@indigoai-us/hq-cloud 6.14.46 → 6.14.48

package/dist/cli/share.d.ts

@@ -162,6 +162,7 @@ export declare const _testing: {
     collectFiles: typeof collectFiles;
     resolveNamedPath: typeof resolveNamedPath;
     isWithinLexicalOrReal: typeof isWithinLexicalOrReal;
+    defaultConsoleLogger: typeof defaultConsoleLogger;
 };
 export interface ShareOptions {
     /** Path(s) to share (files or directories) */
@@ -303,8 +304,10 @@ export interface ShareOptions {
      * belong in THIS bucket regardless of local state" and uses the same
      * DeleteObject + journal-removal path as `propagateDeletes`.
      *
-     * Honors `propagateDeletePolicy` — `"owned-only"` (default) only
-     * decommissions journal entries with `direction === "up"`, so a
+     * Honors `propagateDeletePolicy`. Under `"owned-only"` (this function's
+     * own fallback when the caller passes nothing; every live caller passes
+     * `resolveDeletePolicy()`, which defaults to `"currency-gated"`) only
+     * journal entries with `direction === "up"` are decommissioned, so a
      * misconfigured caller never erases content pulled from elsewhere.
      *
      * Independent of `propagateDeletes`: callers can opt into decommission
@@ -516,7 +519,7 @@ export interface ShareResult {
     pathResults?: SharePathResult[];
     aborted: boolean;
 }
-export type ShareDeleteRefusalReason = "stale-etag" | "legacy-no-etag" | "bulk-asymmetry" | "divergent-local" | "missing-delete-intent" | "intent-changed" | "transfer-error";
+export type ShareDeleteRefusalReason = "stale-etag" | "legacy-no-etag" | "bulk-asymmetry" | "divergent-local" | "missing-delete-intent" | "intent-changed" | "recreated-locally" | "transfer-error";
 export interface SharePathResult {
     path: string;
     status: "accepted" | "refused";
@@ -535,6 +538,11 @@ export declare function wrapFilterWithIgnoreVisibility(underlying: (absPath: str
  * Share local file(s) to the entity vault.
  */
 export declare function share(options: ShareOptions): Promise<ShareResult>;
+/**
+ * Default human-readable share output. Preserves the exact format the CLI
+ * emitted before `onEvent` was added — tty users see no change.
+ */
+declare function defaultConsoleLogger(event: SyncProgressEvent): void;
 /**
  * One entry produced by collectFiles/walkDir. Files describe regular
  * payloads that get hashed + size-checked + uploaded via uploadFile;

