@indigoai-us/hq-cli 5.121.1 → 5.121.2

package/CHANGELOG.md

@@ -2,6 +2,14 @@
 
 ## [Unreleased]
 
+## [5.121.2] — 2026-09-18
+
+### Added
+
+- `hq cloud retire company <slug>` soft-tombstones a cloud company (owner
+  only, confirm unless `--yes`) so `hq cloud demote company` can run without
+  `--propagate-deletes`. Vault files stay; local folders are not touched.
+
 ## [5.121.1] — 2026-09-18
 
 ### Fixed

package/dist/command-catalog.generated.d.ts

@@ -722,6 +722,37 @@ export declare const COMMAND_CATALOG: readonly [{
             }];
             readonly subcommands: readonly [];
         }];
+    }, {
+        readonly name: "retire";
+        readonly description: "Soft-tombstone a cloud-backed company (owner only)";
+        readonly aliases: readonly [];
+        readonly hidden: false;
+        readonly usage: "[options] [command]";
+        readonly arguments: readonly [];
+        readonly options: readonly [];
+        readonly subcommands: readonly [{
+            readonly name: "company";
+            readonly description: "Soft-tombstone a cloud company so `hq cloud demote company` can run. Does not delete vault files or local folders. Prompts unless --yes.";
+            readonly aliases: readonly [];
+            readonly hidden: false;
+            readonly usage: "[options] <slug>";
+            readonly arguments: readonly [{
+                readonly name: "slug";
+                readonly required: true;
+                readonly variadic: false;
+            }];
+            readonly options: readonly [{
+                readonly flags: "--hq-root <path>";
+                readonly description: "Local HQ tree root (default: <runtime-path>)";
+            }, {
+                readonly flags: "--vault-api-url <url>";
+                readonly description: "Vault API URL (default: https://hqapi.hq.computer)";
+            }, {
+                readonly flags: "-y, --yes";
+                readonly description: "Skip the confirmation prompt (for scripts)";
+            }];
+            readonly subcommands: readonly [];
+        }];
     }, {
         readonly name: "demote";
         readonly description: "Demote a cloud-backed entity back to local-only";
@@ -732,7 +763,7 @@ export declare const COMMAND_CATALOG: readonly [{
         readonly options: readonly [];
         readonly subcommands: readonly [{
             readonly name: "company";
-            readonly description: "Demote a cloud-backed company to local-only after the cloud entity has been soft-tombstoned in hq-console. Removes .hq/config.json, flips company.yaml `cloud: false`, and strips the manifest cloud refs.";
+            readonly description: "Demote a cloud-backed company to local-only after the cloud entity has been soft-tombstoned (`hq cloud retire company` or hq-console). Removes .hq/config.json, flips company.yaml `cloud: false`, and strips the manifest cloud refs.";
             readonly aliases: readonly [];
             readonly hidden: false;
             readonly usage: "[options] <slug>";

