@indigoai-us/hq-cli 5.314.0 → 5.316.0

package/dist/commands/skill.d.ts

@@ -3,15 +3,22 @@
  *
  * `hq skill create <slug>` registers a canonical company skill, stamps its
  * immutable UID, surfaces its generated runtime wrapper, and syncs it.
+ * `hq skill register <slug>` reserves that UID from a proposal-lane source and
+ * writes server-stamped bytes only to `--stamped-output` — never under
+ * `companies/<company>/skills/`, and never as a discovery wrapper or sync.
+ * `hq skill promote <slug>` copies independently-cleared stamped bytes into the
+ * canonical tree only after the expected SHA-256 and registered skill_uid match.
  * `hq skill propose <uid|path> --message "…"` posts a whole-skill comment to
  * the same improvement thread shown in HQ Console. It never uploads a modified
- * SKILL.md and cannot overwrite live content. Structured suggest/list/review
- * commands intentionally are not registered.
+ * SKILL.md and cannot overwrite live content. `hq skill delete <target>` removes
+ * a skill and its files for the whole company (confirmation unless --yes).
+ * Structured suggest/list/review commands intentionally are not registered.
  */
 import { Command } from "commander";
 import { ensureCognitoToken } from "../utils/cognito-session.js";
-import { vaultApiFetch } from "../utils/vault-api.js";
+import { vaultApiFetch, getCompanyUid } from "../utils/vault-api.js";
 import { surfaceCompanySkill } from "../lib/company-skill-wrapper.js";
+import { type PlanLimitRefusalSummary } from "../lib/billing/plan-limit-refusals.js";
 export declare const SKILL_UID_PATTERN: RegExp;
 export declare const SKILL_SLUG_PATTERN: RegExp;
 interface SkillSyncInput {
@@ -24,6 +31,8 @@ interface SkillSyncResult {
     filesUploaded: number;
     filesSkipped: number;
     aborted: boolean;
+    /** Set when a plan limit refused the upload; absent or null otherwise. */
+    planLimit?: PlanLimitRefusalSummary | null;
 }
 export declare function parseSkillUid(markdown: string): string | undefined;
 export declare function readActiveCompanySlug(hqRoot: string): string | undefined;
@@ -38,7 +47,21 @@ export declare function makeSkillTemplate(input: {
     description?: string;
 }): string;
 /** Replace SKILL.md without exposing a partially-written identity to agents. */
-export declare function writeSkillFileAtomically(filePath: string, content: string): void;
+export declare function writeSkillFileAtomically(filePath: string, content: string | Buffer): void;
+export declare function sha256Hex(data: string | Buffer): string;
+export declare function skillVaultPath(skillSlug: string): string;
+export declare function isInsideCompanySkillsTree(hqRoot: string, candidatePath: string): boolean;
+export declare function resolveSkillMarkdownPath(target: string, cwd: string): string;
+export declare function assertStagedOutputPath(hqRoot: string, outputPath: string): string;
+export declare function assertSha256HexMatch(actualHex: string, expectedHex: string): void;
+export declare function assertRegisteredSkillResponse(registered: {
+    skillUid?: unknown;
+    content?: unknown;
+}): {
+    skillUid: string;
+    content: string;
+};
+export declare function normalizeLiveSkillVaultPath(rawPath: string): string;
 export declare function mapSkillError(status: number, body: Record<string, unknown>): string;
 /**
  * Type a failed skills-API response by its HTTP status so the top-level error
@@ -98,9 +121,17 @@ export declare function mapSkillError(status: number, body: Record<string, unkno
 export declare function skillApiError(status: number, body: Record<string, unknown>, opts?: {
     machineIdentity?: boolean;
 }): Error;
+export type SkillConfirmFn = (message: string) => Promise<boolean>;
+/**
+ * Resolve a delete target: a `skl_…` uid, a SKILL.md path or its directory, or
+ * a bare skill slug under `companies/<company>/skills/<slug>/`.
