@indigoai-us/hq-cli 5.314.0 → 5.315.0

package/dist/commands/staff/reset-test-account.js

@@ -0,0 +1,268 @@
+import chalk from "chalk";
+import * as readline from "node:readline";
+import { ensureCognitoToken } from "../../utils/cognito-session.js";
+import { peekIdToken } from "../../utils/id-token.js";
+import { vaultApiFetch } from "../../utils/vault-api.js";
+// ── Local staff-email preflight ─────────────────────────────────────────────
+/**
+ * Same predicate the server's admin gate applies at the FIRST layer
+ * (`isStaffEmail` in the vault-service admin handler). Duplicated here so a
+ * non-staff caller stops before the round trip; the server remains the
+ * authorization boundary (this file could not enforce it if it wanted to).
+ *
+ * Exact suffix match. `foo@getindigo.ai.evil.test` and `bar@xgetindigo.ai`
+ * do not qualify.
+ */
+export function isStaffEmail(candidate) {
+    if (typeof candidate !== "string")
+        return false;
+    const parts = candidate.trim().toLowerCase().split("@");
+    if (parts.length !== 2 || parts[0].length === 0)
+        return false;
+    const domain = parts[1];
+    return domain === "getindigo.ai" || domain === "hqforwork.com";
+}
+/** Pull the caller email out of a locally cached id_token. */
+export function callerEmailFromToken(token) {
+    const claims = peekIdToken(token);
+    const email = claims.email;
+    return typeof email === "string" && email.trim().length > 0
+        ? email.trim()
+        : undefined;
+}
+/** Real readline prompt, used when stdin is a TTY. */
+function realPrompt(question) {
+    const rl = readline.createInterface({
+        input: process.stdin,
+        output: process.stdout,
+    });
+    return new Promise((resolve) => {
+        rl.question(question, (line) => {
+            rl.close();
+            resolve(line);
+        });
+    });
+}
+/**
+ * Print a compact dry-run plan. Kept flat so the operator can eyeball what the
+ * executor would touch without a JSON pretty-printer in the loop.
+ */
+export function renderPlan(plan) {
+    const lines = [];
+    lines.push(chalk.bold(`\nReset plan for ${plan.target.normalizedEmail}`));
+    if (plan.target.input !== plan.target.normalizedEmail) {
+        lines.push(chalk.dim(`  raw input:            ${plan.target.input}`));
+    }
+    lines.push(`  person uid:           ${plan.personUid ?? chalk.dim("(none)")}`);
+    lines.push("");
+    lines.push(chalk.bold("  Cognito users"));
+    if (plan.cognitoUsers.length === 0) {
+        lines.push(chalk.dim("    (none)"));
+    }
+    else {
+        for (const u of plan.cognitoUsers) {
+            lines.push(`    - ${u.username}  [${u.provider}]  ${u.email}`);
+        }
+    }
+    lines.push("");
+    lines.push(chalk.bold("  Owned companies"));
+    if (plan.ownedCompanies.length === 0) {
+        lines.push(chalk.dim("    (none)"));
+    }
+    else {
+        for (const c of plan.ownedCompanies) {
+            lines.push(`    - ${c.slug} (${c.uid})  members: ${c.memberCount}`);
+        }
+    }
+    lines.push("");
+    lines.push(chalk.bold("  Personal vault"));
+    lines.push(`    bucket:               ${plan.personalVault.bucketName ?? chalk.dim("(none)")}`);
+    lines.push(`    kms alias:            ${plan.personalVault.kmsKeyAlias ?? chalk.dim("(none)")}`);
+    lines.push("");
+    lines.push(chalk.bold("  Stripe"));
+    if (plan.stripe.customerIds.length === 0) {
+        lines.push(chalk.dim("    (no customer)"));
+    }
+    else {
+        for (const id of plan.stripe.customerIds) {
+            lines.push(`    - ${id}`);
+        }
+    }
+    if (plan.stripe.subscriptionState !== null && plan.stripe.subscriptionState !== undefined) {
+        lines.push(`    subscription:         ${JSON.stringify(plan.stripe.subscriptionState)}`);
+    }
+    lines.push("");
+    lines.push(chalk.bold("  Other"));
+    lines.push(`    welcome-series row:   ${plan.welcomeSeries.present ? "yes" : "no"}`);
+    const wm = plan.workMesh.eventCount === null
+        ? plan.workMesh.note
+            ? `not enumerated (${plan.workMesh.note})`
+            : "not enumerated"
+        : String(plan.workMesh.eventCount);
+    lines.push(`    work-mesh events:     ${wm}`);
+    return lines.join("\n");
+}
+/**
+ * One-line-per-step summary of the executor's result. AC calls for "per-step
+ * counts, ok/failed".
