@indigoai-us/hq-cli 5.312.2-beta.0 → 5.314.0

package/dist/commands/report.js

@@ -1,537 +0,0 @@
-/** `hq report` — safe channel-report lifecycle commands for bot runbooks. */
-import { snapshotReport } from "../lib/report-snapshot.js";
-import * as fs from "node:fs";
-import * as os from "node:os";
-import * as path from "node:path";
-import { ensureCognitoToken, } from "../utils/cognito-session.js";
-import { vaultApiFetch } from "../utils/vault-api.js";
-import { DEPLOY_API_URL, deployApiRequest, deployHeaders } from "../lib/deploy-api.js";
-import { listDeployApps } from "../lib/deploy-apps.js";
-import { listReportTemplates } from "../lib/report-templates.js";
-import { adoptReport, buildReportTarball, conventionReportDir, deployOrgContext, ReportPublishError, plainFailureReason, publishReport, } from "../lib/report-publish.js";
-const REPORT_CHANNEL_STATE_FILE = "report-channels.json";
-const MAX_REPORT_DISCOVERY_CHANNELS = 50;
-const JOB_EXECUTION_DISABLED_MESSAGE = "Scheduled jobs are turned off for this company. A company owner can turn them back on.";
-function reportPath(channelId, reportId) {
-    return `/v1/notify/channels/${encodeURIComponent(channelId)}/reports/${encodeURIComponent(reportId)}`;
-}
-function reportListPath(channelId) {
-    return `/v1/notify/channels/${encodeURIComponent(channelId)}/reports`;
-}
-function reportChannelStatePath() {
-    const stateDir = process.env.HQ_STATE_DIR?.trim() || path.join(os.homedir(), ".hq");
-    return path.join(stateDir, REPORT_CHANNEL_STATE_FILE);
-}
-function readReportChannelState() {
-    const file = reportChannelStatePath();
-    let raw;
-    try {
-        raw = fs.readFileSync(file, "utf8");
-    }
-    catch (error) {
-        if (error.code === "ENOENT") {
-            return { version: 1, channels: {} };
-        }
-        throw new ReportPublishError("Could not read the local report channel state.");
-    }
-    try {
-        const parsed = JSON.parse(raw);
-        if (parsed.version !== 1 || !parsed.channels || typeof parsed.channels !== "object")
-            throw new Error("invalid state");
-        const channels = Object.fromEntries(Object.entries(parsed.channels).filter((entry) => typeof entry[1] === "string" && entry[1].length > 0));
-        return { version: 1, channels };
-    }
-    catch {
-        throw new ReportPublishError("Could not read the local report channel state.");
-    }
-}
-function rememberReportChannel(reportId, channelId) {
-    const file = reportChannelStatePath();
-    const state = readReportChannelState();
-    state.channels[reportId] = channelId;
-    fs.mkdirSync(path.dirname(file), { recursive: true });
-    const temporary = `${file}.${process.pid}.${Date.now()}.tmp`;
-    try {
-        fs.writeFileSync(temporary, `${JSON.stringify(state, null, 2)}\n`, { encoding: "utf8", mode: 0o600 });
-        fs.renameSync(temporary, file);
-    }
-    finally {
-        if (fs.existsSync(temporary))
-            fs.rmSync(temporary, { force: true });
-    }
-}
-function rememberReportChannelAfterSuccess(report) {
-    try {
-        rememberReportChannel(report.reportId, report.channelId);
-    }
-    catch (error) {
-        const reason = error instanceof Error ? error.message : "local state write failed";
-        console.warn(`Report succeeded but local channel context was not saved: ${reason}`);
-    }
-}
-function locallyRecordedChannel(reportId) {
-    return readReportChannelState().channels[reportId];
-}
-function notFoundMessage(scannedChannels) {
-    const scope = scannedChannels >= MAX_REPORT_DISCOVERY_CHANNELS
-        ? `the first ${MAX_REPORT_DISCOVERY_CHANNELS} channels`
-        : `${scannedChannels} channel${scannedChannels === 1 ? "" : "s"}`;
-    return `Report not found. Pass --channel or set HQ_REPORT_CHANNEL_ID. Searched ${scope}.`;
-}
-function errorMessage(error) {
-    if (error instanceof ReportPublishError)
-        return plainFailureReason(error);
-    return "Report command failed. Check the report context and try again.";
-}
-function print(value, json) {
-    if (json)
-        console.log(JSON.stringify(value, null, 2));
-    else
-        console.log(typeof value === "string" ? value : JSON.stringify(value, null, 2));
-}
-async function listReportChannels(token) {
-    // scope=all: the default list is personal channels only, which hid every
-    // project and company channel a report can live on.
