@indigoai-us/hq-cli 5.121.1 → 5.122.0

package/CHANGELOG.md

@@ -2,6 +2,40 @@
 
 ## [Unreleased]
 
+### Fixed
+
+- Work Mesh now keeps the company you selected when its session context is
+  acknowledged or recovered after a restart. Mesh activity stays attached to
+  the right company instead of being held for missing attribution.
+
+## [5.122.0] — 2026-09-18
+
+### Added
+
+- A bot can now join HQ from the computer its owner already uses. Before,
+  `hq agent enroll` refused on such a machine — the owner is signed in there,
+  and an agent identity must not share a host account with a person's login —
+  which left two bad options: a second user account, or `--replace`.
+
+  Enrollment now moves the bot into its own directory instead of refusing:
+  `~/.hq-agent/<name>/`, with its own credentials, key, state and logs. The
+  owner's session file is never read, moved, or changed. `hq agent probe`,
+  `hq agent kit`, `hq agent inbox` and `hq agent mcp` all find that directory
+  on their own, so the bot is itself without anyone exporting environment
+  variables. Use `--name <bot>` to choose the directory, or to run a second
+  bot on the same computer.
+
+  Two or more local bots are deliberately ambiguous: `hq agent` commands then
+  ask for `HQ_AGENT_DIR` rather than guessing which identity to act as.
+
+## [5.121.2] — 2026-09-18
+
+### Added
+
+- `hq cloud retire company <slug>` soft-tombstones a cloud company (owner
+  only, confirm unless `--yes`) so `hq cloud demote company` can run without
+  `--propagate-deletes`. Vault files stay; local folders are not touched.
+
 ## [5.121.1] — 2026-09-18
 
 ### Fixed

package/dist/command-catalog.generated.d.ts

@@ -722,6 +722,37 @@ export declare const COMMAND_CATALOG: readonly [{
             }];
             readonly subcommands: readonly [];
         }];
+    }, {
+        readonly name: "retire";
+        readonly description: "Soft-tombstone a cloud-backed company (owner only)";
+        readonly aliases: readonly [];
+        readonly hidden: false;
+        readonly usage: "[options] [command]";
+        readonly arguments: readonly [];
+        readonly options: readonly [];
+        readonly subcommands: readonly [{
+            readonly name: "company";
+            readonly description: "Soft-tombstone a cloud company so `hq cloud demote company` can run. Does not delete vault files or local folders. Prompts unless --yes.";
+            readonly aliases: readonly [];
+            readonly hidden: false;
+            readonly usage: "[options] <slug>";
+            readonly arguments: readonly [{
+                readonly name: "slug";
+                readonly required: true;
+                readonly variadic: false;
+            }];
+            readonly options: readonly [{
+                readonly flags: "--hq-root <path>";
+                readonly description: "Local HQ tree root (default: <runtime-path>)";
+            }, {
+                readonly flags: "--vault-api-url <url>";
+                readonly description: "Vault API URL (default: https://hqapi.hq.computer)";
+            }, {
+                readonly flags: "-y, --yes";
+                readonly description: "Skip the confirmation prompt (for scripts)";
+            }];
+            readonly subcommands: readonly [];
+        }];
     }, {
         readonly name: "demote";
         readonly description: "Demote a cloud-backed entity back to local-only";
@@ -732,7 +763,7 @@ export declare const COMMAND_CATALOG: readonly [{
         readonly options: readonly [];
         readonly subcommands: readonly [{
             readonly name: "company";
-            readonly description: "Demote a cloud-backed company to local-only after the cloud entity has been soft-tombstoned in hq-console. Removes .hq/config.json, flips company.yaml `cloud: false`, and strips the manifest cloud refs.";
+            readonly description: "Demote a cloud-backed company to local-only after the cloud entity has been soft-tombstoned (`hq cloud retire company` or hq-console). Removes .hq/config.json, flips company.yaml `cloud: false`, and strips the manifest cloud refs.";
             readonly aliases: readonly [];
             readonly hidden: false;
             readonly usage: "[options] <slug>";
@@ -4240,6 +4271,9 @@ export declare const COMMAND_CATALOG: readonly [{
         }, {
             readonly flags: "--replace";
             readonly description: "Overwrite an existing machine identity on this host";
+        }, {
+            readonly flags: "--name <bot>";
+            readonly description: "Enroll into ~/.hq-agent/<bot>/ — for a bot sharing a computer with its owner";
         }, {
             readonly flags: "--api-base-url <url>";
             readonly description: "hq-pro control plane (default: HQ_VAULT_API_URL or production)";
@@ -5716,7 +5750,7 @@ export declare const COMMAND_CATALOG: readonly [{
                 readonly subcommands: readonly [];
             }, {
                 readonly name: "set";
-                readonly description: "Set the device default company slug (unlocked when migration is true for every membership)";
+                readonly description: "Set the device default company slug after verifying membership";
                 readonly aliases: readonly [];
                 readonly hidden: false;
                 readonly usage: "[options] <slug>";
@@ -5727,10 +5761,10 @@ export declare const COMMAND_CATALOG: readonly [{
                 }];
                 readonly options: readonly [{
                     readonly flags: "--allow-without-migration";
-                    readonly description: "Bypass DEFAULT_COMPANY_LOCKED with a warning";
+                    readonly description: "Deprecated compatibility no-op; selected-company membership is always verified";
                 }, {
                     readonly flags: "--company <slug|uid>";
-                    readonly description: "Deprecated no-op; unlock probes every active membership";
+                    readonly description: "Deprecated no-op; the selected company is verified directly";
                 }, {
                     readonly flags: "--json";
                     readonly description: "Print machine-readable JSON";