+ */
+export function renderExecuteSummary(result) {
+    const c = result.counts;
+    const s = result.steps;
+    const line = (label, step, count) => {
+        const flag = step.skipped
+            ? chalk.dim("skipped")
+            : step.ok
+                ? chalk.green("ok")
+                : chalk.red("failed");
+        const note = step.error ? `  ${chalk.red(step.error)}` : "";
+        return `  ${label.padEnd(20)}  ${flag.padEnd(10)}  ${String(count)}${note}`;
+    };
+    const overall = result.ok ? chalk.green("ok") : chalk.yellow("partial");
+    const rawTelemetry = c.rawTelemetryDeleted ?? "n/a";
+    const workMesh = c.workMeshDeleted ?? "n/a";
+    return [
+        "",
+        chalk.bold(`Reset result: ${overall}`),
+        line("stripe", s.stripe ?? { ok: true }, c.stripeDeleted),
+        line("welcome-series", s.welcomeSeries ?? { ok: true }, c.welcomeDeleted),
+        line("raw-telemetry", s.rawTelemetry ?? { ok: true }, rawTelemetry),
+        line("work-mesh", s.workMesh ?? { ok: true }, workMesh),
+        line("memberships", s.memberships ?? { ok: true }, c.membershipsDeleted),
+        line("companies", s.companies ?? { ok: true }, c.companiesPurged),
+        line("entities", s.entity ?? { ok: true }, c.entitiesPurged),
+        line("cognito", s.cognito ?? { ok: true }, c.cognitoDeleted),
+        line("kms (personal)", s.kms ?? { ok: true }, c.kms),
+        line("invites", s.invites ?? { ok: true }, c.invitesDeleted),
+    ].join("\n");
+}
+/** Read a JSON body, tolerant of an empty body (returns `{}`). */
+async function readBody(res) {
+    try {
+        return (await res.json());
+    }
+    catch {
+        return {};
+    }
+}
+function renderApiError(status, body) {
+    const code = typeof body.code === "string" ? body.code : undefined;
+    const message = typeof body.error === "string" ? body.error : `reset failed (${status})`;
+    const detail = body.details ? `  ${JSON.stringify(body.details)}` : "";
+    return code ? `${code}: ${message}${detail}` : `${message}${detail}`;
+}
+export async function runResetTestAccount(params, deps = {}) {
+    const email = params.email.trim();
+    if (email.length === 0) {
+        throw new Error("email argument is required");
+    }
+    const token = await ensureCognitoToken();
+    // LOCAL preflight — a non-staff caller's Cognito token cannot pass the
+    // server's admin gate anyway, so we surface the refusal immediately and
+    // avoid a round trip.
+    const callerEmail = callerEmailFromToken(token);
+    if (!callerEmail || !isStaffEmail(callerEmail)) {
+        throw new Error("reset-test-account requires a super-admin (staff) HQ session. " +
+            "Sign in with an @getindigo.ai account and retry.");
+    }
+    // Dry-run first. The AC calls out "Without --execute, runs dry-run and
+    // prints the plan" — so a bare invocation always ends here.
