@indigoai-us/hq-cli 5.314.0 → 5.316.0

package/dist/commands/cloud-retire.js

@@ -0,0 +1,154 @@
+/**
+ * `hq cloud retire company <slug>` — soft-tombstone a cloud company so
+ * `hq cloud demote company` can run without `--propagate-deletes`.
+ *
+ * Console equivalent: Settings → Delete company (`DELETE /entity/{uid}`).
+ * Owner-only. The entity row, S3 bucket, KMS key, and memberships stay;
+ * `/membership/me` stops listing the company. Local files are not touched —
+ * demote is the follow-up that flips the local tree back to local-only.
+ *
+ * Confirm step is on by default (`[y/N]`). `--yes` skips it for scripts.
+ * A non-TTY stdin without `--yes` refuses rather than hanging.
+ *
+ * Exit codes (mirrors cloud-provision / cloud-demote):
+ *   0 — success, already tombstoned, or the operator cancelled.
+ *   1 — vault HTTP failure (auth/network/5xx).
+ *   2 — validation (bad slug, no entity, not owner, missing confirm).
+ */
+import * as fs from "node:fs";
+import * as readline from "node:readline";
+import chalk from "chalk";
+import { ProvisionError, companyConfigPath, createDefaultVaultClient, validateSlug, } from "./cloud-provision.js";
+import { DEFAULT_HQ_ROOT, DEFAULT_VAULT_API_URL, ensureCognitoToken, } from "../utils/cognito-session.js";
+export function defaultConfirm(question) {
+    const rl = readline.createInterface({
+        input: process.stdin,
+        output: process.stdout,
+    });
+    return new Promise((resolve) => {
+        rl.question(`${question} [y/N] `, (answer) => {
+            rl.close();
+            resolve(/^y(es)?$/i.test(answer.trim()));
+        });
+    });
+}
+/**
+ * Read `companyUid` from `companies/<slug>/.hq/config.json` when the by-slug
+ * lookup misses (a tombstoned company is filtered from that route).
+ */
+export function readLocalCompanyUid(hqRoot, slug) {
+    const cPath = companyConfigPath(hqRoot, slug);
+    if (!fs.existsSync(cPath))
+        return null;
+    try {
+        const parsed = JSON.parse(fs.readFileSync(cPath, "utf-8"));
+        return typeof parsed.companyUid === "string" && parsed.companyUid.length > 0
+            ? parsed.companyUid
+            : null;
+    }
+    catch {
+        return null;
+    }
+}
+export async function retireCompany(options) {
+    validateSlug(options.slug);
+    const accessToken = options.resolveAccessToken
+        ? await options.resolveAccessToken()
+        : await ensureCognitoToken();
+    const client = options.vaultClient ??
+        createDefaultVaultClient(options.vaultApiUrl, accessToken);
+    let entity;
+    try {
+        entity = await client.findCompanyBySlug(options.slug);
+    }
+    catch (err) {
+        if (err instanceof ProvisionError)
+            throw err;
+        throw new ProvisionError(1, `Vault GET by-slug failed: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    if (entity?.deleted === true) {
+        return {
+            ok: true,
+            company_slug: options.slug,
+            cloud_uid: entity.uid,
+            already_deleted: true,
+        };
+    }
+    const uid = entity?.uid ?? readLocalCompanyUid(options.hqRoot, options.slug);
+    if (!uid) {
+        throw new ProvisionError(2, `Refusing to retire '${options.slug}': no cloud entity found.`);
+    }
+    if (options.yes !== true) {
+        const tty = options.stdinIsTTY ?? process.stdin.isTTY === true;
+        if (!tty) {
+            throw new ProvisionError(2, `Refusing to retire '${options.slug}' without confirmation. Re-run with --yes.`);
+        }
+        const confirm = options.confirm ?? defaultConfirm;
+        const ok = await confirm(`Soft-tombstone cloud company '${options.slug}' (${uid})? ` +
+            `It will disappear from every member's picker. Vault files stay. ` +
+            `Then run: hq cloud demote company ${options.slug}`);
+        if (!ok) {
+            return {
+                ok: false,
+                company_slug: options.slug,
+                cloud_uid: uid,
+                already_deleted: false,
+                cancelled: true,
+            };
+        }
+    }
+    try {
+        await client.softDeleteCompany(uid);
+    }
+    catch (err) {
+        if (err instanceof ProvisionError)
+            throw err;
+        throw new ProvisionError(1, `Vault DELETE /entity/${uid} failed: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    return {
+        ok: true,
+        company_slug: options.slug,
+        cloud_uid: uid,
+        already_deleted: false,
+    };
+}
+/**
+ * Register `retire company <slug>` under the `cloud` command group.
