@indigoai-us/hq-cli 5.225.0 → 5.227.0

package/dist/commands/staff/reset-test-account.d.ts

@@ -0,0 +1,110 @@
+import { Command } from "commander";
+/**
+ * `hq staff reset-test-account <email>` — onboarding-test-accounts US-007.
+ *
+ * Thin CLI wrapper over `POST /v1/admin/test-account/reset` (US-003 dry-run +
+ * US-006 execute). Server owns every safety gate; this file owns two operator
+ * ergonomics the wire cannot: (1) a LOCAL staff-email preflight so a non-staff
+ * caller stops here instead of paying a round trip for the same 403, and (2)
+ * the typed-email confirmation prompt for `--execute`, whose value is what the
+ * server matches against `plan.target.normalizedEmail` via `confirmEmailMatches`.
+ *
+ * OQ-003 recommendation: this ships as a subcommand of the existing hq CLI
+ * (`hq staff …`) rather than a separate `hq-staff` binary — reuses auth,
+ * distribution, and telemetry with zero new plumbing.
+ */
+interface PlanCognitoUser {
+    username: string;
+    sub: string;
+    provider: string;
+    email: string;
+}
+interface PlanCompany {
+    uid: string;
+    slug: string;
+    memberCount: number;
+}
+interface Plan {
+    target: {
+        input: string;
+        normalizedEmail: string;
+    };
+    personUid: string | null;
+    cognitoUsers: PlanCognitoUser[];
+    ownedCompanies: PlanCompany[];
+    personalVault: {
+        bucketName: string | null;
+        kmsKeyAlias: string | null;
+    };
+    stripe: {
+        customerIds: string[];
+        subscriptionState: unknown | null;
+    };
+    welcomeSeries: {
+        present: boolean;
+    };
+    workMesh: {
+        eventCount: number | null;
+        note?: string;
+    };
+}
+interface StepOutcome {
+    ok: boolean;
+    skipped?: boolean;
+    reason?: string;
+    error?: string;
+}
+interface ExecuteResult {
+    ok: boolean;
+    steps: Record<string, StepOutcome & Record<string, unknown>>;
+    counts: {
+        stripeDeleted: number;
+        welcomeDeleted: number;
+        rawTelemetryDeleted: number | null;
+        workMeshDeleted: number | null;
+        membershipsDeleted: number;
+        companiesPurged: number;
+        entitiesPurged: number;
+        cognitoDeleted: number;
+        kms: string;
+        invitesDeleted: number;
+    };
+}
+/**
+ * Same predicate the server's admin gate applies at the FIRST layer
+ * (`isStaffEmail` in the vault-service admin handler). Duplicated here so a
+ * non-staff caller stops before the round trip; the server remains the
+ * authorization boundary (this file could not enforce it if it wanted to).
+ *
+ * Exact suffix match. `foo@getindigo.ai.evil.test` and `bar@xgetindigo.ai`
+ * do not qualify.
+ */
+export declare function isStaffEmail(candidate: unknown): boolean;
+/** Pull the caller email out of a locally cached id_token. */
+export declare function callerEmailFromToken(token: string): string | undefined;
+export type ConfirmFn = (question: string) => Promise<string>;
+export interface RunResetTestAccountParams {
+    email: string;
+    execute: boolean;
+    /** Skip the typed-confirmation prompt on --execute (for scripts). */
+    yes?: boolean;
+}
+export interface RunResetTestAccountDeps {
+    prompt?: ConfirmFn;
+    /** Whether to treat this session as an interactive TTY. Defaults to `process.stdin.isTTY`. */
+    isTty?: boolean;
+}
+/**
+ * Print a compact dry-run plan. Kept flat so the operator can eyeball what the
+ * executor would touch without a JSON pretty-printer in the loop.
+ */
+export declare function renderPlan(plan: Plan): string;
+/**
+ * One-line-per-step summary of the executor's result. AC calls for "per-step
+ * counts, ok/failed".