-    const channels = await vaultApiFetch({ token, path: "/v1/notify/channels?scope=all" });
-    if (!channels.ok)
-        throw new ReportPublishError("Could not resolve the report channel.", "source-invalid");
-    const listed = await channels.json();
-    return Array.isArray(listed.channels) ? listed.channels : [];
-}
-/** Any company-owned channel (company or project scope) can carry reports; personal channels cannot. */
-function isCompanyReportChannel(channel) {
-    if (channel.scope === "personal")
-        return false;
-    return channel.scope === "company" || channel.scope === "project" || Boolean(channel.companyUid);
-}
-function requireCompanyReportChannel(channels, channelId) {
-    const channel = channels.find((row) => row.channelId === channelId);
-    if (!channel)
-        throw new ReportPublishError("Report channel was not found in your channels.", "source-invalid");
-    if (!isCompanyReportChannel(channel))
-        throw new ReportPublishError("Channel reports require a company channel.", "source-invalid");
-}
-async function readReportInChannel(token, channelId, reportId) {
-    const res = await vaultApiFetch({ token, path: reportPath(channelId, reportId) });
-    if (!res.ok)
-        return undefined;
-    const body = await res.json();
-    if (!body.report)
-        throw new ReportPublishError("Report response was incomplete.");
-    return body.report;
-}
-/**
- * Records created before hq-pro stamped companyUid carry null. The channel the
- * caller can see knows its company, and publish needs it to pick the deploy
- * org, so fill it from there rather than failing every publish.
- */
-function withChannelCompany(report, channels) {
-    if (report.companyUid)
-        return report;
-    const companyUid = channels.find((row) => row.channelId === report.channelId)?.companyUid;
-    return companyUid ? { ...report, companyUid } : report;
-}
-/** Explicit context has priority; discovery is the authenticated fallback for normal CLI use. */
-export async function resolveReport(token, reportId, requestedChannelId) {
-    const explicit = requestedChannelId ?? process.env.HQ_REPORT_CHANNEL_ID;
-    const channels = await listReportChannels(token);
-    if (explicit) {
-        requireCompanyReportChannel(channels, explicit);
-        const res = await vaultApiFetch({ token, path: reportPath(explicit, reportId) });
-        if (!res.ok)
-            throw new ReportPublishError("Report was not found in the supplied channel context.", "source-invalid");
-        const body = await res.json();
-        if (!body.report)
-            throw new ReportPublishError("Report response was incomplete.");
-        return withChannelCompany(body.report, channels);
-    }
-    const recordedChannel = locallyRecordedChannel(reportId);
-    if (recordedChannel) {
-        requireCompanyReportChannel(channels, recordedChannel);
-        const recorded = await readReportInChannel(token, recordedChannel, reportId);
-        if (recorded)
-            return withChannelCompany(recorded, channels);
-    }
-    // The report API is intentionally channel-scoped. Discover only among the
-    // caller's existing channels, using list endpoints so missing reports never
-    // become one server-side 404 per channel.