package/dist/command-catalog.generated.js

@@ -924,6 +924,46 @@ export const COMMAND_CATALOG = [
                     }
                 ]
             },
+            {
+                "name": "retire",
+                "description": "Soft-tombstone a cloud-backed company (owner only)",
+                "aliases": [],
+                "hidden": false,
+                "usage": "[options] [command]",
+                "arguments": [],
+                "options": [],
+                "subcommands": [
+                    {
+                        "name": "company",
+                        "description": "Soft-tombstone a cloud company so `hq cloud demote company` can run. Does not delete vault files or local folders. Prompts unless --yes.",
+                        "aliases": [],
+                        "hidden": false,
+                        "usage": "[options] <slug>",
+                        "arguments": [
+                            {
+                                "name": "slug",
+                                "required": true,
+                                "variadic": false
+                            }
+                        ],
+                        "options": [
+                            {
+                                "flags": "--hq-root <path>",
+                                "description": "Local HQ tree root (default: <runtime-path>)"
+                            },
+                            {
+                                "flags": "--vault-api-url <url>",
+                                "description": "Vault API URL (default: https://hqapi.hq.computer)"
+                            },
+                            {
+                                "flags": "-y, --yes",
+                                "description": "Skip the confirmation prompt (for scripts)"
+                            }
+                        ],
+                        "subcommands": []
+                    }
+                ]
+            },
             {
                 "name": "demote",
                 "description": "Demote a cloud-backed entity back to local-only",
@@ -935,7 +975,7 @@ export const COMMAND_CATALOG = [
                 "subcommands": [
                     {
                         "name": "company",
-                        "description": "Demote a cloud-backed company to local-only after the cloud entity has been soft-tombstoned in hq-console. Removes .hq/config.json, flips company.yaml `cloud: false`, and strips the manifest cloud refs.",
+                        "description": "Demote a cloud-backed company to local-only after the cloud entity has been soft-tombstoned (`hq cloud retire company` or hq-console). Removes .hq/config.json, flips company.yaml `cloud: false`, and strips the manifest cloud refs.",
                         "aliases": [],
                         "hidden": false,
                         "usage": "[options] <slug>",
@@ -5489,6 +5529,10 @@ export const COMMAND_CATALOG = [
                         "flags": "--replace",
                         "description": "Overwrite an existing machine identity on this host"
                     },
+                    {
+                        "flags": "--name <bot>",
+                        "description": "Enroll into ~/.hq-agent/<bot>/ — for a bot sharing a computer with its owner"
+                    },
                     {
                         "flags": "--api-base-url <url>",
                         "description": "hq-pro control plane (default: HQ_VAULT_API_URL or production)"
@@ -7374,7 +7418,7 @@ export const COMMAND_CATALOG = [
                             },
                             {
                                 "name": "set",
-                                "description": "Set the device default company slug (unlocked when migration is true for every membership)",
+                                "description": "Set the device default company slug after verifying membership",
                                 "aliases": [],
                                 "hidden": false,
                                 "usage": "[options] <slug>",
@@ -7388,11 +7432,11 @@ export const COMMAND_CATALOG = [
                                 "options": [
                                     {
                                         "flags": "--allow-without-migration",
-                                        "description": "Bypass DEFAULT_COMPANY_LOCKED with a warning"
+                                        "description": "Deprecated compatibility no-op; selected-company membership is always verified"
                                     },
                                     {
                                         "flags": "--company <slug|uid>",
-                                        "description": "Deprecated no-op; unlock probes every active membership"
+                                        "description": "Deprecated no-op; the selected company is verified directly"
                                     },
                                     {
                                         "flags": "--json",

