@indigoai-us/hq-cli 5.61.0 → 5.62.0

package/dist/commands/workers.js

@@ -0,0 +1,229 @@
+
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="a4a2bf8b-0a33-57ba-a565-412a14132c99")}catch(e){}}();
+import chalk from "chalk";
+import * as fs from "fs";
+import * as path from "path";
+import * as yaml from "js-yaml";
+import { ensureCognitoToken } from "../utils/cognito-session.js";
+import { vaultApiFetch, getCompanyUid } from "./secrets.js";
+import { GROUP_ID_PATTERN, EMAIL_PATTERN, normalizeFilePrefix } from "./_patterns.js";
+import { findHqRoot } from "../utils/manifest.js";
+/** Read + parse the worker registry. Empty array if it does not exist. */
+export function readWorkerRegistry(hqRoot) {
+    const p = path.join(hqRoot, "core/workers/registry.yaml");
+    if (!fs.existsSync(p))
+        return [];
+    const doc = yaml.load(fs.readFileSync(p, "utf8"));
+    return doc?.workers ?? [];
+}
+/**
+ * Best-effort active company: workspace/sessions/.current -> meta.yaml
+ * company_slug. Undefined when no session context is set. Pure/read-only.
+ */
+export function resolveActiveCompany(hqRoot) {
+    try {
+        const currentFile = path.join(hqRoot, "workspace/sessions/.current");
+        const current = fs.readFileSync(currentFile, "utf8").trim();
+        if (!current)
+            return undefined;
+        const metaPath = path.join(hqRoot, "workspace/sessions", current, "meta.yaml");
+        if (!fs.existsSync(metaPath))
+            return undefined;
+        const meta = yaml.load(fs.readFileSync(metaPath, "utf8"));
+        const co = meta?.company_slug;
+        return typeof co === "string" && co ? co : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Membership-aware access filter for worker discovery: public workers always;
+ * company workers only for the active company. Mirrors the /run skill and the
+ * inject-worker-suggestion hook so all three surfaces agree.
+ */
+export function filterAccessibleWorkers(workers, activeCompany) {
+    return workers.filter((w) => {
+        if (w.visibility === "public")
+            return true;
+        if (!w.company)
+            return false;
+        return activeCompany !== undefined && w.company === activeCompany;
+    });
+}
+/**
+ * The company-relative vault prefix for a worker, e.g.
+ * companies/indigo/workers/deal-brain/ -> workers/deal-brain/. Returns null for
+ * a worker with no company (public/shared — not shareable via ACL).
+ */
+export function workerVaultPrefix(w) {
+    if (!w.company)
+        return null;
+    const companyRoot = `companies/${w.company}/`;
+    const rel = w.path.startsWith(companyRoot)
+        ? w.path.slice(companyRoot.length)
+        : w.path;
+    return normalizeFilePrefix(rel);
+}
+/** Classify a share principal (@all | email | grp_*) — null when invalid. */
+export function classifyPrincipal(principal) {
+    if (principal === "@all") {
+        return { granteeType: "company-wide", granteeId: "", label: "everyone in the company" };
+    }
+    if (EMAIL_PATTERN.test(principal)) {
+        const id = principal.trim().toLowerCase();
+        return { granteeType: "email", granteeId: id, label: id };
+    }
+    if (GROUP_ID_PATTERN.test(principal)) {
+        return { granteeType: "group", granteeId: principal, label: principal };
+    }
+    return null;
+}
+/**
+ * Record a grant locally in the worker's tool-owned .grants.yaml sidecar. Kept
+ * out of worker.yaml so we never rewrite a hand-authored file; the registry
+ * generator unions this sidecar into the registry `grants:` field. Idempotent.
+ */
+export function writeGrantSidecar(hqRoot, workerPath, principalLabel) {
+    const dir = path.join(hqRoot, workerPath);
+    const sidecar = path.join(dir, ".grants.yaml");
+    let grants = [];
+    if (fs.existsSync(sidecar)) {
+        const doc = yaml.load(fs.readFileSync(sidecar, "utf8"));
+        if (Array.isArray(doc?.grants))
+            grants = doc.grants.filter((g) => typeof g === "string");
+    }
+    if (!grants.includes(principalLabel))
+        grants.push(principalLabel);
+    const header = "# Worker access grants — tool-owned, written by `hq workers share`.\n" +
+        "# Unioned into core/workers/registry.yaml `grants:` by the registry generator.\n";
+    fs.writeFileSync(sidecar, header + yaml.dump({ grants }), "utf8");
+}
+async function runWorkersShare(workerId, opts) {
+    const hqRoot = findHqRoot();
+    const worker = readWorkerRegistry(hqRoot).find((w) => w.id === workerId);
+    if (!worker) {
+        console.error(chalk.red(`Worker '${workerId}' not found in registry.`), "\nRun 'hq workers list' to see accessible workers.");
+        process.exit(1);
+    }
+    const prefix = workerVaultPrefix(worker);
+    if (!prefix) {
+        console.error(chalk.red(`'${workerId}' is a shared/public worker (visibility ${worker.visibility}).`), "\nPublic workers already ship to every HQ install — only company-scoped workers are shared with `hq workers share`.");
+        process.exit(1);
+    }
+    const permission = opts.permission ?? "read";