+ */
+export declare function renderExecuteSummary(result: ExecuteResult): string;
+export declare function runResetTestAccount(params: RunResetTestAccountParams, deps?: RunResetTestAccountDeps): Promise<void>;
+export declare function registerResetTestAccountCommand(staff: Command, deps?: RunResetTestAccountDeps): Command;
+export {};
+//# sourceMappingURL=reset-test-account.d.ts.map

package/dist/commands/staff/reset-test-account.js

@@ -0,0 +1,268 @@
+import chalk from "chalk";
+import * as readline from "node:readline";
+import { ensureCognitoToken } from "../../utils/cognito-session.js";
+import { peekIdToken } from "../../utils/id-token.js";
+import { vaultApiFetch } from "../../utils/vault-api.js";
+// ── Local staff-email preflight ─────────────────────────────────────────────
+/**
+ * Same predicate the server's admin gate applies at the FIRST layer
+ * (`isStaffEmail` in the vault-service admin handler). Duplicated here so a
+ * non-staff caller stops before the round trip; the server remains the
+ * authorization boundary (this file could not enforce it if it wanted to).
+ *
+ * Exact suffix match. `foo@getindigo.ai.evil.test` and `bar@xgetindigo.ai`
+ * do not qualify.
+ */
+export function isStaffEmail(candidate) {
+    if (typeof candidate !== "string")
+        return false;
+    const parts = candidate.trim().toLowerCase().split("@");
+    if (parts.length !== 2 || parts[0].length === 0)
+        return false;
+    const domain = parts[1];
+    return domain === "getindigo.ai" || domain === "hqforwork.com";
+}
+/** Pull the caller email out of a locally cached id_token. */
+export function callerEmailFromToken(token) {
+    const claims = peekIdToken(token);
+    const email = claims.email;
+    return typeof email === "string" && email.trim().length > 0
+        ? email.trim()
+        : undefined;
+}
+/** Real readline prompt, used when stdin is a TTY. */
+function realPrompt(question) {
+    const rl = readline.createInterface({
+        input: process.stdin,
+        output: process.stdout,
+    });
+    return new Promise((resolve) => {
+        rl.question(question, (line) => {
+            rl.close();
+            resolve(line);
+        });
+    });
+}
+/**
+ * Print a compact dry-run plan. Kept flat so the operator can eyeball what the
+ * executor would touch without a JSON pretty-printer in the loop.
+ */
+export function renderPlan(plan) {
+    const lines = [];
+    lines.push(chalk.bold(`\nReset plan for ${plan.target.normalizedEmail}`));
+    if (plan.target.input !== plan.target.normalizedEmail) {
+        lines.push(chalk.dim(`  raw input:            ${plan.target.input}`));
+    }
+    lines.push(`  person uid:           ${plan.personUid ?? chalk.dim("(none)")}`);
+    lines.push("");
+    lines.push(chalk.bold("  Cognito users"));
+    if (plan.cognitoUsers.length === 0) {
+        lines.push(chalk.dim("    (none)"));
+    }
+    else {
+        for (const u of plan.cognitoUsers) {
+            lines.push(`    - ${u.username}  [${u.provider}]  ${u.email}`);
+        }
+    }
+    lines.push("");
+    lines.push(chalk.bold("  Owned companies"));
+    if (plan.ownedCompanies.length === 0) {
+        lines.push(chalk.dim("    (none)"));
+    }
+    else {
+        for (const c of plan.ownedCompanies) {
+            lines.push(`    - ${c.slug} (${c.uid})  members: ${c.memberCount}`);
+        }
+    }
+    lines.push("");
+    lines.push(chalk.bold("  Personal vault"));
+    lines.push(`    bucket:               ${plan.personalVault.bucketName ?? chalk.dim("(none)")}`);
+    lines.push(`    kms alias:            ${plan.personalVault.kmsKeyAlias ?? chalk.dim("(none)")}`);
+    lines.push("");
+    lines.push(chalk.bold("  Stripe"));
+    if (plan.stripe.customerIds.length === 0) {
+        lines.push(chalk.dim("    (no customer)"));
+    }
+    else {
+        for (const id of plan.stripe.customerIds) {
+            lines.push(`    - ${id}`);
+        }
+    }
+    if (plan.stripe.subscriptionState !== null && plan.stripe.subscriptionState !== undefined) {
+        lines.push(`    subscription:         ${JSON.stringify(plan.stripe.subscriptionState)}`);
+    }
+    lines.push("");
+    lines.push(chalk.bold("  Other"));
+    lines.push(`    welcome-series row:   ${plan.welcomeSeries.present ? "yes" : "no"}`);
+    const wm = plan.workMesh.eventCount === null
+        ? plan.workMesh.note
+            ? `not enumerated (${plan.workMesh.note})`
+            : "not enumerated"
+        : String(plan.workMesh.eventCount);
+    lines.push(`    work-mesh events:     ${wm}`);
+    return lines.join("\n");
+}
+/**
+ * One-line-per-step summary of the executor's result. AC calls for "per-step
+ * counts, ok/failed".