+ */
+export declare function resolveDeleteTarget(target: string, cwd: string, hqRoot: string, companySlug: string): string;
 interface SkillCommandDeps {
     ensureToken?: typeof ensureCognitoToken;
     apiFetch?: typeof vaultApiFetch;
+    confirm?: SkillConfirmFn;
+    resolveCompanyUid?: typeof getCompanyUid;
     cwd?: () => string;
     hqRoot?: string;
     syncFile?: (input: SkillSyncInput) => Promise<SkillSyncResult>;

package/dist/commands/skill.js

@@ -3,40 +3,71 @@
  *
  * `hq skill create <slug>` registers a canonical company skill, stamps its
  * immutable UID, surfaces its generated runtime wrapper, and syncs it.
+ * `hq skill register <slug>` reserves that UID from a proposal-lane source and
+ * writes server-stamped bytes only to `--stamped-output` — never under
+ * `companies/<company>/skills/`, and never as a discovery wrapper or sync.
+ * `hq skill promote <slug>` copies independently-cleared stamped bytes into the
+ * canonical tree only after the expected SHA-256 and registered skill_uid match.
  * `hq skill propose <uid|path> --message "…"` posts a whole-skill comment to
  * the same improvement thread shown in HQ Console. It never uploads a modified
- * SKILL.md and cannot overwrite live content. Structured suggest/list/review
- * commands intentionally are not registered.
+ * SKILL.md and cannot overwrite live content. `hq skill delete <target>` removes
+ * a skill and its files for the whole company (confirmation unless --yes).
+ * Structured suggest/list/review commands intentionally are not registered.
  */
 import * as fs from "node:fs";
 import * as path from "node:path";
+import { createHash, timingSafeEqual } from "node:crypto";
 import chalk from "chalk";
 import yaml from "js-yaml";
 import { share } from "@indigoai-us/hq-cloud";
 import { ensureCognitoToken, DEFAULT_HQ_ROOT, buildVaultConfig, isMachineIdentity, } from "../utils/cognito-session.js";
-import { vaultApiFetch } from "../utils/vault-api.js";
+import * as readline from "node:readline";
+import { vaultApiFetch, getCompanyUid } from "../utils/vault-api.js";
 import { surfaceCompanySkill } from "../lib/company-skill-wrapper.js";
 import { AuthError } from "../utils/auth-error.js";
 import { redactErrorText } from "../utils/redact-error-text.js";
 import { stampVaultAccessDenied, vaultAccessDeniedDiagnostics, } from "../utils/vault-access-denied-error.js";
+import { PlanGateError } from "../utils/plan-gate-error.js";
+import { createPlanLimitRefusalTracker, trackingProgressRecorder, } from "../lib/billing/plan-limit-refusals.js";
 export const SKILL_UID_PATTERN = /^skl_[A-Za-z0-9]+$/;
 export const SKILL_SLUG_PATTERN = /^[a-z0-9][a-z0-9-]*$/;
 const COMPANY_SLUG_PATTERN = /^[a-z0-9][a-z0-9-]*$/;
 const FRONTMATTER_RE = /^---\r?\n([\s\S]*?)\r?\n---(?:\r?\n|$)/;
+const SHA256_HEX_PATTERN = /^[0-9a-f]{64}$/;
 async function defaultSyncFile(input) {
+    // The runner reports a plan-limit refusal as an event, not a throw, and still
+    // returns normally. Track it so the command cannot claim "Sync: complete".
+    const tracker = createPlanLimitRefusalTracker({ companySlug: input.companySlug });
     const result = await share({
         paths: [input.filePath],
         company: input.companySlug,
         hqRoot: input.hqRoot,
         vaultConfig: buildVaultConfig(input.token),
         onConflict: "abort",
+        progressRecorder: trackingProgressRecorder(tracker, input.companySlug),
     });
     return {
         filesUploaded: result.filesUploaded,
         filesSkipped: result.filesSkipped,
         aborted: result.aborted,
+        planLimit: tracker.summary(),
     };
 }
+/**
+ * The upload of a stamped skill file was refused by a plan limit. Registration
+ * and the local stamp already succeeded, so say that on stderr, then return a
+ * typed plan gate for main.ts to render (reason and upgrade link) and exit
+ * non-zero. Never "Skill ready … Sync: complete".