+    if (!["read", "write"].includes(permission)) {
+        console.error(chalk.red(`Invalid permission '${permission}': must be read or write`));
+        process.exit(1);
+    }
+    const classified = classifyPrincipal(opts.with);
+    if (!classified) {
+        console.error(chalk.red(`Invalid principal '${opts.with}': must be '@all', an email address, or a group id matching grp_<alphanumeric>`));
+        process.exit(1);
+    }
+    const companySlug = opts.company ?? worker.company;
+    const token = await ensureCognitoToken();
+    const companyUid = await getCompanyUid(token, companySlug);
+    const body = {
+        prefix,
+        granteeType: classified.granteeType,
+        granteeId: classified.granteeId,
+        permission,
+    };
+    let res = await vaultApiFetch({
+        token,
+        path: `/files/${encodeURIComponent(companyUid)}/acl/grant`,
+        method: "POST",
+        body,
+    });
+    // No ACL row for this prefix yet — auto-create one with this grant.
+    if (res.status === 404) {
+        res = await vaultApiFetch({
+            token,
+            path: `/files/${encodeURIComponent(companyUid)}/acl`,
+            method: "POST",
+            body: {
+                prefix,
+                entries: [
+                    {
+                        granteeType: classified.granteeType,
+                        granteeId: classified.granteeId,
+                        permission,
+                    },
+                ],
+            },
+        });
+    }
+    if (!res.ok) {
+        const text = await res.text().catch(() => "");
+        console.error(chalk.red(`Failed to share worker (HTTP ${res.status}). ${text}`));
+        process.exit(1);
+    }
+    writeGrantSidecar(hqRoot, worker.path, classified.label);
+    console.log(chalk.green("✓"), `Shared worker '${workerId}' with ${classified.label} (${permission}).`);
+    console.log(chalk.dim(`  Vault prefix ${prefix} granted in company '${companySlug}'. It will sync to granted members and appear in their /run list.`));
+}
+function runWorkersList(opts) {
+    const hqRoot = findHqRoot();
+    const activeCompany = opts.company ?? resolveActiveCompany(hqRoot);
+    let workers = filterAccessibleWorkers(readWorkerRegistry(hqRoot), activeCompany);
+    if (opts.shared)
+        workers = workers.filter((w) => Boolean(w.grants && w.grants.trim()));
+    if (opts.mine)
+        workers = workers.filter((w) => Boolean(w.company) && w.company === activeCompany);
+    if (workers.length === 0) {
+        console.log("No accessible workers.");
+        return;
+    }
+    const publicWorkers = workers.filter((w) => w.visibility === "public");
+    const companyWorkers = workers.filter((w) => w.visibility !== "public");
+    console.log(chalk.bold("Available Workers:"));
+    const printGroup = (title, list) => {
+        if (list.length === 0)
+            return;
+        console.log(`\n  ${chalk.cyan(title)}:`);
+        for (const w of list.sort((a, b) => a.id.localeCompare(b.id))) {
+            const desc = (w.description ?? "").slice(0, 72);
+            const shared = w.grants && w.grants.trim() ? chalk.dim(`  [shared: ${w.grants}]`) : "";
+            console.log(`    ${w.id.padEnd(24)} ${desc}${shared}`);
+        }
+    };
+    printGroup("Public", publicWorkers);
+    if (activeCompany)
+        printGroup(activeCompany, companyWorkers);
+    console.log(chalk.dim("\nUsage: hq run {worker-id} [skill] [args]"));
+    console.log(chalk.dim("Share a company worker: hq workers share {worker-id} --with {grp_<name>|@all} --permission read"));
+}
+export function registerWorkersCommand(program) {
+    const workers = program
+        .command("workers")
+        .description("Discover and share HQ workers")
+        .option("--company <slug>", "Company slug (resolves to companyUid)");
+    workers
+        .command("list")
+        .description("List workers you can access (public + your active company's)")
+        .option("--mine", "Only this company's workers")
+        .option("--shared", "Only workers that have been shared with someone")
+        .action((opts) => {
+        runWorkersList({ ...opts, company: workers.opts().company });
+    });
+    workers
+        .command("share <workerId>")
+        .description("Grant a teammate, group, or @all access to a company worker")
+        .requiredOption("--with <principal>", "Email address, group id (grp_<name>), or '@all' to share with every active company member")
+        .option("--permission <level>", "Permission level: read | write (default: read)")
+        .action(async (workerId, opts) => {
+        try {
+            await runWorkersShare(workerId, {
+                ...opts,
+                company: workers.opts().company,
+            });
+        }
+        catch (err) {
+            console.error(chalk.red("Error:"), err instanceof Error ? err.message : String(err));
+            process.exit(1);
+        }
+    });
+}
+//# sourceMappingURL=workers.js.map
+//# debugId=a4a2bf8b-0a33-57ba-a565-412a14132c99