+ */
+export function renderExecuteSummary(result) {
+    const c = result.counts;
+    const s = result.steps;
+    const line = (label, step, count) => {
+        const flag = step.skipped
+            ? chalk.dim("skipped")
+            : step.ok
+                ? chalk.green("ok")
+                : chalk.red("failed");
+        const note = step.error ? `  ${chalk.red(step.error)}` : "";
+        return `  ${label.padEnd(20)}  ${flag.padEnd(10)}  ${String(count)}${note}`;
+    };
+    const overall = result.ok ? chalk.green("ok") : chalk.yellow("partial");
+    const rawTelemetry = c.rawTelemetryDeleted ?? "n/a";
+    const workMesh = c.workMeshDeleted ?? "n/a";
+    return [
+        "",
+        chalk.bold(`Reset result: ${overall}`),
+        line("stripe", s.stripe ?? { ok: true }, c.stripeDeleted),
+        line("welcome-series", s.welcomeSeries ?? { ok: true }, c.welcomeDeleted),
+        line("raw-telemetry", s.rawTelemetry ?? { ok: true }, rawTelemetry),
+        line("work-mesh", s.workMesh ?? { ok: true }, workMesh),
+        line("memberships", s.memberships ?? { ok: true }, c.membershipsDeleted),
+        line("companies", s.companies ?? { ok: true }, c.companiesPurged),
+        line("entities", s.entity ?? { ok: true }, c.entitiesPurged),
+        line("cognito", s.cognito ?? { ok: true }, c.cognitoDeleted),
+        line("kms (personal)", s.kms ?? { ok: true }, c.kms),
+        line("invites", s.invites ?? { ok: true }, c.invitesDeleted),
+    ].join("\n");
+}
+/** Read a JSON body, tolerant of an empty body (returns `{}`). */
+async function readBody(res) {
+    try {
+        return (await res.json());
+    }
+    catch {
+        return {};
+    }
+}
+function renderApiError(status, body) {
+    const code = typeof body.code === "string" ? body.code : undefined;
+    const message = typeof body.error === "string" ? body.error : `reset failed (${status})`;
+    const detail = body.details ? `  ${JSON.stringify(body.details)}` : "";
+    return code ? `${code}: ${message}${detail}` : `${message}${detail}`;
+}
+export async function runResetTestAccount(params, deps = {}) {
+    const email = params.email.trim();
+    if (email.length === 0) {
+        throw new Error("email argument is required");
+    }
+    const token = await ensureCognitoToken();
+    // LOCAL preflight — a non-staff caller's Cognito token cannot pass the
+    // server's admin gate anyway, so we surface the refusal immediately and
+    // avoid a round trip.
+    const callerEmail = callerEmailFromToken(token);
+    if (!callerEmail || !isStaffEmail(callerEmail)) {
+        throw new Error("reset-test-account requires a super-admin (staff) HQ session. " +
+            "Sign in with an @getindigo.ai account and retry.");
+    }
+    // Dry-run first. The AC calls out "Without --execute, runs dry-run and
+    // prints the plan" — so a bare invocation always ends here.