+ */
+function skillUploadRefused(skillUid, filePath, companySlug, refused) {
+    console.warn(chalk.yellow(`⚠ Skill ${skillUid} is stamped locally at '${filePath}', but the upload was refused by your plan limit.`));
+    return new PlanGateError("PLAN_LIMIT_EXCEEDED", {
+        reason: `${refused.message ?? "New files are paused by your plan limit."} ` +
+            "The skill file was not uploaded. Once the limit is sorted, upload it with: " +
+            `hq sync push --company ${companySlug} '${filePath}'`,
+        ...(refused.upgradeUrl ? { upgradeUrl: refused.upgradeUrl } : {}),
+    });
+}
 export function parseSkillUid(markdown) {
     const match = markdown.match(FRONTMATTER_RE);
     if (!match)
@@ -183,11 +214,19 @@ export function writeSkillFileAtomically(filePath, content) {
         : 0o644;
     const tempPath = path.join(dir, `.SKILL.md.${process.pid}.${Date.now()}.tmp`);
     try {
-        fs.writeFileSync(tempPath, content, {
-            encoding: "utf8",
-            flag: "wx",
-            mode: existingMode,
-        });
+        if (typeof content === "string") {
+            fs.writeFileSync(tempPath, content, {
+                encoding: "utf8",
+                flag: "wx",
+                mode: existingMode,
+            });
+        }
+        else {
+            fs.writeFileSync(tempPath, content, {
+                flag: "wx",
+                mode: existingMode,
+            });
+        }
         fs.renameSync(tempPath, filePath);
     }
     finally {
@@ -195,6 +234,69 @@ export function writeSkillFileAtomically(filePath, content) {
             fs.rmSync(tempPath, { force: true });
     }
 }
+export function sha256Hex(data) {
+    return createHash("sha256").update(data).digest("hex");
+}
+export function skillVaultPath(skillSlug) {
+    return `skills/${skillSlug}/SKILL.md`;
+}
+export function isInsideCompanySkillsTree(hqRoot, candidatePath) {
+    const companiesRoot = path.resolve(hqRoot, "companies");
+    const resolved = path.resolve(candidatePath);
+    const rel = path.relative(companiesRoot, resolved);
+    if (rel === "" || rel.startsWith("..") || path.isAbsolute(rel))
+        return false;
+    const parts = rel.split(path.sep);
+    return parts.length >= 2 && parts[1] === "skills";
+}
+export function resolveSkillMarkdownPath(target, cwd) {
+    let filePath = path.resolve(cwd, target);
+    if (fs.existsSync(filePath) && fs.statSync(filePath).isDirectory()) {
+        filePath = path.join(filePath, "SKILL.md");
+    }
+    return filePath;
+}
+export function assertStagedOutputPath(hqRoot, outputPath) {
+    const resolved = path.resolve(outputPath);
+    if (isInsideCompanySkillsTree(hqRoot, resolved)) {
+        throw localSkillError(`Stamped output '${resolved}' is inside companies/<company>/skills/. Pass a proposal-lane path outside the canonical skill tree.`);
+    }
+    return resolved;
+}
+export function assertSha256HexMatch(actualHex, expectedHex) {
+    const want = expectedHex.trim().toLowerCase();
+    if (!SHA256_HEX_PATTERN.test(want)) {
+        throw localSkillError("--expected-sha256 must be a 64-character hex SHA-256 digest.");
+    }
+    const got = actualHex.trim().toLowerCase();
+    if (!SHA256_HEX_PATTERN.test(got)) {
+        throw localSkillError(`Stamped file SHA-256 ${got} does not match --expected-sha256. Canonical skill was not written.`);
+    }
+    if (!timingSafeEqual(Buffer.from(got, "hex"), Buffer.from(want, "hex"))) {
+        throw localSkillError(`Stamped file SHA-256 ${got} does not match --expected-sha256. Canonical skill was not written.`);
+    }
+}
+export function assertRegisteredSkillResponse(registered) {
+    if (typeof registered.skillUid !== "string" ||
+        !SKILL_UID_PATTERN.test(registered.skillUid) ||
+        typeof registered.content !== "string" ||
+        parseSkillUid(registered.content) !== registered.skillUid) {
+        throw new Error("The server returned an invalid skill registration response; the local file was not changed.");
+    }
+    return { skillUid: registered.skillUid, content: registered.content };