package/dist/command-registration-plan.d.ts

@@ -141,6 +141,12 @@ export declare const REGISTRATION_PLAN: readonly [{
     readonly parent: "cloud";
     readonly module: "./commands/cloud-provision.js";
     readonly exportName: "registerCloudProvisionCommands";
+}, {
+    readonly type: "registrar";
+    readonly root: "cloud";
+    readonly parent: "cloud";
+    readonly module: "./commands/cloud-retire.js";
+    readonly exportName: "registerCloudRetireCommands";
 }, {
     readonly type: "registrar";
     readonly root: "cloud";

package/dist/command-registration-plan.js

@@ -26,6 +26,7 @@ export const REGISTRATION_PLAN = [
     { type: "registrar", root: "sync", parent: "sync", module: "./commands/sync-manifest.js", exportName: "registerSyncManifestCommand" },
     { type: "group", root: "cloud", id: "cloud", name: "cloud", description: "Cloud commands — provision entities and manage cloud-backed companies" },
     { type: "registrar", root: "cloud", parent: "cloud", module: "./commands/cloud-provision.js", exportName: "registerCloudProvisionCommands" },
+    { type: "registrar", root: "cloud", parent: "cloud", module: "./commands/cloud-retire.js", exportName: "registerCloudRetireCommands" },
     { type: "registrar", root: "cloud", parent: "cloud", module: "./commands/cloud-demote.js", exportName: "registerCloudDemoteCommands" },
     { type: "registrar", root: "team-sync", parent: "program", module: "./commands/team-sync.js", exportName: "registerTeamSyncCommand" },
     { type: "registrar", root: "login", parent: "program", module: "./commands/login.js", exportName: "registerLoginCommand" },

package/dist/commands/agent-enroll.d.ts

@@ -88,7 +88,29 @@ export interface EnrollOptions {
     company?: string;
     replace?: boolean;
     apiBaseUrl?: string;
+    /** Enroll into `~/.hq-agent/<name>/` — a bot sharing a host with a person. */
+    name?: string;
 }
+/**
+ * Where this enrollment should write, given what already lives on the host.
+ *
+ * A bot that runs on its owner's own computer is the common case, not an
+ * error: the machine has the owner's HQ session, and the two identities have
+ * to coexist. So an unpinned enrollment onto such a host does NOT refuse and
+ * does NOT overwrite anything — it moves into `~/.hq-agent/<name>/`, its own
+ * tree with its own credentials, key, state and logs. The person's session
+ * file is neither read nor touched, and `hq agent …` finds the bot's tree on
+ * its own afterwards (see agentDir).
+ */
+export declare function resolveEnrollTarget(opts: {
+    name?: string;
+    replace?: boolean;
+}, env?: NodeJS.ProcessEnv, home?: string): {
+    paths: AgentKitPaths;
+    local: boolean;
+};
+/** Lowercase slug, so the directory name can never escape `~/.hq-agent`. */
+export declare function validateLocalAgentName(name: string): string;
 export interface EnrollResult {
     agentUid: string;
     companySlug: string;
@@ -98,6 +120,10 @@ export interface EnrollResult {
     hostKeyPath: string;
     /** Set when --company disagreed with the server's company. */
     companyMismatch?: string;
+    /** True when this enrolled beside a person's session in its own directory. */
+    local: boolean;
+    /** The tree this identity lives in. */
+    agentDir: string;
 }
 /** Pure-ish orchestration so tests can drive it without a TTY or network. */
 export declare function enrollHost(opts: EnrollOptions, deps?: EnrollDeps): Promise<EnrollResult>;