+    const dryRunRes = await vaultApiFetch({
+        token,
+        path: "/v1/admin/test-account/reset",
+        method: "POST",
+        body: { email, dryRun: true },
+    });
+    const dryRunBody = await readBody(dryRunRes);
+    if (!dryRunRes.ok) {
+        throw new Error(renderApiError(dryRunRes.status, dryRunBody));
+    }
+    const plan = dryRunBody.plan;
+    if (!plan) {
+        throw new Error("server did not return a plan for the dry-run request");
+    }
+    console.log(renderPlan(plan));
+    if (!params.execute) {
+        console.log(chalk.dim("\n(dry-run — no writes occurred. Pass --execute after reviewing.)"));
+        return;
+    }
+    // Execute path — require the operator to type the email back.
+    console.log(chalk.yellow(`\nThis will DELETE every artifact above for ${plan.target.normalizedEmail}.`));
+    let confirmEmail;
+    if (params.yes === true) {
+        // `--yes` is an explicit operator act. The server still requires a
+        // matching `confirmEmail`, so we supply the normalized target on the
+        // operator's behalf; the guard on the wire is unchanged.
+        confirmEmail = plan.target.normalizedEmail;
+        console.log(chalk.dim(`  (--yes: sending confirmEmail=${confirmEmail})`));
+    }
+    else {
+        const prompt = deps.prompt ?? realPrompt;
+        const isTty = deps.isTty ?? Boolean(process.stdin.isTTY);
+        if (!isTty && !params.yes) {
+            throw new Error("--execute needs an interactive terminal for the typed-email " +
+                "confirmation. Re-run in a TTY, or pass --yes to skip the prompt.");
+        }
+        const answer = await prompt(`Type the target email to confirm (${plan.target.normalizedEmail}): `);
+        confirmEmail = (answer ?? "").trim();
+        if (confirmEmail.length === 0) {
+            throw new Error("Aborted — no confirmation entered.");
+        }
+        // Local pre-check so the operator gets the friendlier message than the
+        // server's CONFIRM_EMAIL_MISMATCH. Server still enforces via
+        // confirmEmailMatches, so a stale local check cannot bypass the wire gate.
+        if (confirmEmail.toLowerCase() !== plan.target.normalizedEmail.toLowerCase()) {
+            throw new Error(`Aborted — the typed email (${confirmEmail}) does not match the ` +
+                `target (${plan.target.normalizedEmail}).`);
+        }
+    }
+    const executeRes = await vaultApiFetch({
+        token,
+        path: "/v1/admin/test-account/reset",
+        method: "POST",
+        body: { email, dryRun: false, confirmEmail },
+    });
+    const executeBody = await readBody(executeRes);
+    // The handler answers 200 (all-ok) and 207 (best-effort partial). Anything
+    // else is a refusal from a safety gate and should surface as an error.
+    if (executeRes.status !== 200 && executeRes.status !== 207) {
+        throw new Error(renderApiError(executeRes.status, executeBody));
+    }
+    const result = executeBody.result;
+    if (!result) {
+        throw new Error("server did not return an execute result");
+    }
+    console.log(renderExecuteSummary(result));
+    if (!result.ok) {
+        // Non-zero exit so a scripted caller can react. The summary line above
+        // already shows which step failed.
+        process.exitCode = 1;
+    }
+}
+// ── Commander wiring ────────────────────────────────────────────────────────
+function fail(err) {
+    console.error(chalk.red(err instanceof Error ? err.message : String(err)));
+    process.exit(1);
+}
+export function registerResetTestAccountCommand(staff, deps = {}) {
+    return staff
+        .command("reset-test-account")
+        .description("Reset a designated real-email test account (dry-run by default). " +
+        "Wraps POST /v1/admin/test-account/reset — super-admin only.")
+        .argument("<email>", "Designated test-account email (must be in the registry)")
+        .option("--execute", "Actually delete artifacts. Prompts for a typed-email confirmation.")
+        .option("-y, --yes", "Skip the typed-email confirmation prompt (still sends confirmEmail).")