+ */
+export function registerCloudRetireCommands(program) {
+    const retireCmd = program
+        .command("retire")
+        .description("Soft-tombstone a cloud-backed company (owner only)");
+    retireCmd
+        .command("company")
+        .description("Soft-tombstone a cloud company so `hq cloud demote company` can run. " +
+        "Does not delete vault files or local folders. Prompts unless --yes.")
+        .argument("<slug>", "Company slug")
+        .option("--hq-root <path>", `Local HQ tree root (default: ${DEFAULT_HQ_ROOT})`, DEFAULT_HQ_ROOT)
+        .option("--vault-api-url <url>", `Vault API URL (default: ${DEFAULT_VAULT_API_URL})`, DEFAULT_VAULT_API_URL)
+        .option("-y, --yes", "Skip the confirmation prompt (for scripts)")
+        .action(async (slug, options) => {
+        try {
+            const result = await retireCompany({
+                slug,
+                hqRoot: options.hqRoot,
+                vaultApiUrl: options.vaultApiUrl,
+                yes: options.yes,
+            });
+            process.stdout.write(JSON.stringify(result) + "\n");
+            if (result.cancelled) {
+                process.stderr.write(chalk.dim("[hq cloud retire] Cancelled — nothing was tombstoned.\n"));
+            }
+            process.exit(0);
+        }
+        catch (err) {
+            if (err instanceof ProvisionError) {
+                process.stderr.write(chalk.red(`[hq cloud retire] ${err.message}\n`));
+                process.exit(err.code);
+            }
+            process.stderr.write(chalk.red(`[hq cloud retire] Unexpected error: ${err instanceof Error ? err.message : String(err)}\n`));
+            process.exit(1);
+        }
+    });
+}
+//# sourceMappingURL=cloud-retire.js.map

package/dist/commands/cloud.d.ts

@@ -13,8 +13,9 @@
  *   hq sync status            — show local journal summary
  */
 import { Command } from "commander";
-import { type ConflictStrategy, type MembershipSyncConfig, type SyncMode, type PullScope, type ExplicitGrant } from "@indigoai-us/hq-cloud";
+import { type ConflictStrategy, type EntityContext, type MembershipSyncConfig, type SyncMode, type PullScope, type ExplicitGrant, type ShareOptions, type VaultServiceConfig } from "@indigoai-us/hq-cloud";
 import { type BannerLevel } from "../lib/narrow-hint-banner.js";
+import { type PlanLimitRefusalSummary } from "../lib/billing/plan-limit-refusals.js";
 /**
  * Terminal-failure signal for the sync fanout runners. The runners
  * (`runPushAll` / `runPullAll` / `runPullPersonal` / `runNowSingle` /
@@ -28,7 +29,16 @@ import { type BannerLevel } from "../lib/narrow-hint-banner.js";
  */
 export declare class SyncExitError extends Error {
     readonly code: number;
-    constructor(code: number);
+    /**
+     * The client-health outcome to record for this exit. A run whose only
+     * problem was a plan-limit refusal exits non-zero (it did not upload what
+     * was asked) but is not a sync failure: the engine worked and the refusal
+     * is plan state, so it must not count toward `consecutiveFailures`.
+     */
+    readonly health: "failed" | "succeeded";
+    constructor(code: number, opts?: {
+        health?: "failed" | "succeeded";
+    });
 }
 /**
  * Preserve the vault's typed write-scope refusal at the CLI boundary. This is
@@ -61,6 +71,14 @@ export declare function scopeExcludedWarning(count: number): string | null;
  * dropped files — helps debug ACL vs scope-excluded mismatches (feedback_7e9c535e).
  */
 export declare function scopeExcludedPrefixDetail(prefixSet: readonly string[] | undefined): string | null;
+/**
+ * Every warning line for a push that dropped files, shared by `push`, `now`
+ * and `push --all`. With a client prefix scope the files fell outside the
+ * caller's write prefixes; without one (prefixSet undefined) the server
+ * refused them path by path — typically another member's child in a private
+ * folder foo/ — and grant advice would point the reader the wrong way.