package/dist/command-catalog.generated.js

@@ -924,6 +924,46 @@ export const COMMAND_CATALOG = [
                     }
                 ]
             },
+            {
+                "name": "retire",
+                "description": "Soft-tombstone a cloud-backed company (owner only)",
+                "aliases": [],
+                "hidden": false,
+                "usage": "[options] [command]",
+                "arguments": [],
+                "options": [],
+                "subcommands": [
+                    {
+                        "name": "company",
+                        "description": "Soft-tombstone a cloud company so `hq cloud demote company` can run. Does not delete vault files or local folders. Prompts unless --yes.",
+                        "aliases": [],
+                        "hidden": false,
+                        "usage": "[options] <slug>",
+                        "arguments": [
+                            {
+                                "name": "slug",
+                                "required": true,
+                                "variadic": false
+                            }
+                        ],
+                        "options": [
+                            {
+                                "flags": "--hq-root <path>",
+                                "description": "Local HQ tree root (default: <runtime-path>)"
+                            },
+                            {
+                                "flags": "--vault-api-url <url>",
+                                "description": "Vault API URL (default: https://hqapi.hq.computer)"
+                            },
+                            {
+                                "flags": "-y, --yes",
+                                "description": "Skip the confirmation prompt (for scripts)"
+                            }
+                        ],
+                        "subcommands": []
+                    }
+                ]
+            },
             {
                 "name": "demote",
                 "description": "Demote a cloud-backed entity back to local-only",
@@ -935,7 +975,7 @@ export const COMMAND_CATALOG = [
                 "subcommands": [
                     {
                         "name": "company",
-                        "description": "Demote a cloud-backed company to local-only after the cloud entity has been soft-tombstoned in hq-console. Removes .hq/config.json, flips company.yaml `cloud: false`, and strips the manifest cloud refs.",
+                        "description": "Demote a cloud-backed company to local-only after the cloud entity has been soft-tombstoned (`hq cloud retire company` or hq-console). Removes .hq/config.json, flips company.yaml `cloud: false`, and strips the manifest cloud refs.",
                         "aliases": [],
                         "hidden": false,
                         "usage": "[options] <slug>",

package/dist/command-registration-plan.d.ts

@@ -141,6 +141,12 @@ export declare const REGISTRATION_PLAN: readonly [{
     readonly parent: "cloud";
     readonly module: "./commands/cloud-provision.js";
     readonly exportName: "registerCloudProvisionCommands";
+}, {
+    readonly type: "registrar";
+    readonly root: "cloud";
+    readonly parent: "cloud";
+    readonly module: "./commands/cloud-retire.js";
+    readonly exportName: "registerCloudRetireCommands";
 }, {
     readonly type: "registrar";
     readonly root: "cloud";

package/dist/command-registration-plan.js

@@ -26,6 +26,7 @@ export const REGISTRATION_PLAN = [
     { type: "registrar", root: "sync", parent: "sync", module: "./commands/sync-manifest.js", exportName: "registerSyncManifestCommand" },
     { type: "group", root: "cloud", id: "cloud", name: "cloud", description: "Cloud commands — provision entities and manage cloud-backed companies" },
     { type: "registrar", root: "cloud", parent: "cloud", module: "./commands/cloud-provision.js", exportName: "registerCloudProvisionCommands" },
+    { type: "registrar", root: "cloud", parent: "cloud", module: "./commands/cloud-retire.js", exportName: "registerCloudRetireCommands" },
     { type: "registrar", root: "cloud", parent: "cloud", module: "./commands/cloud-demote.js", exportName: "registerCloudDemoteCommands" },
     { type: "registrar", root: "team-sync", parent: "program", module: "./commands/team-sync.js", exportName: "registerTeamSyncCommand" },
     { type: "registrar", root: "login", parent: "program", module: "./commands/login.js", exportName: "registerLoginCommand" },

package/dist/commands/cloud-demote.js

@@ -160,8 +160,9 @@ export function registerCloudDemoteCommands(program) {
     demoteCmd
         .command("company")
         .description("Demote a cloud-backed company to local-only after the cloud entity " +
-        "has been soft-tombstoned in hq-console. Removes .hq/config.json, " +
-        "flips company.yaml `cloud: false`, and strips the manifest cloud refs.")
+        "has been soft-tombstoned (`hq cloud retire company` or hq-console). " +
+        "Removes .hq/config.json, flips company.yaml `cloud: false`, and " +
+        "strips the manifest cloud refs.")
         .argument("<slug>", "Company slug")
         .option("--hq-root <path>", `Local HQ tree root (default: ${DEFAULT_HQ_ROOT})`, DEFAULT_HQ_ROOT)
         .option("--vault-api-url <url>", `Vault API URL (default: ${DEFAULT_VAULT_API_URL})`, DEFAULT_VAULT_API_URL)