+        .action(async (email, opts) => {
+        try {
+            await runResetTestAccount({
+                email,
+                execute: opts.execute === true,
+                yes: opts.yes === true,
+            }, deps);
+        }
+        catch (err) {
+            fail(err);
+        }
+    });
+}
+//# sourceMappingURL=reset-test-account.js.map

package/dist/commands/staff/test-account.d.ts

@@ -0,0 +1,51 @@
+import { Command } from "commander";
+/**
+ * `hq staff test-account {add|remove|list}` — onboarding-test-accounts US-007
+ * follow-up. Thin CLI wrappers over the vault-service registry routes:
+ *
+ *   POST   /v1/admin/test-account-registry            (add)
+ *   DELETE /v1/admin/test-account-registry/{emailB64} (remove)
+ *   GET    /v1/admin/test-account-registry            (list)
+ *
+ * The runbook now points staff at these commands instead of the previous
+ * hand-rolled `curl` + `~/.hq/cognito-tokens.json` pattern. Reusing
+ * `ensureCognitoToken` + `vaultApiFetch` means the id_token is never printed,
+ * never handed to the operator, and never lifted out of the CLI's secure state
+ * directory. The server owns every write; this file's local staff-email
+ * preflight only saves an already-refused round trip.
+ */
+interface RegistryEntry {
+    email: string;
+    addedBy: string;
+    addedAt: string;
+    note: string | null;
+    active: boolean;
+    removedBy?: string;
+    removedAt?: string;
+}
+/**
+ * Encode an email as the base64url path segment the DELETE route expects. The
+ * server decodes and normalizes (`decodeRegistryEmailKey` → `normalizeRegistryEmail`),
+ * so the operator can type `Bohemian.HW@gmail.com` and hit the same row as
+ * `bohemianhw@gmail.com`. Local encoding is a pure transform on the raw input;
+ * we never persist or print a locally normalized value.
+ */
+export declare function encodeEmailForPath(email: string): string;
+export declare function renderEntry(entry: RegistryEntry): string;
+export declare function renderList(entries: RegistryEntry[]): string;
+export interface RunAddParams {
+    email: string;
+    note?: string;
+}
+export declare function runAddTestAccount(params: RunAddParams): Promise<void>;
+export interface RunRemoveParams {
+    email: string;
+}
+export declare function runRemoveTestAccount(params: RunRemoveParams): Promise<void>;
+export interface RunListParams {
+    includeInactive?: boolean;
+}
+export declare function runListTestAccounts(params?: RunListParams): Promise<void>;
+export declare function registerTestAccountCommand(staff: Command): Command;
+export {};
+//# sourceMappingURL=test-account.d.ts.map

package/dist/commands/staff/test-account.js

@@ -0,0 +1,196 @@
+import chalk from "chalk";
+import { ensureCognitoToken } from "../../utils/cognito-session.js";
+import { vaultApiFetch } from "../../utils/vault-api.js";
+import { callerEmailFromToken, isStaffEmail } from "./reset-test-account.js";
+// ── URL-safe base64 encode for the DELETE path parameter ────────────────────
+/**
+ * Encode an email as the base64url path segment the DELETE route expects. The
+ * server decodes and normalizes (`decodeRegistryEmailKey` → `normalizeRegistryEmail`),
+ * so the operator can type `Bohemian.HW@gmail.com` and hit the same row as
+ * `bohemianhw@gmail.com`. Local encoding is a pure transform on the raw input;
+ * we never persist or print a locally normalized value.