+ */
+export declare function scopeExcludedLines(count: number, prefixSet: readonly string[] | undefined): string[];
 /**
  * Bound foreground waits for a watcher/manual sync that currently owns the
  * per-root operation lock. The cloud engine reads this environment value on
@@ -189,6 +207,12 @@ export interface PullAllRow {
 }
 export interface ShareCallOptions {
     company: string;
+    /**
+     * The target's display slug, or undefined for the personal vault. Labels the
+     * shared progress snapshot and builds the company billing link for a
+     * plan-limit refusal that arrived without one.
+     */
+    targetSlug?: string;
     hqRoot: string;
     paths: string[];
     onConflict?: ConflictStrategy;
@@ -209,6 +233,8 @@ export interface ShareCallResult {
     filesExcludedByScope: number;
     conflictPaths: string[];
     aborted: boolean;
+    /** Files this leg's plan limit refused; absent or null when none were. */
+    planLimit?: PlanLimitRefusalSummary | null;
 }
 export interface PushAllDeps {
     vaultClient: PullAllVaultClient;
@@ -231,6 +257,8 @@ export interface PushAllOptions {
 export interface PushAllRow {
     slug: string;
     result?: ShareCallResult;
+    /** Client write-prefix scope this push ran under; undefined = none applied. */
+    prefixSet?: readonly string[];
     error?: string;
 }
 export interface PushAllResult {
@@ -264,6 +292,18 @@ export declare function pullAll(options: PullAllOptions, deps: PullAllDeps): Pro
  * deps so tests can drive it without network or filesystem.
  */
 export declare function pushAll(options: PushAllOptions, deps: PushAllDeps): Promise<PushAllResult>;
+/**
+ * Credentials `hq sync push` hands to share(). A pre-vended EntityContext
+ * (AppBar's `--creds-from-stdin` first push) cannot write under private
+ * folders directly, so it travels with the caller's vault config as
+ * `privateFolderVaultConfig`. share() takes exactly one of `vaultConfig` /
+ * `entityContext`.
+ */
+export declare function pushShareCredentials(input: {
+    entityContext?: EntityContext;
+    vaultConfig?: VaultServiceConfig;
+    scopeVaultConfig?: VaultServiceConfig;
+}): Pick<ShareOptions, "entityContext" | "vaultConfig" | "privateFolderVaultConfig">;
 /**
  * Resolve the canonical person entity UID for the logged-in user. Used by
  * `hq sync {push,pull,now} --personal` to target the personal vault without
@@ -272,22 +312,16 @@ export declare function pushAll(options: PushAllOptions, deps: PushAllDeps): Pro
  */
 export declare function resolveCanonicalPersonUid(vaultClient: PullAllVaultClient): Promise<string>;
 /**
- * Refuse `hq sync push --personal <path>` — the combination silently
- * bypasses `PERSONAL_VAULT_EXCLUDED_TOP_LEVEL` (which is only applied by
- * `computePersonalVaultPaths`), risking cross-scope upload of `companies/`,
- * `repos/`, `workspace/`, or `.git/` content to the personal vault. Real
- * incident (2026-05-21): a single command uploaded 196 `companies/{slug}/**`
- * objects to a personal vault before being killed. Cleanup required a
- * hand-rolled S3 sweep. Closes hq-cli#25.
- *
- * Refusal — not silent filtering — is intentional: explicit is better than
- * implicit guesswork, and the legitimate "I want to push a subset of my
- * personal vault" use case has a clean workaround (drop `--personal`, the
- * subset upload targets the active company via standard semantics).
+ * Keep `hq sync push --personal <path>` refused by default. Positional paths
+ * bypass `computePersonalVaultPaths` and can send excluded `companies/`,
+ * `repos/`, `workspace/`, or `.git/` content to the personal vault. The
+ * default-off targeted-paths gate allows the combination only after every
+ * path is realpath-normalized and checked against the computed personal scope
+ * and its file exclusions. Closes hq-cli#25.
  */
 export declare function assertNoPersonalPositionalPaths(opts: {
     personal?: boolean;
-}, paths: string[] | undefined): void;
+}, paths: string[] | undefined, targetedPersonalPathsEnabled?: boolean): void;
 /**
  * Refuse ambiguous selector combinations. `--all`, `--personal`, and
  * `--company` are mutually exclusive — at most one may be set per