+    const dryRunRes = await vaultApiFetch({
+        token,
+        path: "/v1/admin/test-account/reset",
+        method: "POST",
+        body: { email, dryRun: true },
+    });
+    const dryRunBody = await readBody(dryRunRes);
+    if (!dryRunRes.ok) {
+        throw new Error(renderApiError(dryRunRes.status, dryRunBody));
+    }
+    const plan = dryRunBody.plan;
+    if (!plan) {
+        throw new Error("server did not return a plan for the dry-run request");
+    }
+    console.log(renderPlan(plan));
+    if (!params.execute) {
+        console.log(chalk.dim("\n(dry-run — no writes occurred. Pass --execute after reviewing.)"));
+        return;
+    }
+    // Execute path — require the operator to type the email back.
+    console.log(chalk.yellow(`\nThis will DELETE every artifact above for ${plan.target.normalizedEmail}.`));
+    let confirmEmail;
+    if (params.yes === true) {
+        // `--yes` is an explicit operator act. The server still requires a
+        // matching `confirmEmail`, so we supply the normalized target on the
+        // operator's behalf; the guard on the wire is unchanged.
+        confirmEmail = plan.target.normalizedEmail;
+        console.log(chalk.dim(`  (--yes: sending confirmEmail=${confirmEmail})`));
+    }
+    else {
+        const prompt = deps.prompt ?? realPrompt;
+        const isTty = deps.isTty ?? Boolean(process.stdin.isTTY);
+        if (!isTty && !params.yes) {
+            throw new Error("--execute needs an interactive terminal for the typed-email " +
+                "confirmation. Re-run in a TTY, or pass --yes to skip the prompt.");
+        }
+        const answer = await prompt(`Type the target email to confirm (${plan.target.normalizedEmail}): `);
+        confirmEmail = (answer ?? "").trim();
+        if (confirmEmail.length === 0) {
+            throw new Error("Aborted — no confirmation entered.");
+        }
+        // Local pre-check so the operator gets the friendlier message than the
+        // server's CONFIRM_EMAIL_MISMATCH. Server still enforces via
+        // confirmEmailMatches, so a stale local check cannot bypass the wire gate.
+        if (confirmEmail.toLowerCase() !== plan.target.normalizedEmail.toLowerCase()) {
+            throw new Error(`Aborted — the typed email (${confirmEmail}) does not match the ` +
+                `target (${plan.target.normalizedEmail}).`);
+        }
+    }
+    const executeRes = await vaultApiFetch({
+        token,
+        path: "/v1/admin/test-account/reset",
+        method: "POST",
+        body: { email, dryRun: false, confirmEmail },
+    });
+    const executeBody = await readBody(executeRes);
+    // The handler answers 200 (all-ok) and 207 (best-effort partial). Anything
+    // else is a refusal from a safety gate and should surface as an error.
+    if (executeRes.status !== 200 && executeRes.status !== 207) {
+        throw new Error(renderApiError(executeRes.status, executeBody));
+    }
+    const result = executeBody.result;
+    if (!result) {
+        throw new Error("server did not return an execute result");
+    }
+    console.log(renderExecuteSummary(result));
+    if (!result.ok) {
+        // Non-zero exit so a scripted caller can react. The summary line above
+        // already shows which step failed.
+        process.exitCode = 1;
+    }
+}
+// ── Commander wiring ────────────────────────────────────────────────────────
+function fail(err) {
+    console.error(chalk.red(err instanceof Error ? err.message : String(err)));
+    process.exit(1);
+}
+export function registerResetTestAccountCommand(staff, deps = {}) {
+    return staff
+        .command("reset-test-account")
+        .description("Reset a designated real-email test account (dry-run by default). " +
+        "Wraps POST /v1/admin/test-account/reset — super-admin only.")
+        .argument("<email>", "Designated test-account email (must be in the registry)")
+        .option("--execute", "Actually delete artifacts. Prompts for a typed-email confirmation.")
+        .option("-y, --yes", "Skip the typed-email confirmation prompt (still sends confirmEmail).")