package/dist/lib/db/control-plane.d.ts

@@ -0,0 +1,45 @@
+/**
+ * Control-plane client for remote vault DB (US-009).
+ * Injectable fetch for tests — never logs response bodies that might hold secrets.
+ */
+export interface RemoteProvisionResponse {
+    ok: boolean;
+    companyUid: string;
+    companySlug: string;
+    engineId: string;
+    resourceArn: string;
+    region: string;
+    status: string;
+    secretRef: string;
+    idempotent: boolean;
+}
+export interface RemoteStatusResponse {
+    companyUid: string;
+    companySlug?: string;
+    remote: {
+        engineId: string;
+        resourceArn: string;
+        region: string;
+        status: string;
+        secretRef: string;
+    } | null;
+}
+export interface ControlPlaneClientOptions {
+    baseUrl: string;
+    /** Bearer access token */
+    getAccessToken: () => Promise<string>;
+    fetchImpl?: typeof fetch;
+}
+export declare class ControlPlaneDbClient {
+    private readonly baseUrl;
+    private readonly getAccessToken;
+    private readonly fetchImpl;
+    constructor(opts: ControlPlaneClientOptions);
+    provision(input: {
+        companyUid: string;
+        companySlug: string;
+        region?: string;
+    }): Promise<RemoteProvisionResponse>;
+    status(companyUid: string): Promise<RemoteStatusResponse>;
+}
+//# sourceMappingURL=control-plane.d.ts.map

package/dist/lib/db/control-plane.js

@@ -0,0 +1,81 @@
+/**
+ * Control-plane client for remote vault DB (US-009).
+ * Injectable fetch for tests — never logs response bodies that might hold secrets.
+ */
+
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="b2bf60fc-6b3a-5534-af8e-3b92b9518e29")}catch(e){}}();
+function assertNoPostgresUrl(label, text) {
+    if (/postgres:\/\//i.test(text) || /postgresql:\/\//i.test(text)) {
+        throw new Error(`${label}: control plane returned a connection string (refusing to surface)`);
+    }
+}
+export class ControlPlaneDbClient {
+    baseUrl;
+    getAccessToken;
+    fetchImpl;
+    constructor(opts) {
+        this.baseUrl = opts.baseUrl.replace(/\/$/, "");
+        this.getAccessToken = opts.getAccessToken;
+        this.fetchImpl = opts.fetchImpl ?? fetch;
+    }
+    async provision(input) {
+        const token = await this.getAccessToken();
+        const res = await this.fetchImpl(`${this.baseUrl}/v1/db/provision`, {
+            method: "POST",
+            headers: {
+                Authorization: `Bearer ${token}`,
+                "Content-Type": "application/json",
+            },
+            body: JSON.stringify(input),
+        });
+        const text = await res.text();
+        assertNoPostgresUrl("provision", text);
+        if (!res.ok) {
+            let msg = `provision failed (${res.status})`;
+            let code;
+            try {
+                const j = JSON.parse(text);
+                if (j.error)
+                    msg = j.error;
+                if (j.code)
+                    code = j.code;
+            }
+            catch {
+                /* keep */
+            }
+            const err = new Error(msg);
+            err.status = res.status;
+            if (code)
+                err.code = code;
+            throw err;
+        }
+        return JSON.parse(text);
+    }
+    async status(companyUid) {
+        const token = await this.getAccessToken();
+        const url = `${this.baseUrl}/v1/db/status?companyUid=${encodeURIComponent(companyUid)}`;
+        const res = await this.fetchImpl(url, {
+            method: "GET",
+            headers: { Authorization: `Bearer ${token}` },
+        });
+        const text = await res.text();
+        assertNoPostgresUrl("status", text);
+        if (!res.ok) {
+            let msg = `status failed (${res.status})`;
+            try {
+                const j = JSON.parse(text);
+                if (j.error)
+                    msg = j.error;
+            }
+            catch {
+                /* keep */
+            }
+            const err = new Error(msg);
+            err.status = res.status;
+            throw err;
+        }
+        return JSON.parse(text);
+    }
+}
+//# sourceMappingURL=control-plane.js.map
+//# debugId=b2bf60fc-6b3a-5534-af8e-3b92b9518e29