package/dist/commands/agent-enroll.js

@@ -22,7 +22,7 @@ import { DEFAULT_VAULT_API_URL, personTokenCacheFile, } from "../utils/cognito-s
 import { HQ_CLIENT_NAME } from "../utils/vault-api.js";
 import { networkTransportErrorCode } from "../utils/network-transport-error.js";
 import { generateHostKeyPair, machineCredsFileExists, readExternalMachineCreds, writeHostKeyPair, writeMachineCreds, } from "../lib/agent-kit/creds.js";
-import { agentKitPaths } from "../lib/agent-kit/paths.js";
+import { DEFAULT_LOCAL_AGENT_NAME, agentKitPaths, localAgentDir, } from "../lib/agent-kit/paths.js";
 export const ENROLL_PATH = "/v1/agents/enroll";
 /** Canonical code: un-grouped, uppercase (server hashes exactly this). */
 export function normalizeEnrollmentCode(raw) {
@@ -63,9 +63,14 @@ export function refusalMessage(existing) {
         case "none":
             return null;
         case "human":
+            // Reached only when a caller pins the tree (HQ_AGENT_DIR / --dir) at a
+            // home that would sit on top of a person's login. The unpinned path
+            // enrolls into a sibling directory instead of refusing — see
+            // resolveEnrollTarget.
             return (`A human HQ session exists at ${existing.file}. An agent identity must not ` +
-                `share a host account with a person's login. Run enrollment under a dedicated ` +
-                `user (or container), or pass --replace to enroll anyway — the human session ` +
+                `share a host account with a person's login. Enroll into a directory of its ` +
+                `own (drop HQ_AGENT_DIR and this happens automatically, or pass ` +
+                `--name <bot>), or pass --replace to enroll here anyway — the human session ` +
                 `file is left untouched and never read.`);
         case "machine":
             return (`This host already has a machine identity at ${existing.file}` +
@@ -169,10 +174,49 @@ function parseEnrollResponse(raw) {
         },
     };
 }
+/**
+ * Where this enrollment should write, given what already lives on the host.
+ *
+ * A bot that runs on its owner's own computer is the common case, not an
+ * error: the machine has the owner's HQ session, and the two identities have
+ * to coexist. So an unpinned enrollment onto such a host does NOT refuse and
+ * does NOT overwrite anything — it moves into `~/.hq-agent/<name>/`, its own
+ * tree with its own credentials, key, state and logs. The person's session
+ * file is neither read nor touched, and `hq agent …` finds the bot's tree on
+ * its own afterwards (see agentDir).
+ */
+export function resolveEnrollTarget(opts, env = process.env, home = os.homedir()) {
+    const pinned = Boolean(env.HQ_AGENT_DIR?.trim() || env.HQ_MACHINE_CREDS_FILE?.trim());
+    if (opts.name) {
+        const dir = localAgentDir(validateLocalAgentName(opts.name), home);
+        return { paths: agentKitPaths(home, { ...env, HQ_AGENT_DIR: dir }), local: true };
+    }
+    const base = agentKitPaths(home, env);
+    // A pinned tree is the caller's explicit choice; --replace is an explicit
+    // choice too. Neither gets silently redirected.
+    if (pinned || opts.replace)
+        return { paths: base, local: false };
+    if (detectExistingIdentity(base, env).kind !== "human") {
+        return { paths: base, local: false };
+    }
+    const dir = localAgentDir(DEFAULT_LOCAL_AGENT_NAME, home);
+    return { paths: agentKitPaths(home, { ...env, HQ_AGENT_DIR: dir }), local: true };
+}
+/** Lowercase slug, so the directory name can never escape `~/.hq-agent`. */
+export function validateLocalAgentName(name) {
+    const trimmed = (name ?? "").trim();