+        .action(async (email, opts) => {
+        try {
+            await runResetTestAccount({
+                email,
+                execute: opts.execute === true,
+                yes: opts.yes === true,
+            }, deps);
+        }
+        catch (err) {
+            fail(err);
+        }
+    });
+}
+//# sourceMappingURL=reset-test-account.js.map

package/dist/commands/staff/test-account.d.ts

@@ -0,0 +1,51 @@
+import { Command } from "commander";
+/**
+ * `hq staff test-account {add|remove|list}` — onboarding-test-accounts US-007
+ * follow-up. Thin CLI wrappers over the vault-service registry routes:
+ *
+ *   POST   /v1/admin/test-account-registry            (add)
+ *   DELETE /v1/admin/test-account-registry/{emailB64} (remove)
+ *   GET    /v1/admin/test-account-registry            (list)
+ *
+ * The runbook now points staff at these commands instead of the previous
+ * hand-rolled `curl` + `~/.hq/cognito-tokens.json` pattern. Reusing
+ * `ensureCognitoToken` + `vaultApiFetch` means the id_token is never printed,
+ * never handed to the operator, and never lifted out of the CLI's secure state
+ * directory. The server owns every write; this file's local staff-email
+ * preflight only saves an already-refused round trip.
+ */
+interface RegistryEntry {
+    email: string;
+    addedBy: string;
+    addedAt: string;
+    note: string | null;
+    active: boolean;
+    removedBy?: string;
+    removedAt?: string;
+}
+/**
+ * Encode an email as the base64url path segment the DELETE route expects. The
+ * server decodes and normalizes (`decodeRegistryEmailKey` → `normalizeRegistryEmail`),
+ * so the operator can type `Bohemian.HW@gmail.com` and hit the same row as
+ * `bohemianhw@gmail.com`. Local encoding is a pure transform on the raw input;
+ * we never persist or print a locally normalized value.
+ */
+export declare function encodeEmailForPath(email: string): string;
+export declare function renderEntry(entry: RegistryEntry): string;
+export declare function renderList(entries: RegistryEntry[]): string;
+export interface RunAddParams {
+    email: string;
+    note?: string;
+}
+export declare function runAddTestAccount(params: RunAddParams): Promise<void>;
+export interface RunRemoveParams {
+    email: string;
+}
+export declare function runRemoveTestAccount(params: RunRemoveParams): Promise<void>;
+export interface RunListParams {
+    includeInactive?: boolean;
+}
+export declare function runListTestAccounts(params?: RunListParams): Promise<void>;
+export declare function registerTestAccountCommand(staff: Command): Command;
+export {};
+//# sourceMappingURL=test-account.d.ts.map

package/dist/commands/staff/test-account.js

@@ -0,0 +1,196 @@
+import chalk from "chalk";
+import { ensureCognitoToken } from "../../utils/cognito-session.js";
+import { vaultApiFetch } from "../../utils/vault-api.js";
+import { callerEmailFromToken, isStaffEmail } from "./reset-test-account.js";
+// ── URL-safe base64 encode for the DELETE path parameter ────────────────────
+/**
+ * Encode an email as the base64url path segment the DELETE route expects. The
+ * server decodes and normalizes (`decodeRegistryEmailKey` → `normalizeRegistryEmail`),
+ * so the operator can type `Bohemian.HW@gmail.com` and hit the same row as
+ * `bohemianhw@gmail.com`. Local encoding is a pure transform on the raw input;
+ * we never persist or print a locally normalized value.