-    let scannedChannels = 0;
-    for (const row of channels) {
-        if (!row.channelId)
-            continue;
-        if (!isCompanyReportChannel(row))
-            continue;
-        if (scannedChannels >= MAX_REPORT_DISCOVERY_CHANNELS)
-            break;
-        scannedChannels += 1;
-        const res = await vaultApiFetch({ token, path: reportListPath(row.channelId) });
-        if (!res.ok)
-            continue;
-        const body = await res.json();
-        const reports = Array.isArray(body.reports) ? body.reports : [];
-        const match = reports.find((report) => report.reportId === reportId);
-        if (match)
-            return withChannelCompany(match, channels);
-    }
-    throw new ReportPublishError(notFoundMessage(scannedChannels));
-}
-export async function patchReport(token, report, patch) {
-    if (!report.companyUid)
-        throw new ReportPublishError("Channel reports require a company channel.", "source-invalid");
-    const patchOnce = (current) => vaultApiFetch({
-        token,
-        path: reportPath(current.channelId, current.reportId),
-        method: "PATCH",
-        body: {
-            ...(typeof patch === "function" ? patch(current) : patch),
-            revision: current.revision,
-        },
-    });
-    let res = await patchOnce(report);
-    if (res.status === 409) {
-        const body = await res.json().catch(() => ({}));
-        if (body.error === "already-running")
-            throw new ReportPublishError("already running", "already-running");
-        if (body.error !== "revision-mismatch")
-            throw new ReportPublishError("Report changed while it was being updated.", "revision-conflict");
-        const latest = await readReportInChannel(token, report.channelId, report.reportId);
-        if (!latest)
-            throw new ReportPublishError("Could not reread the report after it changed.", "revision-conflict");
-        if (typeof patch !== "function") {
-            throw new ReportPublishError("Report changed while it was being updated; refresh and retry.", "revision-conflict");
-        }
-        res = await patchOnce(latest);
-        if (res.status === 409) {
-            const retryBody = await res.json().catch(() => ({}));
-            if (retryBody.error === "already-running")
-                throw new ReportPublishError("already running", "already-running");
-            throw new ReportPublishError("Report changed while it was being updated; refresh and retry.", "revision-conflict");
-        }
-    }
-    if (!res.ok)
-        throw new ReportPublishError("Could not update the report record.");
-    const body = await res.json();
-    if (!body.report)
-        throw new ReportPublishError("Report update response was incomplete.");
-    return body.report;
-}
-async function deployJson(token, route, method, body, extraHeaders = {}) {
-    let res;
-    try {
-        res = await deployApiRequest(token, route, method, body, extraHeaders);
-    }
-    catch {
-        throw new ReportPublishError("Could not reach hq-deploy.");
-    }
-    if (!res.ok) {
-        const failure = await res.json().catch(() => ({}));
-        if (failure?.error?.code === "SUBDOMAIN_DUPLICATE")
-            throw new SubdomainTakenError();
-        throw new ReportPublishError("hq-deploy rejected the report deployment.");
-    }
-    return await res.json();
-}
-/** hq-deploy refused the subdomain: another app, not visible to this caller, holds it. */
-class SubdomainTakenError extends ReportPublishError {
-    constructor() {
-        super("hq-deploy rejected the report deployment.");
-    }
-}
-/**
- * Subdomains to try, in order. The first is the report's own slug; the rest
- * are used only when an app the caller cannot see already holds it (for
- * example, one left by an earlier publish under a different account).
- */
-export function candidateSlugs(slug, attempts = 3) {
-    return [slug, ...Array.from({ length: attempts }, (_, i) => `${slug}-${i + 2}`)];
-}
-async function resolveCompanySlug(token, companyUid) {
-    const res = await vaultApiFetch({ token, path: `/entity/${encodeURIComponent(companyUid)}` });
-    if (!res.ok)
-        throw new ReportPublishError("Could not resolve the report's company for deploy.");
-    const body = await res.json();
-    const slug = body.entity?.slug;
-    if (!slug)
-        throw new ReportPublishError("Could not resolve the report's company for deploy.");
-    return slug;
-}
-async function orgFor(token, report) {
-    const slug = report.companyUid ? await resolveCompanySlug(token, report.companyUid) : undefined;
-    return deployOrgContext(report, slug);
-}