+}
+function skillRecordPath(record) {
+    for (const value of [record?.vaultPath, record?.sourcePath, record?.path]) {
+        if (typeof value === "string" && value.length > 0)
+            return value;
+    }
+    return undefined;
+}
+export function normalizeLiveSkillVaultPath(rawPath) {
+    const normalized = rawPath.replace(/\\/g, "/").replace(/^\/+/, "").replace(/\/+$/, "");
+    const match = normalized.match(/(?:^|\/)skills\/([a-z0-9][a-z0-9-]*)(?:\/SKILL\.md)?$/);
+    return match ? skillVaultPath(match[1]) : normalized;
+}
 export function mapSkillError(status, body) {
     const server = (typeof body.error === "string" && body.error) ||
         (typeof body.message === "string" && body.message) ||
@@ -322,6 +424,31 @@ export function skillApiError(status, body, opts = {}) {
     }
     return new Error(message);
 }
+function realConfirm(message) {
+    const rl = readline.createInterface({
+        input: process.stdin,
+        output: process.stdout,
+    });
+    return new Promise((resolve) => {
+        rl.question(`${message} [y/N] `, (answer) => {
+            rl.close();
+            resolve(/^y(es)?$/i.test(answer.trim()));
+        });
+    });
+}
+/**
+ * Resolve a delete target: a `skl_…` uid, a SKILL.md path or its directory, or
+ * a bare skill slug under `companies/<company>/skills/<slug>/`.
+ */
+export function resolveDeleteTarget(target, cwd, hqRoot, companySlug) {
+    if (SKILL_UID_PATTERN.test(target))
+        return target;
+    const asPath = path.resolve(cwd, target);
+    if (!fs.existsSync(asPath) && SKILL_SLUG_PATTERN.test(target)) {
+        return resolveSkillUid(canonicalCompanySkillPath(hqRoot, companySlug, target), cwd);
+    }
+    return resolveSkillUid(target, cwd);
+}
 export function registerSkillCommand(program, deps = {}) {
     const ensureToken = deps.ensureToken ?? ensureCognitoToken;
     const apiFetch = deps.apiFetch ?? vaultApiFetch;
@@ -329,9 +456,11 @@ export function registerSkillCommand(program, deps = {}) {
     const hqRoot = deps.hqRoot ?? DEFAULT_HQ_ROOT;
     const syncFile = deps.syncFile ?? defaultSyncFile;
     const surfaceSkillFn = deps.surfaceSkillFn ?? surfaceCompanySkill;
+    const confirm = deps.confirm ?? realConfirm;
+    const resolveCompanyUid = deps.resolveCompanyUid ?? getCompanyUid;
     const skill = program
         .command("skill")
-        .description("Create company skills and discuss improvements")
+        .description("Create, stage, promote, and discuss company skills")
         .option("--company <slug>", "Company slug (defaults to the active company)")
         .option("--hq-root <path>", "Local HQ root", hqRoot);
     skill
@@ -391,7 +520,7 @@ export function registerSkillCommand(program, deps = {}) {
             path: `/v1/files/skills/company/${encodeURIComponent(companySlug)}/register`,
             method: "POST",
             body: {
-                path: `skills/${slug}/SKILL.md`,
+                path: skillVaultPath(slug),
                 content: localContent,
             },
         });
@@ -401,13 +530,8 @@ export function registerSkillCommand(program, deps = {}) {
                 machineIdentity: isMachineIdentity(),
             });
         }
-        const registered = (await response.json());
-        if (typeof registered.skillUid !== "string" ||
-            !SKILL_UID_PATTERN.test(registered.skillUid) ||
-            typeof registered.content !== "string" ||
-            parseSkillUid(registered.content) !== registered.skillUid) {
-            throw new Error("The server returned an invalid skill registration response; the local file was not changed.");
-        }
+        const payload = (await response.json());
+        const registered = assertRegisteredSkillResponse(payload);
         writeSkillFileAtomically(filePath, registered.content);
         let discoveryStatus = null;
         try {
@@ -473,15 +597,183 @@ export function registerSkillCommand(program, deps = {}) {
                 // Sentry rather than filing a crash on its first occurrence.