package/dist/commands/cloud-provision.d.ts

@@ -38,6 +38,8 @@ export interface VaultEntity {
     kmsKeyId?: string | null;
     status?: string;
     ownerUid?: string;
+    /** Set by hq-pro after a soft tombstone. Absent on live companies. */
+    deleted?: boolean;
 }
 /** Per-company `.hq/config.json` schema (matches AppBar `provision.rs::CompanyConfig`). */
 export interface CompanyConfig {
@@ -142,6 +144,15 @@ export interface VaultClient {
         name: string;
         ownerUid?: string;
     }): Promise<VaultEntity>;
+    /**
+     * Soft-tombstone a company (`DELETE /entity/{uid}`). Owner-only. Leaves the
+     * row, S3 bucket, KMS key, and memberships intact. Idempotent on an already
+     * deleted company. Used by `hq cloud retire company`.
+     */
+    softDeleteCompany(uid: string): Promise<{
+        deleted: true;
+        uid: string;
+    }>;
 }
 /** Custom error class so the CLI runner can map to exit codes. */
 export declare class ProvisionError extends Error {

package/dist/commands/cloud-provision.js

@@ -364,6 +364,31 @@ export function createDefaultVaultClient(apiUrl, accessToken) {
             }
             return data.entity;
         },
+        async softDeleteCompany(uid) {
+            const url = `${apiUrl.replace(/\/$/, "")}/entity/${encodeURIComponent(uid)}`;
+            const res = await fetch(url, { method: "DELETE", headers });
+            if (res.status === 403) {
+                const body = await safeBody(res);
+                throw new ProvisionError(2, `Refusing to retire '${uid}': only the company owner can soft-tombstone it. ${body}`);
+            }
+            if (res.status === 404) {
+                const body = await safeBody(res);
+                throw new ProvisionError(2, `Vault DELETE /entity/${uid} failed: not found — ${body}`);
+            }
+            if (res.status === 400) {
+                const body = await safeBody(res);
+                throw new ProvisionError(2, `Vault DELETE /entity/${uid} failed: ${res.status} ${res.statusText} — ${body}`);
+            }
+            if (!res.ok) {
+                const body = await safeBody(res);
+                throw new ProvisionError(1, `Vault DELETE /entity/${uid} failed: ${res.status} ${res.statusText} — ${body}`);
+            }
+            const data = (await res.json());
+            if (data.deleted !== true || typeof data.uid !== "string") {
+                throw new ProvisionError(1, `Vault DELETE /entity/${uid} returned ${res.status} with no deleted confirmation`);
+            }
+            return { deleted: true, uid: data.uid };
+        },
     };
 }
 async function safeBody(res) {

package/dist/commands/cloud-retire.d.ts

@@ -0,0 +1,51 @@
+/**
+ * `hq cloud retire company <slug>` — soft-tombstone a cloud company so
+ * `hq cloud demote company` can run without `--propagate-deletes`.
+ *
+ * Console equivalent: Settings → Delete company (`DELETE /entity/{uid}`).
+ * Owner-only. The entity row, S3 bucket, KMS key, and memberships stay;
+ * `/membership/me` stops listing the company. Local files are not touched —
+ * demote is the follow-up that flips the local tree back to local-only.
+ *
+ * Confirm step is on by default (`[y/N]`). `--yes` skips it for scripts.
+ * A non-TTY stdin without `--yes` refuses rather than hanging.
+ *
+ * Exit codes (mirrors cloud-provision / cloud-demote):
+ *   0 — success, already tombstoned, or the operator cancelled.
+ *   1 — vault HTTP failure (auth/network/5xx).
+ *   2 — validation (bad slug, no entity, not owner, missing confirm).
+ */
+import { Command } from "commander";
+import { type VaultClient } from "./cloud-provision.js";
+/** Final stdout JSON shape. */
+export interface RetireResult {
+    ok: boolean;
+    company_slug: string;
+    cloud_uid: string | null;
+    /** True when hq-pro already had deleted=true (no DELETE sent). */
+    already_deleted: boolean;
+    cancelled?: boolean;
+}
+export interface RetireCompanyOptions {
+    slug: string;
+    hqRoot: string;
+    vaultApiUrl: string;
+    /** Skip the interactive confirmation prompt. */
+    yes?: boolean;
+    vaultClient?: VaultClient;
+    resolveAccessToken?: () => Promise<string>;
+    confirm?: (question: string) => Promise<boolean>;
+    stdinIsTTY?: boolean;
+}
+export declare function defaultConfirm(question: string): Promise<boolean>;
+/**
+ * Read `companyUid` from `companies/<slug>/.hq/config.json` when the by-slug
+ * lookup misses (a tombstoned company is filtered from that route).
+ */
+export declare function readLocalCompanyUid(hqRoot: string, slug: string): string | null;
+export declare function retireCompany(options: RetireCompanyOptions): Promise<RetireResult>;
+/**
+ * Register `retire company <slug>` under the `cloud` command group.
+ */
+export declare function registerCloudRetireCommands(program: Command): void;
+//# sourceMappingURL=cloud-retire.d.ts.map

