: ${rendered}`);
+            }
+        }
+        catch (err) {
+            fail(err);
+        }
+    });
+    agents
+        .command("rename <agentUid> <name>")
+        .description("Set an agent's display name")
+        .option("--company <slug>", "Company slug (resolves to companyUid)")
+        .action(async function (agentUid, name) {
+        try {
+            const token = await ensureCognitoToken();
+            const result = await patchAgentProfile(token, agentUid, {
+                displayName: name,
+            });
+            console.log(chalk.green(`Renamed agent ${agentUid} to "${name}"`));
+            if (result.slackUpdated) {
+                console.log(chalk.dim("Propagated to the agent's live Slack app."));
+            }
+        }
+        catch (err) {
+            fail(err);
+        }
+    });
+    agents
+        .command("set <agentUid>")
+        .description("Update an agent's profile (name / title / description)")
+        .option("--company <slug>", "Company slug (resolves to companyUid)")
+        .option("--name <displayName>", "Display name")
+        .option("--title <title>", 'Org-chart job title (e.g. "Chief of Staff")')
+        .option("--description <text>", "Short description / bio")
+        .option("--json", "Emit raw JSON")
+        .action(async function (agentUid, opts) {
+        try {
+            const patch = {};
+            if (opts.name !== undefined)
+                patch.displayName = opts.name;
+            if (opts.title !== undefined)
+                patch.title = opts.title;
+            if (opts.description !== undefined)
+                patch.description = opts.description;
+            if (Object.keys(patch).length === 0) {
+                console.error(chalk.red("Nothing to set. Pass at least one of --name, --title, --description."));
+                process.exit(1);
+            }
+            const token = await ensureCognitoToken();
+            const result = await patchAgentProfile(token, agentUid, patch);
+            if (opts.json) {
+                process.stdout.write(JSON.stringify(result, null, 2) + "\n");
+                return;
+            }
+            console.log(chalk.green(`Updated profile for agent ${agentUid}.`));
+            if (result.slackUpdated) {
+                console.log(chalk.dim("Propagated to the agent's live Slack app."));
+            }
+        }
+        catch (err) {
+            fail(err);
+        }
+    });
+    agents
+        .command("config <agentUid>")
+        .description("Update an agent's runtime config (model / reasoning effort / service tier)")
+        .option("--company <slug>", "Company slug (resolves to companyUid)")
+        .option("--model <model>", "Codex model id")
+        .option("--effort <effort>", "Reasoning effort: minimal | low | medium | high | xhigh")
+        .option("--tier <tier>", "Service tier (speed): default | priority")
+        .option("--json", "Emit raw JSON")
+        .action(async function (agentUid, opts) {
+        try {
+            const patch = {};
+            if (opts.model !== undefined)
+                patch.codexModel = opts.model;
+            if (opts.effort !== undefined) {
+                const effort = opts.effort.trim().toLowerCase();
+                if (!VALID_EFFORTS.has(effort)) {
+                    console.error(chalk.red(`Invalid --effort '${opts.effort}': must be one of minimal, low, medium, high, xhigh`));
+                    process.exit(1);
+                }
+                patch.codexReasoningEffort = effort;
+            }
+            if (opts.tier !== undefined) {
+                const tier = opts.tier.trim().toLowerCase();
+                if (!VALID_TIERS.has(tier)) {
+                    console.error(chalk.red(`Invalid --tier '${opts.tier}': must be one of default, priority`));
+                    process.exit(1);
+                }
+                patch.codexServiceTier = tier;
+            }
+            if (Object.keys(patch).length === 0) {
+                console.error(chalk.red("Nothing to change. Pass at least one of --model, --effort, --tier."));
+                process.exit(1);
+            }
+            const token = await ensureCognitoToken();
+            const result = await patchAgentRuntimeConfig(token, agentUid, patch);
+            if (opts.json) {
+                process.stdout.write(JSON.stringify(result, null, 2) + "\n");
+                return;
+            }
+            console.log(chalk.green(`Updated runtime config for agent ${agentUid} — ${appliedHint(result.applied)}.`));
+        }
+        catch (err) {
+            fail(err);
+        }
+    });
+    for (const action of ["start", "stop"]) {
+        agents
+            .command(`${action} <agentUid>`)
+            .description(`${action === "start" ? "Start" : "Stop"} an agent's box`)
+            .option("--company <slug>", "Company slug (resolves to companyUid)")
+            .action(async function (agentUid) {
+            try {
+                const token = await ensureCognitoToken();
+                await startStopAgent(token, agentUid, action);
+                console.log(chalk.green(`${action === "start" ? "Started" : "Stopped"} agent ${agentUid}.`));
+            }
+            catch (err) {
+                fail(err);
+            }
+        });
+    }
+    agents
+        .command("retry <agentUid>")
+        .description("Resume an agent's setup from the first non-done step")
+        .option("--company <slug>", "Company slug (resolves to companyUid)")
+        .action(async function (agentUid) {
+        try {
+            const token = await ensureCognitoToken();
+            await retryAgent(token, agentUid);
+            console.log(chalk.green(`Retry queued for agent ${agentUid}.`));
+        }
+        catch (err) {
+            fail(err);
+        }
+    });
+    agents
+        .command("rm <agentUid>")
+        .alias("delete")
+        .description("Deprovision (permanently tear down) an agent")
+        .option("--company <slug>", "Company slug (resolves to companyUid)")
+        .option("--yes", "Confirm the irreversible teardown (required)")
+        .action(async function (agentUid, opts) {
+        if (!opts.yes) {
+            console.error(chalk.yellow(`This will permanently deprovision agent ${agentUid} and tear down its ` +
+                `cloud resources. This cannot be undone.\n` +
+                `Re-run with --yes to confirm: hq agents rm ${agentUid} --yes`));
+            process.exit(1);
+        }
+        try {
+            const token = await ensureCognitoToken();
+            const result = await deprovisionAgent(token, agentUid);
+            if (result.terminal === false) {
+                console.log(chalk.yellow(`Deprovision in progress for agent ${agentUid} (not yet fully torn down — re-run to continue).`));
+            }
+            else {
+                console.log(chalk.green(`Deprovisioned agent ${agentUid}.`));
+            }
+        }
+        catch (err) {
+            fail(err);
+        }
+    });
+}
+//# sourceMappingURL=agents.js.map
+//# debugId=8a374059-a137-5cce-94ad-9e2647fc37c5