                 throw localSkillError(`Skill ${registered.skillUid} is stamped locally at '${filePath}', but sync aborted because the remote file conflicts.`);
             }
+            if (syncResult.planLimit) {
+                throw skillUploadRefused(registered.skillUid, filePath, companySlug, syncResult.planLimit);
+            }
         }
         console.log(chalk.green(`Skill ready: ${registered.skillUid}`));
         console.log(`  File:     ${filePath}`);
         console.log(`  Discovery: ${discoveryStatus === 0 ? "ready" : "needs attention"}`);
-        console.log(registered.accessPolicy === "open"
+        console.log(payload.accessPolicy === "open"
             ? `  Access:   Open — every active ${companySlug} member can edit`
             : "  Access:   preserved existing policy");
         console.log(`  Sync:     ${opts.sync === false ? "not requested" : "complete"}`);
     });
+    skill
+        .command("register <slug>")
+        .description("Register a company skill to a proposal-lane stamped file without writing the canonical tree")
+        .requiredOption("--source <path>", "Caller-authored SKILL.md (or its directory) to send to the server validator")
+        .requiredOption("--stamped-output <path>", "Write the complete server-stamped bytes here, outside companies/<company>/skills/")
+        .option("--no-canonical-write", "Refuse to write companies/<company>/skills/ (always the register behavior)")
+        .option("--no-surface", "Do not create a discovery wrapper (always the register behavior)")
+        .option("--no-sync", "Do not upload the skill file (always the register behavior)")
+        .action(async (slug, opts) => {
+        if (!SKILL_SLUG_PATTERN.test(slug)) {
+            throw localSkillError("Skill slug must start with a lowercase letter or number and contain only lowercase letters, numbers, and hyphens.");
+        }
+        const parentOpts = skill.opts();
+        const resolvedRoot = path.resolve(parentOpts.hqRoot ?? hqRoot);
+        const companySlug = resolveCompanySlug(parentOpts.company, resolvedRoot);
+        canonicalCompanySkillPath(resolvedRoot, companySlug, slug);
+        const sourcePath = resolveSkillMarkdownPath(opts.source, cwd());
+        if (!fs.existsSync(sourcePath) || !fs.statSync(sourcePath).isFile()) {
+            throw localSkillError(`No SKILL.md found at '${opts.source}'. Pass --source <file> or a directory that contains SKILL.md.`);
+        }
+        const stampedOutputPath = assertStagedOutputPath(resolvedRoot, path.resolve(cwd(), opts.stampedOutput));
+        const localContent = fs.readFileSync(sourcePath, "utf8");
+        const sourceHash = sha256Hex(localContent);
+        const token = await ensureToken();
+        const response = await apiFetch({
+            token,
+            path: `/v1/files/skills/company/${encodeURIComponent(companySlug)}/register`,
+            method: "POST",
+            body: {
+                path: skillVaultPath(slug),
+                content: localContent,
+            },
+        });
+        if (!response.ok) {
+            const body = (await response.json().catch(() => ({})));
+            throw skillApiError(response.status, body, {
+                machineIdentity: isMachineIdentity(),
+            });
+        }
+        const registered = assertRegisteredSkillResponse((await response.json()));
+        writeSkillFileAtomically(stampedOutputPath, registered.content);
+        const stampedHash = sha256Hex(registered.content);
+        console.log(chalk.green(`Skill registered (staged): ${registered.skillUid}`));
+        console.log(`  Source:          ${sourcePath}`);
+        console.log(`  Source SHA-256:  ${sourceHash}`);
+        console.log(`  Stamped output:  ${stampedOutputPath}`);
+        console.log(`  Stamped SHA-256: ${stampedHash}`);
+        console.log("  Canonical write: not requested");
+        console.log("  Discovery:       not requested");
+        console.log("  Sync:            not requested");
+    });
+    skill
+        .command("promote <slug>")
+        .description("Copy independently-cleared stamped bytes into the canonical skill path after SHA-256 and skill_uid checks")
+        .requiredOption("--from <path>", "Independently-cleared stamped SKILL.md (or its directory)")
+        .requiredOption("--expected-sha256 <hex>", "SHA-256 of the exact stamped file bytes that were cleared")
+        .option("--reviewed-update", "Replace an existing canonical SKILL.md whose bytes differ from the stamped file")