+    if (!/^[a-z0-9](?:[a-z0-9-]{0,38}[a-z0-9])?$/.test(trimmed) || trimmed.includes("--")) {
+        throw new EnrollError(`Invalid --name "${name}": use 1–40 lowercase letters, digits and single hyphens (e.g. "grokbot").`);
+    }
+    return trimmed;
+}
 /** Pure-ish orchestration so tests can drive it without a TTY or network. */
 export async function enrollHost(opts, deps = {}) {
     const env = deps.env ?? process.env;
-    const paths = deps.paths ?? agentKitPaths(os.homedir(), env);
+    const target = deps.paths
+        ? { paths: deps.paths, local: false }
+        : resolveEnrollTarget({ name: opts.name, replace: opts.replace }, env);
+    const paths = target.paths;
     const doFetch = deps.fetch ?? fetch;
     const apiBaseUrl = (opts.apiBaseUrl ?? env.HQ_VAULT_API_URL ?? DEFAULT_VAULT_API_URL).replace(/\/+$/, "");
     const code = normalizeEnrollmentCode(opts.code);
@@ -224,6 +268,8 @@ export async function enrollHost(opts, deps = {}) {
     };
     writeMachineCreds(paths, creds);
     return {
+        local: target.local,
+        agentDir: paths.agentDir,
         agentUid: parsed.agentUid,
         companySlug: parsed.companySlug,
         companyUid: parsed.companyUid,
@@ -241,6 +287,7 @@ export function registerAgentEnrollCommand(agent) {
         .description("Enroll this host as an external HQ agent using a one-time code")
         .option("--company <slug>", "Expected company slug (warns when the code belongs elsewhere)")
         .option("--replace", "Overwrite an existing machine identity on this host")
+        .option("--name <bot>", "Enroll into ~/.hq-agent/<bot>/ — for a bot sharing a computer with its owner")
         .option("--api-base-url <url>", "hq-pro control plane (default: HQ_VAULT_API_URL or production)")
         .action(async (code, opts) => {
         try {
@@ -249,8 +296,16 @@ export function registerAgentEnrollCommand(agent) {
                 company: opts.company,
                 replace: opts.replace,
                 apiBaseUrl: opts.apiBaseUrl,
+                name: opts.name,
             });
             console.log(chalk.green(`Enrolled as ${result.agentUid} in ${result.companySlug}.`));
+            if (result.local) {
+                // Say it plainly: this host belongs to a person, and the bot is a
+                // guest on it. Nothing of theirs was read, moved or overwritten.
+                console.log(chalk.dim(`  This computer already has a person signed in, so this agent lives in its own\n` +
+                    `  directory beside them: ${result.agentDir}. Their session was not read or changed.\n` +
+                    `  Every hq agent command finds this tree on its own — no environment to set.`));
+            }
             console.log(`  host fingerprint: ${result.hostFingerprint}`);
             console.log(`  credentials:      ${result.credsPath} (0600)`);
             console.log(`  host key:         ${result.hostKeyPath} (0600)`);
@@ -260,8 +315,10 @@ export function registerAgentEnrollCommand(agent) {
             }
             console.log("");
             console.log("Next:");
-            console.log("  hq whoami                # should report the agent identity");
-            console.log("  hq agent kit install     # sync, work-mesh, inbox and heartbeat services");
+            console.log(result.local
+                ? "  hq agent probe           # its first line reports this agent, not you"
+                : "  hq whoami                # should report the agent identity");
+            console.log("  hq agent kit install     # inbox poller and heartbeat services");
             console.log("  hq agent probe           # end-to-end check, reported to the console");
         }
         catch (err) {