package/dist/lib/db/local.d.ts

@@ -0,0 +1,49 @@
+/**
+ * Local vault SQLite open/create (C1).
+ *
+ * File lives at ~/.hq/db/{company}/vault.db with WAL journal mode.
+ * Never returns or logs remote connection strings.
+ */
+import Database from "better-sqlite3";
+import { type LocalDbPathEnv } from "./paths.js";
+export type LocalDb = Database.Database;
+export interface OpenLocalDbOptions extends LocalDbPathEnv {
+    /** When true, do not create the file if missing (throws). Default false. */
+    readonly?: boolean;
+}
+export interface LocalDbStatus {
+    company: string;
+    tier: "local";
+    path: string;
+    exists: boolean;
+    healthy: boolean;
+    journalMode: string | null;
+    /** Migration ledger head when present; null if ledger not initialized. */
+    schemaVersion: string | null;
+    /** Fingerprint of path for logs that prefer not to echo full home paths. */
+    pathFingerprint: string;
+}
+/**
+ * Short non-reversible fingerprint of a path (for status display).
+ * Not a secret — just avoids dumping full home paths when preferred.
+ */
+export declare function fingerprintPath(filePath: string): string;
+/**
+ * Open (and create if missing) the company local vault DB with WAL mode.
+ * Idempotent: reopening an existing file does not recreate or wipe it.
+ */
+export declare function openLocalDb(companySlug: string, opts?: OpenLocalDbOptions): LocalDb;
+/**
+ * Read migration head from platform ledger if the table exists.
+ */
+export declare function readMigrationHead(db: LocalDb): string | null;
+/**
+ * Ensure local DB exists (create if needed), report status, close handle.
+ * Safe for CLI status: never includes connection strings.
+ */
+export declare function ensureAndStatusLocalDb(companySlug: string, opts?: LocalDbPathEnv): LocalDbStatus;
+/**
+ * Format status for CLI stdout (no secrets).
+ */
+export declare function formatLocalDbStatus(status: LocalDbStatus): string;
+//# sourceMappingURL=local.d.ts.map