+ */
+export function encodeEmailForPath(email) {
+    return Buffer.from(email.trim(), "utf8")
+        .toString("base64")
+        .replace(/\+/g, "-")
+        .replace(/\//g, "_")
+        .replace(/=+$/, "");
+}
+// ── Rendering ───────────────────────────────────────────────────────────────
+function renderEntryLine(entry) {
+    const flag = entry.active ? chalk.green("active") : chalk.dim("inactive");
+    const note = entry.note ? `  ${chalk.dim(entry.note)}` : "";
+    return `  ${entry.email.padEnd(40)}  ${flag}  added ${entry.addedAt} by ${entry.addedBy}${note}`;
+}
+export function renderEntry(entry) {
+    const lines = [];
+    lines.push(chalk.bold(`\nRegistry entry for ${entry.email}`));
+    lines.push(`  active:      ${entry.active ? chalk.green("yes") : chalk.dim("no")}`);
+    lines.push(`  added by:    ${entry.addedBy}`);
+    lines.push(`  added at:    ${entry.addedAt}`);
+    lines.push(`  note:        ${entry.note ?? chalk.dim("(none)")}`);
+    if (entry.removedBy !== undefined) {
+        lines.push(`  removed by:  ${entry.removedBy}`);
+    }
+    if (entry.removedAt !== undefined) {
+        lines.push(`  removed at:  ${entry.removedAt}`);
+    }
+    return lines.join("\n");
+}
+export function renderList(entries) {
+    if (entries.length === 0) {
+        return chalk.dim("\n(no registry entries)");
+    }
+    const lines = [];
+    lines.push(chalk.bold(`\nTest-account registry (${entries.length})`));
+    for (const entry of entries) {
+        lines.push(renderEntryLine(entry));
+    }
+    return lines.join("\n");
+}
+// ── Shared HTTP helpers ─────────────────────────────────────────────────────
+async function readBody(res) {
+    try {
+        return (await res.json());
+    }
+    catch {
+        return {};
+    }
+}
+function renderApiError(status, body) {
+    const code = typeof body.code === "string" ? body.code : undefined;
+    const message = typeof body.error === "string" ? body.error : `request failed (${status})`;
+    return code ? `${code}: ${message}` : message;
+}
+/**
+ * Same local preflight the reset command runs. Duplicated in shape (not code)
+ * so both commands surface the same message without a circular import; the
+ * server remains the authorization boundary.
+ */
+async function requireStaffToken() {
+    const token = await ensureCognitoToken();
+    const callerEmail = callerEmailFromToken(token);
+    if (!callerEmail || !isStaffEmail(callerEmail)) {
+        throw new Error("hq staff test-account requires a super-admin (staff) HQ session. " +
+            "Sign in with an @getindigo.ai account and retry.");
+    }
+    return token;
+}
+export async function runAddTestAccount(params) {
+    const email = params.email.trim();
+    if (email.length === 0) {
+        throw new Error("email argument is required");
+    }
+    const token = await requireStaffToken();
+    const body = { email };
+    if (params.note !== undefined)
+        body.note = params.note;
+    const res = await vaultApiFetch({
+        token,
+        path: "/v1/admin/test-account-registry",
+        method: "POST",
+        body,
+    });
+    const parsed = await readBody(res);
+    if (!res.ok) {
+        throw new Error(renderApiError(res.status, parsed));
+    }
+    const entry = parsed.entry;
+    if (!entry) {
+        throw new Error("server did not return the registry entry");
+    }
+    console.log(renderEntry(entry));
+    console.log(chalk.dim("\n(entry added — reset command will now accept this email.)"));
+}
+export async function runRemoveTestAccount(params) {
+    const email = params.email.trim();
+    if (email.length === 0) {
+        throw new Error("email argument is required");
+    }
+    const token = await requireStaffToken();
+    const emailB64 = encodeEmailForPath(email);
+    const res = await vaultApiFetch({
+        token,
+        path: `/v1/admin/test-account-registry/${emailB64}`,
+        method: "DELETE",
+    });
+    const parsed = await readBody(res);
+    if (!res.ok) {
+        throw new Error(renderApiError(res.status, parsed));
+    }
+    const entry = parsed.entry;
+    if (!entry) {
+        throw new Error("server did not return the registry entry");
+    }
+    console.log(renderEntry(entry));
+    console.log(chalk.dim("\n(entry soft-deleted — row stays with active: false.)"));
+}
+export async function runListTestAccounts(params = {}) {
+    const token = await requireStaffToken();
+    const res = await vaultApiFetch({
+        token,
+        path: "/v1/admin/test-account-registry",
+        method: "GET",
+        query: params.includeInactive ? { includeInactive: "true" } : undefined,
+    });
+    const parsed = await readBody(res);
+    if (!res.ok) {
+        throw new Error(renderApiError(res.status, parsed));
+    }
+    const entries = parsed.entries;
+    if (!Array.isArray(entries)) {
+        throw new Error("server did not return a list of entries");
+    }
+    console.log(renderList(entries));
+}
+// ── Commander wiring ────────────────────────────────────────────────────────
+function fail(err) {
+    console.error(chalk.red(err instanceof Error ? err.message : String(err)));
+    process.exit(1);
+}
+export function registerTestAccountCommand(staff) {
+    const group = staff
+        .command("test-account")
+        .description("Manage the designated test-account registry (super-admin only). " +
+        "Wraps /v1/admin/test-account-registry.");
+    group
+        .command("add")
+        .description("Add an email to the registry so `hq staff reset-test-account` will sweep it.")