+        .option("--no-sync", "Promote locally without uploading the canonical file")
+        .action(async (slug, opts) => {
+        if (!SKILL_SLUG_PATTERN.test(slug)) {
+            throw localSkillError("Skill slug must start with a lowercase letter or number and contain only lowercase letters, numbers, and hyphens.");
+        }
+        const parentOpts = skill.opts();
+        const resolvedRoot = path.resolve(parentOpts.hqRoot ?? hqRoot);
+        const companySlug = resolveCompanySlug(parentOpts.company, resolvedRoot);
+        const canonicalPath = canonicalCompanySkillPath(resolvedRoot, companySlug, slug);
+        const fromPath = resolveSkillMarkdownPath(opts.from, cwd());
+        if (!fs.existsSync(fromPath) || !fs.statSync(fromPath).isFile()) {
+            throw localSkillError(`No stamped SKILL.md found at '${opts.from}'. Pass --from <file> or a directory that contains SKILL.md.`);
+        }
+        const stampedBytes = fs.readFileSync(fromPath);
+        assertSha256HexMatch(sha256Hex(stampedBytes), opts.expectedSha256);
+        const stampedContent = stampedBytes.toString("utf8");
+        const skillUid = parseSkillUid(stampedContent);
+        if (!skillUid) {
+            throw localSkillError(`The stamped SKILL.md at '${fromPath}' has no registered skill_uid. Canonical skill was not written.`);
+        }
+        const token = await ensureToken();
+        const companyUid = await resolveCompanyUid(token, companySlug);
+        const detail = await apiFetch({
+            token,
+            path: `/v1/skills/${encodeURIComponent(companyUid)}/${encodeURIComponent(skillUid)}`,
+            method: "GET",
+        });
+        if (!detail.ok) {
+            const body = (await detail.json().catch(() => ({})));
+            throw skillApiError(detail.status, body, {
+                machineIdentity: isMachineIdentity(),
+            });
+        }
+        const { skill: record } = (await detail.json());
+        if (typeof record?.skillUid === "string" &&
+            record.skillUid !== skillUid) {
+            throw localSkillError(`Stamped skill_uid ${skillUid} does not match the server registration. Canonical skill was not written.`);
+        }
+        const recordPath = skillRecordPath(record);
+        if (recordPath &&
+            normalizeLiveSkillVaultPath(recordPath) !== skillVaultPath(slug)) {
+            throw localSkillError(`Stamped skill_uid ${skillUid} is registered at '${recordPath}', not '${skillVaultPath(slug)}'. Canonical skill was not written.`);
+        }
+        if (fs.existsSync(canonicalPath) && !fs.statSync(canonicalPath).isFile()) {
+            throw localSkillError(`Expected a SKILL.md file at '${canonicalPath}'.`);
+        }
+        const existing = fs.existsSync(canonicalPath)
+            ? fs.readFileSync(canonicalPath)
+            : null;
+        if (existing && !existing.equals(stampedBytes)) {
+            if (opts.reviewedUpdate !== true) {
+                throw localSkillError(`Canonical skill '${canonicalPath}' already exists and differs from the stamped file. Re-run with --reviewed-update after that exact change is cleared.`);
+            }
+        }
+        if (!existing || !existing.equals(stampedBytes)) {
+            writeSkillFileAtomically(canonicalPath, stampedBytes);
+        }
+        const legacyPrefix = readCompanyPrefix(resolvedRoot, companySlug);
+        let discoveryStatus = null;
+        try {
+            discoveryStatus = surfaceSkillFn({
+                hqRoot: resolvedRoot,
+                companySlug,
+                skillSlug: slug,
+                ...(legacyPrefix ? { legacyPrefix } : {}),
+            }).status;
+        }
+        catch (err) {
+            console.warn(chalk.yellow(`⚠ Skill promoted, but local discovery failed: ${err instanceof Error ? err.message : String(err)}`));
+        }
+        if (discoveryStatus !== null && discoveryStatus !== 0) {
+            console.warn(chalk.yellow(`⚠ Skill promoted, but local discovery exited ${discoveryStatus}. Run 'hq skill --company ${companySlug} create ${slug} --surface-only' to retry without another registration request.`));
+        }
+        if (opts.sync !== false) {
+            let syncResult;
+            try {
+                syncResult = await syncFile({
+                    filePath: canonicalPath,
+                    companySlug,
+                    hqRoot: resolvedRoot,
+                    token,
+                });
+            }
+            catch (err) {