package/dist/lib/db/local.js

@@ -0,0 +1,106 @@
+/**
+ * Local vault SQLite open/create (C1).
+ *
+ * File lives at ~/.hq/db/{company}/vault.db with WAL journal mode.
+ * Never returns or logs remote connection strings.
+ */
+
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="3cf7d852-6ced-5521-a8de-8da889a5b97c")}catch(e){}}();
+import fs from "node:fs";
+import Database from "better-sqlite3";
+import { ensureLocalDbDir, resolveLocalDbPath, } from "./paths.js";
+const MIGRATIONS_TABLE = "hq_schema_migrations";
+/**
+ * Short non-reversible fingerprint of a path (for status display).
+ * Not a secret — just avoids dumping full home paths when preferred.
+ */
+export function fingerprintPath(filePath) {
+    let h = 2166136261;
+    for (let i = 0; i < filePath.length; i++) {
+        h ^= filePath.charCodeAt(i);
+        h = Math.imul(h, 16777619);
+    }
+    return `fp_${(h >>> 0).toString(16).padStart(8, "0")}`;
+}
+/**
+ * Open (and create if missing) the company local vault DB with WAL mode.
+ * Idempotent: reopening an existing file does not recreate or wipe it.
+ */
+export function openLocalDb(companySlug, opts) {
+    const dbPath = resolveLocalDbPath(companySlug, opts);
+    const exists = fs.existsSync(dbPath);
+    if (!exists) {
+        if (opts?.readonly) {
+            throw new Error(`local vault DB not found for company ${JSON.stringify(companySlug)} at ${dbPath}`);
+        }
+        ensureLocalDbDir(companySlug, opts);
+    }
+    const db = new Database(dbPath);
+    // WAL for concurrent readers; safe for agent/CLI workloads.
+    db.pragma("journal_mode = WAL");
+    db.pragma("foreign_keys = ON");
+    return db;
+}
+/**
+ * Read migration head from platform ledger if the table exists.
+ */
+export function readMigrationHead(db) {
+    try {
+        const row = db
+            .prepare(`SELECT name FROM sqlite_master WHERE type='table' AND name=?`)
+            .get(MIGRATIONS_TABLE);
+        if (!row?.name)
+            return null;
+        const head = db
+            .prepare(`SELECT version FROM ${MIGRATIONS_TABLE} ORDER BY version DESC LIMIT 1`)
+            .get();
+        return head?.version ?? null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Ensure local DB exists (create if needed), report status, close handle.
+ * Safe for CLI status: never includes connection strings.
+ */
+export function ensureAndStatusLocalDb(companySlug, opts) {
+    const dbPath = resolveLocalDbPath(companySlug, opts);
+    const db = openLocalDb(companySlug, opts);
+    try {
+        const journalMode = String(db.pragma("journal_mode", { simple: true }));
+        const schemaVersion = readMigrationHead(db);
+        // Touch a trivial query to prove the handle is healthy.
+        db.prepare("SELECT 1 AS ok").get();
+        return {
+            company: companySlug.trim().toLowerCase(),
+            tier: "local",
+            path: dbPath,
+            exists: true,
+            healthy: true,
+            journalMode,
+            schemaVersion,
+            pathFingerprint: fingerprintPath(dbPath),
+        };
+    }
+    finally {
+        db.close();
+    }
+}
+/**
+ * Format status for CLI stdout (no secrets).
+ */
+export function formatLocalDbStatus(status) {
+    const lines = [
+        `company: ${status.company}`,
+        `tier: ${status.tier}`,
+        `healthy: ${status.healthy ? "yes" : "no"}`,
+        `path: ${status.path}`,
+        `pathFingerprint: ${status.pathFingerprint}`,
+        `journalMode: ${status.journalMode ?? "unknown"}`,
+        `schemaVersion: ${status.schemaVersion ?? "(none)"}`,
+    ];
+    return lines.join("\n");
+}
+//# sourceMappingURL=local.js.map
+//# debugId=3cf7d852-6ced-5521-a8de-8da889a5b97c

package/dist/lib/db/migrate.d.ts

@@ -0,0 +1,41 @@
+/**
+ * Vault text migrations for local SQLite (vault-databases US-005).
+ *
+ * Migrations live as reviewable text under:
+ *   companies/{company}/db/migrations/*.sql
+ * Applied versions are recorded in hq_schema_migrations inside the local DB.
+ */
+import type { LocalDb } from "./local.js";
+import type { LocalDbPathEnv } from "./paths.js";
+export declare const MIGRATIONS_TABLE = "hq_schema_migrations";
+export interface MigrateOptions extends LocalDbPathEnv {
+    company: string;
+    /**
+     * Absolute path to HQ root containing companies/{co}/db/migrations.
+     * Required for vault-relative migrations.
+     */
+    hqRoot: string;
+}
+export interface MigrateResult {
+    company: string;
+    migrationsDir: string;
+    applied: string[];
+    skipped: string[];
+    head: string | null;
+}
+export declare function resolveMigrationsDir(hqRoot: string, companySlug: string): string;
+/**
+ * Ensure migrations directory exists (creates empty dir on first migrate).
+ */
+export declare function ensureMigrationsDir(hqRoot: string, companySlug: string): string;
+/**
+ * List pending migration files in lexical/version order (filename sort).
+ */
+export declare function listMigrationFiles(migrationsDir: string): string[];
+export declare function ensureMigrationsLedger(db: LocalDb): void;
+export declare function listAppliedVersions(db: LocalDb): Set<string>;
+/**
+ * Apply pending migrations. On failure, does not mark the failed file applied.
+ */
+export declare function migrateLocalDb(opts: MigrateOptions): MigrateResult;
+//# sourceMappingURL=migrate.d.ts.map