+        .argument("<email>", "Designated test-account email")
+        .option("--note <text>", "Short reason recorded on the row")
+        .action(async (email, opts) => {
+        try {
+            await runAddTestAccount({ email, note: opts.note });
+        }
+        catch (err) {
+            fail(err);
+        }
+    });
+    group
+        .command("remove")
+        .description("Soft-delete a registry entry (row stays with active: false).")
+        .argument("<email>", "Registered test-account email")
+        .action(async (email) => {
+        try {
+            await runRemoveTestAccount({ email });
+        }
+        catch (err) {
+            fail(err);
+        }
+    });
+    group
+        .command("list")
+        .description("List active registry entries.")
+        .option("--include-inactive", "Also list soft-deleted rows (active: false).")
+        .action(async (opts) => {
+        try {
+            await runListTestAccounts({ includeInactive: opts.includeInactive === true });
+        }
+        catch (err) {
+            fail(err);
+        }
+    });
+    return group;
+}
+//# sourceMappingURL=test-account.js.map

package/dist/commands/sync-mode.d.ts

@@ -70,6 +70,15 @@ export interface SetSyncModeResult {
 export interface ShowSyncModesOptions {
     vaultClient: SyncModeVaultClient;
 }
+export interface GetSyncModeOptions {
+    companySlug: string;
+    vaultClient: SyncModeVaultClient;
+}
+export interface GetSyncModeResult {
+    membershipId: string;
+    companySlug: string;
+    config: MembershipSyncConfig;
+}
 export interface ShowSyncModesRow {
     companySlug: string;
     companyName?: string;
@@ -100,6 +109,8 @@ export declare function setSyncMode(options: SetSyncModeOptions): Promise<SetSyn
  * stable table output.
  */
 export declare function showSyncModes(options: ShowSyncModesOptions): Promise<ShowSyncModesRow[]>;
+/** Read one company's effective sync mode without hiding API read failures. */
+export declare function getSyncModeForCompany(options: GetSyncModeOptions): Promise<GetSyncModeResult>;
 /**
  * Render the `--show` table as plain text. No external dep — hq-cli doesn't
  * use cli-table3, so we hand-format columns to match the existing chalk +

package/dist/commands/sync-mode.js

@@ -163,6 +163,36 @@ export async function showSyncModes(options) {
     rows.sort((a, b) => a.companySlug.localeCompare(b.companySlug));
     return rows;
 }
+/** Read one company's effective sync mode without hiding API read failures. */
+export async function getSyncModeForCompany(options) {
+    const { companySlug, vaultClient } = options;
+    const memberships = await vaultClient.listMyMemberships();
+    const enriched = await Promise.all(memberships.map(async (membership) => {
+        try {
+            const entity = await vaultClient.entity.get(membership.companyUid);
+            return { ok: true, membership, slug: entity.slug };
+        }
+        catch (error) {
+            return { ok: false, membership, error };
+        }
+    }));
+    const match = enriched.find((row) => row.ok && row.slug === companySlug);
+    if (!match) {
+        const failedLookup = enriched.find((row) => !row.ok);
+        if (failedLookup && !failedLookup.ok)
+            throw failedLookup.error;
+        throw new Error(`No membership found for company '${companySlug}'.`);
+    }
+    for (const failedLookup of enriched) {
+        if (!failedLookup.ok) {
+            const detail = failedLookup.error instanceof Error ? failedLookup.error.message : String(failedLookup.error);