package/dist/commands/db-migrate.d.ts

@@ -0,0 +1,6 @@
+/**
+ * hq db migrate — apply vault text migrations to local SQLite (US-005).
+ */
+import { Command } from "commander";
+export declare function registerDbMigrateCommand(db: Command): void;
+//# sourceMappingURL=db-migrate.d.ts.map

package/dist/commands/db-migrate.js

@@ -0,0 +1,42 @@
+/**
+ * hq db migrate — apply vault text migrations to local SQLite (US-005).
+ */
+
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="58d60a42-0362-59a3-a31e-c05f1a8dfc1e")}catch(e){}}();
+import chalk from "chalk";
+import path from "node:path";
+import { migrateLocalDb } from "../lib/db/migrate.js";
+const DEFAULT_HQ_ROOT = process.env.HQ_ROOT || path.resolve(process.cwd());
+export function registerDbMigrateCommand(db) {
+    db.command("migrate")
+        .description("Apply pending vault text migrations (companies/{co}/db/migrations/*.sql) to the local DB")
+        .requiredOption("--company <slug>", "Company slug (tenant scope; required)")
+        .option("--hq-root <path>", "HQ tree root containing companies/ (default: cwd or HQ_ROOT)", DEFAULT_HQ_ROOT)
+        .option("--home <path>", "Override home for local DB root (tests)")
+        .action((opts) => {
+        try {
+            const company = String(opts.company ?? "").trim();
+            if (!company) {
+                console.error(chalk.red("Error: --company is required"));
+                process.exitCode = 1;
+                return;
+            }
+            const result = migrateLocalDb({
+                company,
+                hqRoot: opts.hqRoot || DEFAULT_HQ_ROOT,
+                ...(opts.home ? { home: opts.home } : {}),
+            });
+            console.log(`company: ${result.company}`);
+            console.log(`migrationsDir: ${result.migrationsDir}`);
+            console.log(`applied: ${result.applied.length ? result.applied.join(", ") : "(none)"}`);
+            console.log(`skipped: ${result.skipped.length ? result.skipped.join(", ") : "(none)"}`);
+            console.log(`schemaVersion: ${result.head ?? "(none)"}`);
+        }
+        catch (error) {
+            console.error(chalk.red("Error:"), error instanceof Error ? error.message : "Unknown error");
+            process.exitCode = 1;
+        }
+    });
+}
+//# sourceMappingURL=db-migrate.js.map
+//# debugId=58d60a42-0362-59a3-a31e-c05f1a8dfc1e