package/dist/lib/db/migrate.js

@@ -0,0 +1,104 @@
+/**
+ * Vault text migrations for local SQLite (vault-databases US-005).
+ *
+ * Migrations live as reviewable text under:
+ *   companies/{company}/db/migrations/*.sql
+ * Applied versions are recorded in hq_schema_migrations inside the local DB.
+ */
+
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="d8abc231-bc36-5aad-a942-acbb0b86ea96")}catch(e){}}();
+import fs from "node:fs";
+import path from "node:path";
+import { openLocalDb, readMigrationHead } from "./local.js";
+import { normalizeCompanySlugForLocalDb } from "./paths.js";
+export const MIGRATIONS_TABLE = "hq_schema_migrations";
+export function resolveMigrationsDir(hqRoot, companySlug) {
+    const slug = normalizeCompanySlugForLocalDb(companySlug);
+    return path.join(hqRoot, "companies", slug, "db", "migrations");
+}
+/**
+ * Ensure migrations directory exists (creates empty dir on first migrate).
+ */
+export function ensureMigrationsDir(hqRoot, companySlug) {
+    const dir = resolveMigrationsDir(hqRoot, companySlug);
+    fs.mkdirSync(dir, { recursive: true });
+    return dir;
+}
+/**
+ * List pending migration files in lexical/version order (filename sort).
+ */
+export function listMigrationFiles(migrationsDir) {
+    if (!fs.existsSync(migrationsDir))
+        return [];
+    return fs
+        .readdirSync(migrationsDir)
+        .filter((f) => f.endsWith(".sql"))
+        .sort((a, b) => a.localeCompare(b, "en"));
+}
+export function ensureMigrationsLedger(db) {
+    db.exec(`
+    CREATE TABLE IF NOT EXISTS ${MIGRATIONS_TABLE} (
+      version TEXT PRIMARY KEY NOT NULL,
+      applied_at TEXT NOT NULL DEFAULT (datetime('now'))
+    );
+  `);
+}
+export function listAppliedVersions(db) {
+    ensureMigrationsLedger(db);
+    const rows = db
+        .prepare(`SELECT version FROM ${MIGRATIONS_TABLE} ORDER BY version`)
+        .all();
+    return new Set(rows.map((r) => r.version));
+}
+/**
+ * Apply pending migrations. On failure, does not mark the failed file applied.
+ */
+export function migrateLocalDb(opts) {
+    const company = normalizeCompanySlugForLocalDb(opts.company);
+    if (!opts.hqRoot?.trim()) {
+        throw new Error("hqRoot is required for vault migrations");
+    }
+    const migrationsDir = ensureMigrationsDir(opts.hqRoot, company);
+    const files = listMigrationFiles(migrationsDir);
+    const db = openLocalDb(company, opts);
+    const applied = [];
+    const skipped = [];
+    try {
+        ensureMigrationsLedger(db);
+        const already = listAppliedVersions(db);
+        for (const file of files) {
+            const version = file.replace(/\.sql$/i, "");
+            if (already.has(version) || already.has(file)) {
+                skipped.push(file);
+                continue;
+            }
+            const fullPath = path.join(migrationsDir, file);
+            const sql = fs.readFileSync(fullPath, "utf8");
+            const run = db.transaction(() => {
+                db.exec(sql);
+                db.prepare(`INSERT INTO ${MIGRATIONS_TABLE} (version) VALUES (?)`).run(version);
+            });
+            try {
+                run();
+                applied.push(file);
+                already.add(version);
+            }
+            catch (err) {
+                const msg = err instanceof Error ? err.message : String(err);
+                throw new Error(`migration failed: ${file} — ${msg} (not marked applied)`);
+            }
+        }
+        return {
+            company,
+            migrationsDir,
+            applied,
+            skipped,
+            head: readMigrationHead(db),
+        };
+    }
+    finally {
+        db.close();
+    }
+}
+//# sourceMappingURL=migrate.js.map
+//# debugId=d8abc231-bc36-5aad-a942-acbb0b86ea96