+            console.error(`getSyncModeForCompany: entity lookup failed for membership ${failedLookup.membership.membershipKey} while resolving '${companySlug}': ${detail}`);
+        }
+    }
+    const membershipId = match.membership.membershipKey;
+    const config = await vaultClient.getMembershipSyncConfig(membershipId);
+    return { membershipId, companySlug, config };
+}
 // ── Table rendering (used by CLI action, separable for tests) ──────────────
 /**
  * Render the `--show` table as plain text. No external dep — hq-cli doesn't

package/dist/commands/sync-narrow.js

@@ -103,6 +103,31 @@ export async function resolveNarrowTarget(input) {
         syncConfig,
     };
 }
+/**
+ * Normalize one ACL row for the local pull scope used by `sync narrow`.
+ *
+ * A trailing slash is a private-folder row, not a recursive read prefix. It
+ * lets its grantee create a new direct child, but existing children remain
+ * creator-only. Dropping that row from the prospective shared scope keeps the
+ * narrow plan from retaining private children merely because their parent
+ * happens to end in `/`. A creator's exact/child grant is still retained by
+ * the normal `grantPathToPrefix` path below.
+ */
+function narrowPrefixForGrant(grant, companySlug) {
+    let path = (grant.path ?? "").replace(/^\/+/, "");
+    const companyAnchor = `companies/${companySlug}/`;
+    const slugAnchor = `${companySlug}/`;
+    if (path.startsWith(companyAnchor)) {
+        path = path.slice(companyAnchor.length);
+    }
+    else if (path.startsWith(slugAnchor)) {
+        path = path.slice(slugAnchor.length);
+    }
+    if (path.length > 0 && path.endsWith("/") && !path.endsWith("/*")) {
+        return null;
+    }
+    return grantPathToPrefix(grant.path, companySlug);
+}
 /**
  * Compute the narrow plan for one company: fetch explicit grants, coalesce,
  * read the per-company journal, walk the local tree, classify.
@@ -118,11 +143,17 @@ export async function computeNarrowPlan(input) {
     // (grantPathToPrefix, hq-cloud ≥5.42.0): real grants are anchored
     // (`companies/<slug>/x/*`, `<slug>/x/*`) and glob-style (`x/*`, bare `*`),
     // none of which startsWith-match the company-relative local-tree keys
-    // buildNarrowPlan emits. A wildcard grant normalizes to "" (everything);
-    // coalescePrefixes drops empties, so guard it explicitly to `[""]` (which
-    // isCoveredByAny treats as covering everything → nothing orphaned) rather
-    // than letting it collapse to "nothing" and propose deleting the tree.
-    const normalizedPrefixes = grants.map((g) => grantPathToPrefix(g.path, companySlug));
+    // buildNarrowPlan emits. Private-folder rows (`x/`) are deliberately
+    // excluded: they do not grant read/list access to existing children, so
+    // treating them as recursive prefixes would leave private files on disk
+    // after an all → shared migration. A wildcard grant normalizes to ""
+    // (everything); coalescePrefixes drops empties, so guard it explicitly to
+    // `[""]` (which isCoveredByAny treats as covering everything → nothing
+    // orphaned) rather than letting it collapse to "nothing" and propose
+    // deleting the tree.
+    const normalizedPrefixes = grants
+        .map((g) => narrowPrefixForGrant(g, companySlug))
+        .filter((p) => p !== null);
     const prospectivePrefixSet = normalizedPrefixes.some((p) => p === "")
         ? [""]
         : coalescePrefixes(normalizedPrefixes);