-export async function findOrCreateApp(token, slug, org) {
-    const apps = await listDeployApps((cursor) => {
-        const route = cursor ? `/api/apps?cursor=${encodeURIComponent(cursor)}` : "/api/apps";
-        return deployJson(token, route, "GET", undefined, org.headers);
-    });
-    const mine = (name) => apps.find((app) => !!app && typeof app === "object" && (app.subdomain === name || app.name === name));
-    let app;
-    for (const name of candidateSlugs(slug)) {
-        const existing = mine(name);
-        if (existing) {
-            app = existing;
-            break;
-        }
-        try {
-            app = await deployJson(token, "/api/apps", "POST", { name, type: "static" }, org.headers);
-            break;
-        }
-        catch (error) {
-            if (error instanceof SubdomainTakenError)
-                continue;
-            throw error;
-        }
-    }
-    if (!app)
-        throw new ReportPublishError("Every address for this report is taken on hq-deploy.");
-    const id = typeof app.id === "string" ? app.id : undefined;
-    const subdomain = typeof app.subdomain === "string" ? app.subdomain : undefined;
-    if (!id || !subdomain)
-        throw new ReportPublishError("hq-deploy returned an incomplete app record.");
-    return { id, subdomain };
-}
-async function deployReportStatic(token, input) {
-    const app = await findOrCreateApp(token, input.slug, input.org);
-    await deployJson(token, `/api/apps/${encodeURIComponent(app.id)}/access-policy`, "PUT", input.access, input.org.headers);
-    const tarball = buildReportTarball(input.files);
-    const deployment = await deployJson(token, "/api/deploys", "POST", {
-        appSlug: app.subdomain,
-        ...(input.org.org ? { org: input.org.org } : {}),
-        manifest: { files: [], size: tarball.sizeBytes, sha256: tarball.sha256 },
-    }, input.org.headers);
-    const deployId = typeof deployment.deployId === "string" ? deployment.deployId : undefined;
-    const presignedUrl = typeof deployment.presignedUrl === "string" ? deployment.presignedUrl : undefined;
-    if (!deployId || !presignedUrl)
-        throw new ReportPublishError("hq-deploy did not create an upload.");
-    let upload;
-    try {
-        upload = await fetch(presignedUrl, { method: "PUT", headers: { "Content-Type": "application/gzip" }, body: tarball.bytes });
-    }
-    catch {
-        throw new ReportPublishError("Report upload failed.");
-    }
-    if (!upload.ok)
-        throw new ReportPublishError("Report upload failed.");
-    const completed = await deployJson(token, `/api/deploys/${encodeURIComponent(deployId)}/complete`, "POST", { appSlug: app.subdomain }, input.org.headers);
-    const url = typeof completed.url === "string" ? completed.url : `https://${app.subdomain}.indigo-hq.com`;
-    return { appId: app.id, url, deployId };
-}
-async function publishWithOrg(token, report, directory, draft) {
-    const published = await publishReport(report, directory, draft, {
-        // The server echoes the stored record, whose companyUid may still be null
-        // on reports created before hq-pro stamped it. Keep the company resolved
-        // from the channel so the access policy and deploy org stay correct.
-        patch: async (current, patch) => {
-            const next = await patchReport(token, current, patch);
-            const companyUid = next.companyUid ?? current.companyUid ?? report.companyUid;
-            return companyUid ? { ...next, companyUid } : next;
-        },
-        deploy: async (input) => {
-            const org = await orgFor(token, report);
-            return deployReportStatic(token, { ...input, org });
-        },
-        now: () => new Date().toISOString(),
-        snapshot: (source) => snapshotReport(source),
-    });
-    rememberReportChannelAfterSuccess(published);
-    return published;
-}
-async function publishAction(reportId, options) {
-    const token = await ensureCognitoToken();
-    const report = await resolveReport(token, reportId, options.channel);
-    print(await publishWithOrg(token, report, options.dir, options.draft === true), options.json === true);
-}
-async function promoteAction(reportId, options) {
-    const token = await ensureCognitoToken();
-    const report = await resolveReport(token, reportId, options.channel);
-    const directory = options.dir?.trim() ? options.dir : conventionReportDir(reportId);
-    const published = await publishWithOrg(token, report, directory, false);
-    // A promotion makes the freshly deployed live page authoritative. Null clears
-    // the draft pointer; omitting the field would leave the old draft in place.