package/dist/commands/agent.js

@@ -8,6 +8,9 @@
  *   hq agent mcp                  stdio MCP server for the bot framework
  *   hq agent inbox [done <id…>]   pending HQ messages / mark handled
  */
+import * as os from "node:os";
+import { adoptAgentIdentityEnv } from "../lib/agent-kit/adopt-identity.js";
+import { agentKitPaths } from "../lib/agent-kit/paths.js";
 import { registerAgentEnrollCommand } from "./agent-enroll.js";
 import { registerAgentInboxCommand } from "./agent-inbox.js";
 import { registerAgentKitCommand } from "./agent-kit.js";
@@ -16,7 +19,18 @@ import { registerAgentProbeCommand } from "./agent-probe.js";
 export function registerAgentCommand(program) {
     const agent = program
         .command("agent")
-        .description("Enroll and run this host as an external HQ agent");
+        .description("Enroll and run this host as an external HQ agent")
+        // A bot that shares a computer with its owner keeps its identity in its
+        // own directory. Publish that tree to the environment before any
+        // subcommand runs, so the CLI and hq-cloud both mint as the AGENT rather
+        // than falling back to the one fixed path — and, on a person's computer,
+        // to the person. Enroll is exempt: it is the command that decides where
+        // the tree goes.
+        .hook("preAction", (_thisCommand, actionCommand) => {
+        if (actionCommand.name() === "enroll")
+            return;
+        adoptAgentIdentityEnv(agentKitPaths(os.homedir(), process.env), process.env);
+    });
     registerAgentEnrollCommand(agent);
     registerAgentKitCommand(agent);
     registerAgentProbeCommand(agent);

package/dist/commands/cloud-demote.js

@@ -160,8 +160,9 @@ export function registerCloudDemoteCommands(program) {
     demoteCmd
         .command("company")
         .description("Demote a cloud-backed company to local-only after the cloud entity " +
-        "has been soft-tombstoned in hq-console. Removes .hq/config.json, " +
-        "flips company.yaml `cloud: false`, and strips the manifest cloud refs.")
+        "has been soft-tombstoned (`hq cloud retire company` or hq-console). " +
+        "Removes .hq/config.json, flips company.yaml `cloud: false`, and " +
+        "strips the manifest cloud refs.")
         .argument("<slug>", "Company slug")
         .option("--hq-root <path>", `Local HQ tree root (default: ${DEFAULT_HQ_ROOT})`, DEFAULT_HQ_ROOT)
         .option("--vault-api-url <url>", `Vault API URL (default: ${DEFAULT_VAULT_API_URL})`, DEFAULT_VAULT_API_URL)

package/dist/commands/cloud-provision.d.ts

@@ -38,6 +38,8 @@ export interface VaultEntity {
     kmsKeyId?: string | null;
     status?: string;
     ownerUid?: string;
+    /** Set by hq-pro after a soft tombstone. Absent on live companies. */
+    deleted?: boolean;
 }
 /** Per-company `.hq/config.json` schema (matches AppBar `provision.rs::CompanyConfig`). */
 export interface CompanyConfig {
@@ -142,6 +144,15 @@ export interface VaultClient {
         name: string;
         ownerUid?: string;
     }): Promise<VaultEntity>;
+    /**
+     * Soft-tombstone a company (`DELETE /entity/{uid}`). Owner-only. Leaves the
+     * row, S3 bucket, KMS key, and memberships intact. Idempotent on an already
+     * deleted company. Used by `hq cloud retire company`.
+     */
+    softDeleteCompany(uid: string): Promise<{
+        deleted: true;
+        uid: string;
+    }>;
 }
 /** Custom error class so the CLI runner can map to exit codes. */
 export declare class ProvisionError extends Error {