package/dist/commands/db-provision.d.ts

@@ -0,0 +1,15 @@
+/**
+ * hq db provision — request remote vault DB binding (US-009).
+ */
+import { Command } from "commander";
+export interface DbProvisionCommandDeps {
+    resolveCompany: (slug: string) => Promise<{
+        companyUid: string;
+        companySlug: string;
+    }>;
+    getAccessToken: () => Promise<string>;
+    apiBaseUrl: string;
+    fetchImpl?: typeof fetch;
+}
+export declare function registerDbProvisionCommand(db: Command, depsFactory?: () => DbProvisionCommandDeps): void;
+//# sourceMappingURL=db-provision.d.ts.map

package/dist/commands/db-provision.js

@@ -0,0 +1,78 @@
+/**
+ * hq db provision — request remote vault DB binding (US-009).
+ */
+
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="cecdf1ea-3f73-54c4-adc0-f11caebf1e55")}catch(e){}}();
+import chalk from "chalk";
+import { ControlPlaneDbClient } from "../lib/db/control-plane.js";
+const defaultDeps = () => ({
+    async resolveCompany(slug) {
+        // Production path: resolve via vault API membership. Tests inject mocks.
+        // Keep slug as placeholder uid only when HQ_DB_MOCK_CONTROL_PLANE=1.
+        if (process.env.HQ_DB_MOCK_CONTROL_PLANE === "1") {
+            return { companyUid: `cmp_${slug}`, companySlug: slug };
+        }
+        throw new Error("company resolution not wired in this build path — inject deps or set HQ_DB_MOCK_CONTROL_PLANE=1 for local mock");
+    },
+    async getAccessToken() {
+        if (process.env.HQ_DB_MOCK_CONTROL_PLANE === "1") {
+            return "mock-token";
+        }
+        throw new Error("auth token resolution not wired — inject deps for production");
+    },
+    apiBaseUrl: process.env.HQ_API_BASE_URL ||
+        process.env.HQ_CLOUD_API_URL ||
+        "https://hqapi.getindigo.ai",
+});
+export function registerDbProvisionCommand(db, depsFactory = defaultDeps) {
+    db.command("provision")
+        .description("Provision (or re-bind) the company remote vault DB via HQ control plane")
+        .requiredOption("--company <slug>", "Company slug")
+        .option("--region <region>", "AWS region", "us-east-1")
+        .action(async (opts) => {
+        try {
+            const deps = depsFactory();
+            const company = String(opts.company ?? "").trim();
+            if (!company) {
+                console.error(chalk.red("Error: --company is required"));
+                process.exitCode = 1;
+                return;
+            }
+            const resolved = await deps.resolveCompany(company);
+            const client = new ControlPlaneDbClient({
+                baseUrl: deps.apiBaseUrl,
+                getAccessToken: deps.getAccessToken,
+                fetchImpl: deps.fetchImpl,
+            });
+            const result = await client.provision({
+                companyUid: resolved.companyUid,
+                companySlug: resolved.companySlug,
+                region: opts.region,
+            });
+            console.log(`company: ${result.companySlug}`);
+            console.log(`remote: ${result.status}`);
+            console.log(`engine: ${result.engineId}`);
+            console.log(`region: ${result.region}`);
+            console.log(`resourceArn: ${result.resourceArn}`);
+            console.log(`secretRef: ${result.secretRef}`);
+            console.log(`idempotent: ${result.idempotent ? "yes" : "no"}`);
+        }
+        catch (error) {
+            const msg = error instanceof Error ? error.message : "Unknown error";
+            const status = error.status;
+            if (status === 402 || /PLAN_REQUIRED|Team plan|\$500/i.test(msg)) {
+                console.error(chalk.red("Error:"), "Remote vault DB requires the HQ Team plan ($500/mo).");
+                console.error(chalk.dim("Local databases still work: hq db status|sql|migrate — no Team plan required."));
+            }
+            else {
+                console.error(chalk.red("Error:"), msg);
+            }
+            if (/postgres:\/\//i.test(msg)) {
+                console.error(chalk.red("Error: refused to print secret material"));
+            }
+            process.exitCode = 1;
+        }
+    });
+}
+//# sourceMappingURL=db-provision.js.map
+//# debugId=cecdf1ea-3f73-54c4-adc0-f11caebf1e55

package/dist/commands/db-sql.d.ts

@@ -0,0 +1,9 @@
+/**
+ * hq db sql — run SQL against the company local vault DB (US-004).
+ *
+ * Default is read-only. Prefer `hq db migrate` for schema changes.
+ * Never prints remote connection strings.
+ */
+import { Command } from "commander";
+export declare function registerDbSqlCommand(db: Command): void;
+//# sourceMappingURL=db-sql.d.ts.map