+ */
+export function encodeEmailForPath(email) {
+    return Buffer.from(email.trim(), "utf8")
+        .toString("base64")
+        .replace(/\+/g, "-")
+        .replace(/\//g, "_")
+        .replace(/=+$/, "");
+}
+// ── Rendering ───────────────────────────────────────────────────────────────
+function renderEntryLine(entry) {
+    const flag = entry.active ? chalk.green("active") : chalk.dim("inactive");
+    const note = entry.note ? `  ${chalk.dim(entry.note)}` : "";
+    return `  ${entry.email.padEnd(40)}  ${flag}  added ${entry.addedAt} by ${entry.addedBy}${note}`;
+}
+export function renderEntry(entry) {
+    const lines = [];
+    lines.push(chalk.bold(`\nRegistry entry for ${entry.email}`));
+    lines.push(`  active:      ${entry.active ? chalk.green("yes") : chalk.dim("no")}`);
+    lines.push(`  added by:    ${entry.addedBy}`);
+    lines.push(`  added at:    ${entry.addedAt}`);
+    lines.push(`  note:        ${entry.note ?? chalk.dim("(none)")}`);
+    if (entry.removedBy !== undefined) {
+        lines.push(`  removed by:  ${entry.removedBy}`);
+    }
+    if (entry.removedAt !== undefined) {
+        lines.push(`  removed at:  ${entry.removedAt}`);
+    }
+    return lines.join("\n");
+}
+export function renderList(entries) {
+    if (entries.length === 0) {
+        return chalk.dim("\n(no registry entries)");
+    }
+    const lines = [];
+    lines.push(chalk.bold(`\nTest-account registry (${entries.length})`));
+    for (const entry of entries) {
+        lines.push(renderEntryLine(entry));
+    }
+    return lines.join("\n");
+}
+// ── Shared HTTP helpers ─────────────────────────────────────────────────────
+async function readBody(res) {
+    try {
+        return (await res.json());
+    }
+    catch {
+        return {};
+    }
+}
+function renderApiError(status, body) {
+    const code = typeof body.code === "string" ? body.code : undefined;
+    const message = typeof body.error === "string" ? body.error : `request failed (${status})`;
+    return code ? `${code}: ${message}` : message;
+}
+/**
+ * Same local preflight the reset command runs. Duplicated in shape (not code)
+ * so both commands surface the same message without a circular import; the
+ * server remains the authorization boundary.
+ */
+async function requireStaffToken() {
+    const token = await ensureCognitoToken();
+    const callerEmail = callerEmailFromToken(token);
+    if (!callerEmail || !isStaffEmail(callerEmail)) {
+        throw new Error("hq staff test-account requires a super-admin (staff) HQ session. " +
+            "Sign in with an @getindigo.ai account and retry.");
+    }
+    return token;
+}
+export async function runAddTestAccount(params) {
+    const email = params.email.trim();
+    if (email.length === 0) {
+        throw new Error("email argument is required");
+    }
+    const token = await requireStaffToken();
+    const body = { email };
+    if (params.note !== undefined)
+        body.note = params.note;
+    const res = await vaultApiFetch({
+        token,
+        path: "/v1/admin/test-account-registry",
+        method: "POST",
+        body,
+    });
+    const parsed = await readBody(res);
+    if (!res.ok) {
+        throw new Error(renderApiError(res.status, parsed));
+    }
+    const entry = parsed.entry;
+    if (!entry) {
+        throw new Error("server did not return the registry entry");
+    }
+    console.log(renderEntry(entry));
+    console.log(chalk.dim("\n(entry added — reset command will now accept this email.)"));
+}
+export async function runRemoveTestAccount(params) {
+    const email = params.email.trim();
+    if (email.length === 0) {
+        throw new Error("email argument is required");
+    }
+    const token = await requireStaffToken();
+    const emailB64 = encodeEmailForPath(email);
+    const res = await vaultApiFetch({
+        token,
+        path: `/v1/admin/test-account-registry/${emailB64}`,
+        method: "DELETE",
+    });
+    const parsed = await readBody(res);
+    if (!res.ok) {
+        throw new Error(renderApiError(res.status, parsed));
+    }
+    const entry = parsed.entry;
+    if (!entry) {
+        throw new Error("server did not return the registry entry");
+    }
+    console.log(renderEntry(entry));
+    console.log(chalk.dim("\n(entry soft-deleted — row stays with active: false.)"));
+}
+export async function runListTestAccounts(params = {}) {
+    const token = await requireStaffToken();
+    const res = await vaultApiFetch({
+        token,
+        path: "/v1/admin/test-account-registry",
+        method: "GET",
+        query: params.includeInactive ? { includeInactive: "true" } : undefined,
+    });
+    const parsed = await readBody(res);
+    if (!res.ok) {
+        throw new Error(renderApiError(res.status, parsed));
+    }
+    const entries = parsed.entries;
+    if (!Array.isArray(entries)) {
+        throw new Error("server did not return a list of entries");
+    }
+    console.log(renderList(entries));
+}
+// ── Commander wiring ────────────────────────────────────────────────────────
+function fail(err) {
+    console.error(chalk.red(err instanceof Error ? err.message : String(err)));
+    process.exit(1);
+}
+export function registerTestAccountCommand(staff) {
+    const group = staff
+        .command("test-account")
+        .description("Manage the designated test-account registry (super-admin only). " +
+        "Wraps /v1/admin/test-account-registry.");
+    group
+        .command("add")
+        .description("Add an email to the registry so `hq staff reset-test-account` will sweep it.")