-    const updated = published.draft
-        ? await patchReport(token, published, { draft: null, state: "live" })
-        : published;
-    print(updated, options.json === true);
-}
-async function getAction(reportId, options) {
-    const report = await resolveReport(await ensureCognitoToken(), reportId, options.channel);
-    print(report, options.json === true);
-}
-async function discardDraftAction(reportId, options) {
-    const token = await ensureCognitoToken();
-    const report = await resolveReport(token, reportId, options.channel);
-    const org = await orgFor(token, report);
-    if (report.draft?.appId) {
-        const res = await fetch(`${DEPLOY_API_URL.replace(/\/+$/, "")}/api/apps/${encodeURIComponent(report.draft.appId)}`, {
-            method: "DELETE",
-            headers: deployHeaders(token, false, org.headers),
-        });
-        if (!res.ok && res.status !== 404)
-            throw new ReportPublishError("Could not remove the draft deployment.");
-    }
-    const updated = await patchReport(token, report, (current) => ({
-        draft: null,
-        state: current.url ? "live" : "draft-pending",
-    }));
-    print(updated, options.json === true);
-}
-async function accessAction(reportId, options) {
-    if (!["company", "selected", "password", "public"].includes(options.mode)) {
-        throw new ReportPublishError("Access mode must be company, selected, password, or public.");
-    }
-    if (options.mode === "password" && !options.password) {
-        throw new ReportPublishError("A password is required for password access mode.");
-    }
-    const token = await ensureCognitoToken();
-    const report = await resolveReport(token, reportId, options.channel);
-    const appId = report.deployAppId ?? report.draft?.appId;
-    if (!appId)
-        throw new ReportPublishError("Publish the report before changing its access policy.");
-    const companyUid = report.companyUid ?? "personal";
-    const policy = {
-        mode: options.mode,
-        companyUid,
-        users: options.mode === "selected" ? [{ id: report.createdBy }] : [],
-        groups: [],
-        ...(options.mode === "password" && options.password ? { password: options.password } : {}),
-    };
-    const org = await orgFor(token, report);
-    const result = await deployJson(token, `/api/apps/${encodeURIComponent(appId)}/access-policy`, "PUT", policy, org.headers);
-    print(result, options.json === true);
-}
-async function cancelOwnedJob(token, agentUid, jobId) {
-    const res = await vaultApiFetch({
-        token,
-        path: `/v1/agents/${encodeURIComponent(agentUid)}/jobs/${encodeURIComponent(jobId)}/cancel`,
-        method: "POST",
-    });
-    if (!res.ok && res.status !== 404)
-        throw new ReportPublishError("Could not remove the report job.");
-}
-async function requireScheduledJobsEnabled(token, agentUid) {
-    let executionEnabled;
-    try {
-        const res = await vaultApiFetch({
-            token,
-            path: `/v1/agents/${encodeURIComponent(agentUid)}/jobs`,
-            method: "GET",
-        });
-        if (!res.ok) {
-            console.debug("Scheduled job preflight was unavailable; proceeding with job creation.", { status: res.status });
-            return;
-        }
-        const body = await res.json();
-        if (body && typeof body === "object" && !Array.isArray(body)) {
-            executionEnabled = body.executionEnabled;
-        }
-    }
-    catch (error) {
-        console.debug("Scheduled job preflight failed; proceeding with job creation.", error);
-        return;
-    }
-    if (executionEnabled === false) {
-        throw new ReportPublishError(JOB_EXECUTION_DISABLED_MESSAGE, "job-execution-disabled");
-    }
-    if (executionEnabled !== true) {
-        console.debug("Scheduled job preflight did not return a boolean executionEnabled; proceeding with job creation.");
-    }
-}
-async function adoptAction(reportId, options) {
-    const token = await ensureCognitoToken();
-    const report = await resolveReport(token, reportId, options.channel);
-    const updated = await adoptReport(report, {
-        preflightJobCreation: () => requireScheduledJobsEnabled(token, report.ownerAgentUid),
-        cancelJob: (jobId) => cancelOwnedJob(token, report.ownerAgentUid, jobId),
-        createJob: async (input) => {
-            const res = await vaultApiFetch({
-                token,
-                path: `/v1/agents/${encodeURIComponent(report.ownerAgentUid)}/jobs`,
-                method: "POST",
-                body: input,
-            });
-            if (!res.ok) {
-                if (res.status === 409) {
-                    let rejection;
-                    try {
-                        rejection = await res.json();
-                    }
-                    catch {
-                        // A non-JSON conflict response is still the generic install failure.