package/dist/commands/cloud-provision.js

@@ -364,6 +364,31 @@ export function createDefaultVaultClient(apiUrl, accessToken) {
             }
             return data.entity;
         },
+        async softDeleteCompany(uid) {
+            const url = `${apiUrl.replace(/\/$/, "")}/entity/${encodeURIComponent(uid)}`;
+            const res = await fetch(url, { method: "DELETE", headers });
+            if (res.status === 403) {
+                const body = await safeBody(res);
+                throw new ProvisionError(2, `Refusing to retire '${uid}': only the company owner can soft-tombstone it. ${body}`);
+            }
+            if (res.status === 404) {
+                const body = await safeBody(res);
+                throw new ProvisionError(2, `Vault DELETE /entity/${uid} failed: not found — ${body}`);
+            }
+            if (res.status === 400) {
+                const body = await safeBody(res);
+                throw new ProvisionError(2, `Vault DELETE /entity/${uid} failed: ${res.status} ${res.statusText} — ${body}`);
+            }
+            if (!res.ok) {
+                const body = await safeBody(res);
+                throw new ProvisionError(1, `Vault DELETE /entity/${uid} failed: ${res.status} ${res.statusText} — ${body}`);
+            }
+            const data = (await res.json());
+            if (data.deleted !== true || typeof data.uid !== "string") {
+                throw new ProvisionError(1, `Vault DELETE /entity/${uid} returned ${res.status} with no deleted confirmation`);
+            }
+            return { deleted: true, uid: data.uid };
+        },
     };
 }
 async function safeBody(res) {

package/dist/commands/cloud-retire.d.ts

@@ -0,0 +1,51 @@
+/**
+ * `hq cloud retire company <slug>` — soft-tombstone a cloud company so
+ * `hq cloud demote company` can run without `--propagate-deletes`.
+ *
+ * Console equivalent: Settings → Delete company (`DELETE /entity/{uid}`).
+ * Owner-only. The entity row, S3 bucket, KMS key, and memberships stay;
+ * `/membership/me` stops listing the company. Local files are not touched —
+ * demote is the follow-up that flips the local tree back to local-only.
+ *
+ * Confirm step is on by default (`[y/N]`). `--yes` skips it for scripts.
+ * A non-TTY stdin without `--yes` refuses rather than hanging.
+ *
+ * Exit codes (mirrors cloud-provision / cloud-demote):
+ *   0 — success, already tombstoned, or the operator cancelled.
+ *   1 — vault HTTP failure (auth/network/5xx).
+ *   2 — validation (bad slug, no entity, not owner, missing confirm).
+ */
+import { Command } from "commander";
+import { type VaultClient } from "./cloud-provision.js";
+/** Final stdout JSON shape. */
+export interface RetireResult {
+    ok: boolean;
+    company_slug: string;
+    cloud_uid: string | null;
+    /** True when hq-pro already had deleted=true (no DELETE sent). */
+    already_deleted: boolean;
+    cancelled?: boolean;
+}
+export interface RetireCompanyOptions {
+    slug: string;
+    hqRoot: string;
+    vaultApiUrl: string;
+    /** Skip the interactive confirmation prompt. */
+    yes?: boolean;
+    vaultClient?: VaultClient;
+    resolveAccessToken?: () => Promise<string>;
+    confirm?: (question: string) => Promise<boolean>;
+    stdinIsTTY?: boolean;
+}
+export declare function defaultConfirm(question: string): Promise<boolean>;
+/**
+ * Read `companyUid` from `companies/<slug>/.hq/config.json` when the by-slug
+ * lookup misses (a tombstoned company is filtered from that route).
+ */
+export declare function readLocalCompanyUid(hqRoot: string, slug: string): string | null;
+export declare function retireCompany(options: RetireCompanyOptions): Promise<RetireResult>;
+/**
+ * Register `retire company <slug>` under the `cloud` command group.
+ */
+export declare function registerCloudRetireCommands(program: Command): void;
+//# sourceMappingURL=cloud-retire.d.ts.map