+        .argument("<email>", "Designated test-account email")
+        .option("--note <text>", "Short reason recorded on the row")
+        .action(async (email, opts) => {
+        try {
+            await runAddTestAccount({ email, note: opts.note });
+        }
+        catch (err) {
+            fail(err);
+        }
+    });
+    group
+        .command("remove")
+        .description("Soft-delete a registry entry (row stays with active: false).")
+        .argument("<email>", "Registered test-account email")
+        .action(async (email) => {
+        try {
+            await runRemoveTestAccount({ email });
+        }
+        catch (err) {
+            fail(err);
+        }
+    });
+    group
+        .command("list")
+        .description("List active registry entries.")
+        .option("--include-inactive", "Also list soft-deleted rows (active: false).")
+        .action(async (opts) => {
+        try {
+            await runListTestAccounts({ includeInactive: opts.includeInactive === true });
+        }
+        catch (err) {
+            fail(err);
+        }
+    });
+    return group;
+}
+//# sourceMappingURL=test-account.js.map

package/dist/lib/checkpoint-ontology/plan.d.ts

@@ -11,7 +11,6 @@ import { type CompanyBriefResult } from "./company-brief.js";
 import { type OntologyCompany } from "./company.js";
 import { type MultiWriterStart } from "./multi-writer.js";
 export declare const ONTOLOGY_FLAG = "checkpoint.ontology";
-export declare const SHARED_INPUTS_FLAG = "checkpoint.ontology.shared-inputs";
 export declare const COMPANY_BRIEF_FLAG = "checkpoint.ontology.company-brief";
 /**
  * Applies only when the payload's sibling backend is grok. On gold-v2, Claude
@@ -43,7 +42,7 @@ export declare const BUDGET: {
     readonly maxTokens: 60000;
     readonly chunkTokens: 12000;
 };
-export type PendingReason = "session-touched" | "shared" | "first-run-gap" | "missing-refs";
+export type PendingReason = "session-touched";
 export interface LedgerEntry {
     sha256: string;
     size: number;
@@ -89,7 +88,6 @@ export interface OntologyPlan {
     created_at: string;
     first_run: boolean;
     boundary: string | null;
-    shared_inputs: boolean;
     /** Present only when `checkpoint.ontology.company-brief` was on for this plan. */
     company_brief?: {
         status: CompanyBriefResult["status"];
@@ -152,10 +150,10 @@ export declare function sessionTouched(hqRoot: string, company: OntologyCompany,
 export declare function chunkLines(content: string, chunkTokens: number): Array<[number, number]>;
 /**
  * Update the ledger with the current tree and return it. New or changed files
- * become pending when this machine should process them (design 14.1) and
- * seen otherwise. The first run seeds from the entity boundary (design 14.3).
+ * the session touched become pending; others are recorded as seen. The first
+ * run records the entity boundary (design 14.3).
  */
-export declare function refreshLedger(company: OntologyCompany, existing: Ledger | null, touched: Set<string>, sharedInputs: boolean): {
+export declare function refreshLedger(company: OntologyCompany, existing: Ledger | null, touched: Set<string>): {
     ledger: Ledger;
     firstRun: boolean;
 };