-                    }
-                    if (rejection?.code === "JOB_EXECUTION_DISABLED") {
-                        throw new ReportPublishError(JOB_EXECUTION_DISABLED_MESSAGE, "job-execution-disabled");
-                    }
-                }
-                throw new ReportPublishError("Could not install the report job.");
-            }
-            const body = await res.json();
-            const jobId = body.job?.jobId ?? body.jobId;
-            if (!jobId)
-                throw new ReportPublishError("Jobs API returned an incomplete job.");
-            return { jobId };
-        },
-        patch: (current, patch) => patchReport(token, current, patch),
-    });
-    rememberReportChannelAfterSuccess(updated);
-    print(updated, options.json === true);
-}
-async function decommissionAction(reportId, options) {
-    const token = await ensureCognitoToken();
-    const report = await resolveReport(token, reportId, options.channel);
-    const org = await orgFor(token, report);
-    const leftover = [];
-    for (const id of [report.deployAppId, report.draft?.appId]) {
-        if (!id)
-            continue;
-        try {
-            const res = await fetch(`${DEPLOY_API_URL.replace(/\/+$/, "")}/api/apps/${encodeURIComponent(id)}`, {
-                method: "DELETE",
-                headers: deployHeaders(token, false, org.headers),
-            });
-            if (res.status === 404)
-                leftover.push("The published page was already gone.");
-            else if (!res.ok)
-                leftover.push("A deployment could not be deactivated.");
-        }
-        catch {
-            leftover.push("A deployment could not be reached.");
-        }
-    }
-    // The durable report is marked decommissioned by hq-pro before this prompt.
-    // Cleanup gaps stay on the result so a missing app or offline bot does not roll the record back.
-    if (report.jobId) {
-        try {
-            await cancelOwnedJob(token, report.ownerAgentUid, report.jobId);
-        }
-        catch {
-            leftover.push("The report job is still installed.");
-        }
-    }
-    const note = leftover.length ? [...new Set(leftover)].join(" ") : null;
-    print({ reportId: report.reportId, decommissioned: true, note }, options.json === true);
-}
-export function registerReportCommand(program) {
-    const report = program.command("report").description("Publish and manage a channel report owned by this bot.");
-    const context = (command) => command.option("--channel <channelId>", "report channel context (or set HQ_REPORT_CHANNEL_ID)");
-    context(report.command("get <reportId>").option("--json").action((reportId, options) => runReportCommand(() => getAction(reportId, options))));
-    context(report.command("publish <reportId>").requiredOption("--dir <path>").option("--draft").option("--json").action((reportId, options) => runReportCommand(() => publishAction(reportId, options))));
-    context(report.command("promote <reportId>").option("--dir <path>", "report folder; defaults to <workerDir>/reports/<reportId>").option("--json").action((reportId, options) => runReportCommand(() => promoteAction(reportId, options))));
-    context(report.command("discard-draft <reportId>").option("--json").action((reportId, options) => runReportCommand(() => discardDraftAction(reportId, options))));
-    context(report.command("access <reportId>").requiredOption("--mode <mode>", "company|selected|password|public").option("--password <password>").option("--json").action((reportId, options) => runReportCommand(() => accessAction(reportId, options))));
-    context(report.command("decommission <reportId>").option("--json").action((reportId, options) => runReportCommand(() => decommissionAction(reportId, options))));
-    context(report.command("adopt <reportId>").option("--json").action((reportId, options) => runReportCommand(() => adoptAction(reportId, options))));
-    report.command("templates").option("--json").action((options) => {
-        const templates = listReportTemplates().map(({ name, path: templatePath }) => ({ name, path: templatePath }));
-        print(templates, options.json === true);
-    });
-}
-async function runReportCommand(action) {
-    try {
-        await action();
-    }
-    catch (error) {
-        console.error(errorMessage(error));
-        process.exitCode = 1;
-    }
-}
-//# sourceMappingURL=report.js.map

package/dist/commands/run-feature-telemetry.d.ts

@@ -1,3 +0,0 @@
-/** Attribute hq run's batch secret read to its resolved company UID. */
-export declare function withRunSecretReadTelemetry<T>(companyUid: string, action: () => Promise<T>): Promise<T>;
-//# sourceMappingURL=run-feature-telemetry.d.ts.map

package/dist/commands/run-feature-telemetry.js

@@ -1,6 +0,0 @@
-import { withCliFeatureUsed } from '../utils/cli-telemetry.js';
-/** Attribute hq run's batch secret read to its resolved company UID. */
-export function withRunSecretReadTelemetry(companyUid, action) {
-    return withCliFeatureUsed('secret_read', action, companyUid);
-}
-//# sourceMappingURL=run-feature-telemetry.js.map

package/dist/commands/staff/reset-test-account.d.ts

@@ -1,110 +0,0 @@
-import { Command } from "commander";
-/**
- * `hq staff reset-test-account <email>` — onboarding-test-accounts US-007.