package/dist/commands/cloud-retire.js

@@ -0,0 +1,154 @@
+/**
+ * `hq cloud retire company <slug>` — soft-tombstone a cloud company so
+ * `hq cloud demote company` can run without `--propagate-deletes`.
+ *
+ * Console equivalent: Settings → Delete company (`DELETE /entity/{uid}`).
+ * Owner-only. The entity row, S3 bucket, KMS key, and memberships stay;
+ * `/membership/me` stops listing the company. Local files are not touched —
+ * demote is the follow-up that flips the local tree back to local-only.
+ *
+ * Confirm step is on by default (`[y/N]`). `--yes` skips it for scripts.
+ * A non-TTY stdin without `--yes` refuses rather than hanging.
+ *
+ * Exit codes (mirrors cloud-provision / cloud-demote):
+ *   0 — success, already tombstoned, or the operator cancelled.
+ *   1 — vault HTTP failure (auth/network/5xx).
+ *   2 — validation (bad slug, no entity, not owner, missing confirm).
+ */
+import * as fs from "node:fs";
+import * as readline from "node:readline";
+import chalk from "chalk";
+import { ProvisionError, companyConfigPath, createDefaultVaultClient, validateSlug, } from "./cloud-provision.js";
+import { DEFAULT_HQ_ROOT, DEFAULT_VAULT_API_URL, ensureCognitoToken, } from "../utils/cognito-session.js";
+export function defaultConfirm(question) {
+    const rl = readline.createInterface({
+        input: process.stdin,
+        output: process.stdout,
+    });
+    return new Promise((resolve) => {
+        rl.question(`${question} [y/N] `, (answer) => {
+            rl.close();
+            resolve(/^y(es)?$/i.test(answer.trim()));
+        });
+    });
+}
+/**
+ * Read `companyUid` from `companies/<slug>/.hq/config.json` when the by-slug
+ * lookup misses (a tombstoned company is filtered from that route).
+ */
+export function readLocalCompanyUid(hqRoot, slug) {
+    const cPath = companyConfigPath(hqRoot, slug);
+    if (!fs.existsSync(cPath))
+        return null;
+    try {
+        const parsed = JSON.parse(fs.readFileSync(cPath, "utf-8"));
+        return typeof parsed.companyUid === "string" && parsed.companyUid.length > 0
+            ? parsed.companyUid
+            : null;
+    }
+    catch {
+        return null;
+    }
+}
+export async function retireCompany(options) {
+    validateSlug(options.slug);
+    const accessToken = options.resolveAccessToken
+        ? await options.resolveAccessToken()
+        : await ensureCognitoToken();
+    const client = options.vaultClient ??
+        createDefaultVaultClient(options.vaultApiUrl, accessToken);
+    let entity;
+    try {
+        entity = await client.findCompanyBySlug(options.slug);
+    }
+    catch (err) {
+        if (err instanceof ProvisionError)
+            throw err;
+        throw new ProvisionError(1, `Vault GET by-slug failed: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    if (entity?.deleted === true) {
+        return {
+            ok: true,
+            company_slug: options.slug,
+            cloud_uid: entity.uid,
+            already_deleted: true,
+        };
+    }
+    const uid = entity?.uid ?? readLocalCompanyUid(options.hqRoot, options.slug);
+    if (!uid) {
+        throw new ProvisionError(2, `Refusing to retire '${options.slug}': no cloud entity found.`);
+    }