+                console.warn(chalk.yellow(`⚠ Skill ${skillUid} is stamped locally at '${canonicalPath}', but sync failed.`));
+                if (err && typeof err === "object") {
+                    const diagnostics = vaultAccessDeniedDiagnostics(err, {
+                        companySlug,
+                        objectKey: skillVaultPath(slug),
+                    });
+                    if (diagnostics)
+                        stampVaultAccessDenied(err, diagnostics);
+                }
+                throw err;
+            }
+            if (syncResult.aborted) {
+                throw localSkillError(`Skill ${skillUid} is stamped locally at '${canonicalPath}', but sync aborted because the remote file conflicts.`);
+            }
+            if (syncResult.planLimit) {
+                throw skillUploadRefused(skillUid, canonicalPath, companySlug, syncResult.planLimit);
+            }
+        }
+        console.log(chalk.green(`Skill promoted: ${skillUid}`));
+        console.log(`  File:     ${canonicalPath}`);
+        console.log(`  SHA-256:  ${sha256Hex(stampedBytes)}`);
+        console.log(`  Discovery: ${discoveryStatus === 0 ? "ready" : "needs attention"}`);
+        console.log(`  Sync:     ${opts.sync === false ? "not requested" : "complete"}`);
+    });
     skill
         .command("propose <target>")
         .description("Post a comment-only improvement for a skill")
@@ -516,6 +808,53 @@ export function registerSkillCommand(program, deps = {}) {
         console.log(`  Message:  ${posted.body}`);
         console.log(chalk.dim("  Review it in HQ Console → Skills → Improvements"));
     });
+    skill
+        .command("delete <target>")
+        .description("Delete a company skill and all of its files for everyone (skl_… uid, SKILL.md path, or skill slug). Prompts for confirmation unless --yes.")
+        .option("-y, --yes", "Skip the confirmation prompt (for scripts)")
+        .action(async (target, opts) => {
+        const parentOpts = skill.opts();
+        const resolvedRoot = path.resolve(parentOpts.hqRoot ?? hqRoot);
+        const companySlug = resolveCompanySlug(parentOpts.company, resolvedRoot);
+        const skillUid = resolveDeleteTarget(target, cwd(), resolvedRoot, companySlug);
+        const token = await ensureToken();
+        const companyUid = await resolveCompanyUid(token, companySlug);
+        const skillPath = `/v1/skills/${encodeURIComponent(companyUid)}/${encodeURIComponent(skillUid)}`;
+        const detail = await apiFetch({ token, path: skillPath, method: "GET" });
+        if (!detail.ok) {
+            const body = (await detail.json().catch(() => ({})));
+            throw skillApiError(detail.status, body, {
+                machineIdentity: isMachineIdentity(),
+            });
+        }
+        const { skill: record } = (await detail.json());
+        const name = typeof record?.name === "string" ? record.name : skillUid;
+        if (opts.yes !== true) {
+            if (!process.stdin.isTTY) {
+                throw localSkillError(`Refusing to delete '${name}' without confirmation. Re-run with --yes.`);
+            }
+            const ok = await confirm(`Delete skill '${name}' (${skillUid}) and all of its files for everyone in ${companySlug}? This can't be undone from the CLI.`);
+            if (!ok) {
+                console.log("Cancelled — nothing was deleted.");
+                return;
+            }
+        }
+        const response = await apiFetch({ token, path: skillPath, method: "DELETE" });
+        if (!response.ok) {
+            const body = (await response.json().catch(() => ({})));
+            throw skillApiError(response.status, body, {
+                machineIdentity: isMachineIdentity(),
+            });
+        }
+        const result = (await response.json());
+        console.log(chalk.green(`Skill deleted: ${name}`));
+        console.log(`  Skill:    ${skillUid}`);
+        console.log(`  Files:    ${typeof result.filesDeleted === "number" ? result.filesDeleted : 0} removed`);
+        if (result.tombstoneIncomplete === true) {
+            console.warn(chalk.yellow("⚠ Some synced computers may not be told to remove their copy. Delete it locally if it reappears."));
+        }
+        console.log(chalk.dim("  Local copies are removed on the next sync (hq sync now)."));
+    });
     return skill;
 }
 //# sourceMappingURL=skill.js.map

package/dist/commands/staff/reset-test-account.d.ts

@@ -0,0 +1,110 @@
+import { Command } from "commander";
+/**
+ * `hq staff reset-test-account <email>` — onboarding-test-accounts US-007.