- *
- * Thin CLI wrapper over `POST /v1/admin/test-account/reset` (US-003 dry-run +
- * US-006 execute). Server owns every safety gate; this file owns two operator
- * ergonomics the wire cannot: (1) a LOCAL staff-email preflight so a non-staff
- * caller stops here instead of paying a round trip for the same 403, and (2)
- * the typed-email confirmation prompt for `--execute`, whose value is what the
- * server matches against `plan.target.normalizedEmail` via `confirmEmailMatches`.
- *
- * OQ-003 recommendation: this ships as a subcommand of the existing hq CLI
- * (`hq staff …`) rather than a separate `hq-staff` binary — reuses auth,
- * distribution, and telemetry with zero new plumbing.
- */
-interface PlanCognitoUser {
-    username: string;
-    sub: string;
-    provider: string;
-    email: string;
-}
-interface PlanCompany {
-    uid: string;
-    slug: string;
-    memberCount: number;
-}
-interface Plan {
-    target: {
-        input: string;
-        normalizedEmail: string;
-    };
-    personUid: string | null;
-    cognitoUsers: PlanCognitoUser[];
-    ownedCompanies: PlanCompany[];
-    personalVault: {
-        bucketName: string | null;
-        kmsKeyAlias: string | null;
-    };
-    stripe: {
-        customerIds: string[];
-        subscriptionState: unknown | null;
-    };
-    welcomeSeries: {
-        present: boolean;
-    };
-    workMesh: {
-        eventCount: number | null;
-        note?: string;
-    };
-}
-interface StepOutcome {
-    ok: boolean;
-    skipped?: boolean;
-    reason?: string;
-    error?: string;
-}
-interface ExecuteResult {
-    ok: boolean;
-    steps: Record<string, StepOutcome & Record<string, unknown>>;
-    counts: {
-        stripeDeleted: number;
-        welcomeDeleted: number;
-        rawTelemetryDeleted: number | null;
-        workMeshDeleted: number | null;
-        membershipsDeleted: number;
-        companiesPurged: number;
-        entitiesPurged: number;
-        cognitoDeleted: number;
-        kms: string;
-        invitesDeleted: number;
-    };
-}
-/**
- * Same predicate the server's admin gate applies at the FIRST layer
- * (`isStaffEmail` in the vault-service admin handler). Duplicated here so a
- * non-staff caller stops before the round trip; the server remains the
- * authorization boundary (this file could not enforce it if it wanted to).
- *
- * Exact suffix match. `foo@getindigo.ai.evil.test` and `bar@xgetindigo.ai`
- * do not qualify.
- */
-export declare function isStaffEmail(candidate: unknown): boolean;
-/** Pull the caller email out of a locally cached id_token. */
-export declare function callerEmailFromToken(token: string): string | undefined;
-export type ConfirmFn = (question: string) => Promise<string>;
-export interface RunResetTestAccountParams {
-    email: string;
-    execute: boolean;
-    /** Skip the typed-confirmation prompt on --execute (for scripts). */
-    yes?: boolean;
-}
-export interface RunResetTestAccountDeps {
-    prompt?: ConfirmFn;
-    /** Whether to treat this session as an interactive TTY. Defaults to `process.stdin.isTTY`. */
-    isTty?: boolean;
-}
-/**
- * Print a compact dry-run plan. Kept flat so the operator can eyeball what the
- * executor would touch without a JSON pretty-printer in the loop.
- */
-export declare function renderPlan(plan: Plan): string;
-/**
- * One-line-per-step summary of the executor's result. AC calls for "per-step
- * counts, ok/failed".
- */
-export declare function renderExecuteSummary(result: ExecuteResult): string;
-export declare function runResetTestAccount(params: RunResetTestAccountParams, deps?: RunResetTestAccountDeps): Promise<void>;
-export declare function registerResetTestAccountCommand(staff: Command, deps?: RunResetTestAccountDeps): Command;
-export {};
-//# sourceMappingURL=reset-test-account.d.ts.map