+    if (options.yes !== true) {
+        const tty = options.stdinIsTTY ?? process.stdin.isTTY === true;
+        if (!tty) {
+            throw new ProvisionError(2, `Refusing to retire '${options.slug}' without confirmation. Re-run with --yes.`);
+        }
+        const confirm = options.confirm ?? defaultConfirm;
+        const ok = await confirm(`Soft-tombstone cloud company '${options.slug}' (${uid})? ` +
+            `It will disappear from every member's picker. Vault files stay. ` +
+            `Then run: hq cloud demote company ${options.slug}`);
+        if (!ok) {
+            return {
+                ok: false,
+                company_slug: options.slug,
+                cloud_uid: uid,
+                already_deleted: false,
+                cancelled: true,
+            };
+        }
+    }
+    try {
+        await client.softDeleteCompany(uid);
+    }
+    catch (err) {
+        if (err instanceof ProvisionError)
+            throw err;
+        throw new ProvisionError(1, `Vault DELETE /entity/${uid} failed: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    return {
+        ok: true,
+        company_slug: options.slug,
+        cloud_uid: uid,
+        already_deleted: false,
+    };
+}
+/**
+ * Register `retire company <slug>` under the `cloud` command group.
+ */
+export function registerCloudRetireCommands(program) {
+    const retireCmd = program
+        .command("retire")
+        .description("Soft-tombstone a cloud-backed company (owner only)");
+    retireCmd
+        .command("company")
+        .description("Soft-tombstone a cloud company so `hq cloud demote company` can run. " +
+        "Does not delete vault files or local folders. Prompts unless --yes.")
+        .argument("<slug>", "Company slug")
+        .option("--hq-root <path>", `Local HQ tree root (default: ${DEFAULT_HQ_ROOT})`, DEFAULT_HQ_ROOT)
+        .option("--vault-api-url <url>", `Vault API URL (default: ${DEFAULT_VAULT_API_URL})`, DEFAULT_VAULT_API_URL)
+        .option("-y, --yes", "Skip the confirmation prompt (for scripts)")
+        .action(async (slug, options) => {
+        try {
+            const result = await retireCompany({
+                slug,
+                hqRoot: options.hqRoot,
+                vaultApiUrl: options.vaultApiUrl,
+                yes: options.yes,
+            });
+            process.stdout.write(JSON.stringify(result) + "\n");
+            if (result.cancelled) {
+                process.stderr.write(chalk.dim("[hq cloud retire] Cancelled — nothing was tombstoned.\n"));
+            }
+            process.exit(0);
+        }
+        catch (err) {
+            if (err instanceof ProvisionError) {
+                process.stderr.write(chalk.red(`[hq cloud retire] ${err.message}\n`));
+                process.exit(err.code);
+            }
+            process.stderr.write(chalk.red(`[hq cloud retire] Unexpected error: ${err instanceof Error ? err.message : String(err)}\n`));
+            process.exit(1);
+        }
+    });
+}
+//# sourceMappingURL=cloud-retire.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.121.1",
+  "version": "5.121.2",
   "description": "HQ by Indigo management CLI \u2014 modules and cloud sync",
   "main": "dist/index.js",
   "bin": {