+ *
+ * Thin CLI wrapper over `POST /v1/admin/test-account/reset` (US-003 dry-run +
+ * US-006 execute). Server owns every safety gate; this file owns two operator
+ * ergonomics the wire cannot: (1) a LOCAL staff-email preflight so a non-staff
+ * caller stops here instead of paying a round trip for the same 403, and (2)
+ * the typed-email confirmation prompt for `--execute`, whose value is what the
+ * server matches against `plan.target.normalizedEmail` via `confirmEmailMatches`.
+ *
+ * OQ-003 recommendation: this ships as a subcommand of the existing hq CLI
+ * (`hq staff …`) rather than a separate `hq-staff` binary — reuses auth,
+ * distribution, and telemetry with zero new plumbing.
+ */
+interface PlanCognitoUser {
+    username: string;
+    sub: string;
+    provider: string;
+    email: string;
+}
+interface PlanCompany {
+    uid: string;
+    slug: string;
+    memberCount: number;
+}
+interface Plan {
+    target: {
+        input: string;
+        normalizedEmail: string;
+    };
+    personUid: string | null;
+    cognitoUsers: PlanCognitoUser[];
+    ownedCompanies: PlanCompany[];
+    personalVault: {
+        bucketName: string | null;
+        kmsKeyAlias: string | null;
+    };
+    stripe: {
+        customerIds: string[];
+        subscriptionState: unknown | null;
+    };
+    welcomeSeries: {
+        present: boolean;
+    };
+    workMesh: {
+        eventCount: number | null;
+        note?: string;
+    };
+}
+interface StepOutcome {
+    ok: boolean;
+    skipped?: boolean;
+    reason?: string;
+    error?: string;
+}
+interface ExecuteResult {
+    ok: boolean;
+    steps: Record<string, StepOutcome & Record<string, unknown>>;
+    counts: {
+        stripeDeleted: number;
+        welcomeDeleted: number;
+        rawTelemetryDeleted: number | null;
+        workMeshDeleted: number | null;
+        membershipsDeleted: number;
+        companiesPurged: number;
+        entitiesPurged: number;
+        cognitoDeleted: number;
+        kms: string;
+        invitesDeleted: number;
+    };
+}
+/**
+ * Same predicate the server's admin gate applies at the FIRST layer
+ * (`isStaffEmail` in the vault-service admin handler). Duplicated here so a
+ * non-staff caller stops before the round trip; the server remains the
+ * authorization boundary (this file could not enforce it if it wanted to).
+ *
+ * Exact suffix match. `foo@getindigo.ai.evil.test` and `bar@xgetindigo.ai`
+ * do not qualify.
+ */
+export declare function isStaffEmail(candidate: unknown): boolean;
+/** Pull the caller email out of a locally cached id_token. */
+export declare function callerEmailFromToken(token: string): string | undefined;
+export type ConfirmFn = (question: string) => Promise<string>;
+export interface RunResetTestAccountParams {
+    email: string;
+    execute: boolean;
+    /** Skip the typed-confirmation prompt on --execute (for scripts). */
+    yes?: boolean;
+}
+export interface RunResetTestAccountDeps {
+    prompt?: ConfirmFn;
+    /** Whether to treat this session as an interactive TTY. Defaults to `process.stdin.isTTY`. */
+    isTty?: boolean;
+}
+/**
+ * Print a compact dry-run plan. Kept flat so the operator can eyeball what the
+ * executor would touch without a JSON pretty-printer in the loop.
+ */
+export declare function renderPlan(plan: Plan): string;
+/**
+ * One-line-per-step summary of the executor's result. AC calls for "per-step
+ * counts, ok/failed".
+ */
+export declare function renderExecuteSummary(result: ExecuteResult): string;
+export declare function runResetTestAccount(params: RunResetTestAccountParams, deps?: RunResetTestAccountDeps): Promise<void>;
+export declare function registerResetTestAccountCommand(staff: Command, deps?: RunResetTestAccountDeps): Command;
+export {};
+//# sourceMappingURL=reset-test-account.d.ts.map