package/dist/cli/share.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"share.d.ts","sourceRoot":"","sources":["../../src/cli/share.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAKH,OAAO,KAAK,EAAE,aAAa,EAAE,kBAAkB,EAAe,MAAM,aAAa,CAAC;AAelF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAuB7C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAEL,KAAK,gBAAgB,EACtB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAGL,KAAK,gBAAgB,EACtB,MAAM,uBAAuB,CAAC;AAwE/B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,eAAO,MAAM,sBAAsB,QACmD,CAAC;AAEvF;;;;;;;;;GASG;AACH;;;;;;;;;;GAUG;AACH,eAAO,MAAM,kBAAkB,QAAqB,CAAC;AAErD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AACH,wBAAgB,qBAAqB,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAExD;AAED,wBAAgB,eAAe,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAElD;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAExD;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,0BAA0B,CAAC,GAAG,EAAE,MAAM,EAAE,YAAY,EAAE,OAAO,GAAG,OAAO,CAEtF;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,QAAQ;;;;;;;CAOpB,CAAC;AA8MF,MAAM,WAAW,YAAY;IAC3B,8CAA8C;IAC9C,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,mEAAmE;IACnE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,mDAAmD;IACnD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,wCAAwC;IACxC,UAAU,CAAC,EAAE,gBAAgB,CAAC;IAC9B;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,kBAAkB,CAAC;IACjC;;;;;;;;;;;;;;;;;;OAkBG;IACH,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B,wBAAwB;IACxB,MAAM,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,iBAAiB,KAAK,IAAI,CAAC;IAC7C;;;;;;;;;OASG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB;;;;;;;;;;;;;;;;OAgBG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAyCG;IACH,qBAAqB,CAAC,EAAE,gBAAgB,GAAG,YAAY,GAAG,KAAK,CAAC;IAChE;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAC;IAChC;;;;;;OAMG;IACH,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB;;;;;;;;OAQG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB;;;;;OAKG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;;;;;;;;OAYG;IACH,SAAS,CAAC,EAAE,gBAAgB,EAAE,CAAC;IAC/B;;;;;;;;;;;OAWG;IACH,cAAc,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAC/C;;;;;;;;;;;;;;;;;;;OAmBG;IACH,qBAAqB,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;CAC1C;AAED,8DAA8D;AAC9D,MAAM,MAAM,qBAAqB,GAAG,SAAS,GAAG,iBAAiB,GAAG,iBAAiB,CAAC;AAEtF;;;;;GAKG;AACH,qBAAa,yBAA0B,SAAQ,KAAK;IAClD,6EAA6E;IAC7E,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC;IACzB,4DAA4D;IAC5D,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAC;gBAE5C,WAAW,EAAE,WAAW,CAAC,MAAM,EAAE,qBAAqB,CAAC,EAAE,QAAQ,EAAE,MAAM;CAuBtF;AAED,MAAM,WAAW,WAAW;IAC1B,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB;;;;;;;OAOG;IACH,YAAY,EAAE,MAAM,CAAC;IACrB;;;;;;OAMG;IACH,eAAe,EAAE,MAAM,CAAC;IACxB;;;;;;;;;OASG;IACH,iBAAiB,EAAE,MAAM,CAAC;IAC1B;;;;;;;;OAQG;IACH,sBAAsB,EAAE,MAAM,EAAE,CAAC;IACjC;;;;;;;OAOG;IACH,0BAA0B,EAAE,MAAM,CAAC;IACnC;;;;;;;OAOG;IACH,qBAAqB,EAAE,MAAM,CAAC;IAC9B;;;;;;;;OAQG;IACH,oBAAoB,EAAE,MAAM,CAAC;IAC7B;;;;;OAKG;IACH,qBAAqB,EAAE,MAAM,CAAC;IAC9B;;;;;;;;;;;;;;;;;OAiBG;IACH,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B;;;;;;;OAOG;IACH,wBAAwB,EAAE,MAAM,EAAE,CAAC;IACnC;;;;OAIG;IACH,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,4EAA4E;IAC5E,WAAW,CAAC,EAAE,eAAe,EAAE,CAAC;IAChC,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,MAAM,wBAAwB,GAChC,YAAY,GACZ,gBAAgB,GAChB,gBAAgB,GAChB,iBAAiB,GACjB,uBAAuB,GACvB,gBAAgB,GAChB,gBAAgB,CAAC;AAErB,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,UAAU,GAAG,SAAS,CAAC;IAC/B,SAAS,EAAE,QAAQ,GAAG,WAAW,CAAC;IAClC,MAAM,CAAC,EAAE,wBAAwB,CAAC;CACnC;AAmDD;;;;;;GAMG;AACH,wBAAgB,8BAA8B,CAC5C,UAAU,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO,KAAK,OAAO,EACzD,MAAM,EAAE,MAAM,EACd,gBAAgB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,EAC3C,aAAa,CAAC,EAAE,MAAM,IAAI,GACzB,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO,KAAK,OAAO,CAW/C;AAED;;GAEG;AACH,wBAAsB,KAAK,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC,CA4CvE;AAmqCD;;;;;;;;;GASG;AACH,KAAK,cAAc,GACf;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GAC5D;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAEpF;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,UAAU,YAAY;IACpB,iBAAiB,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,qBAAqB,KAAK,IAAI,CAAC;IAC/E,eAAe,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CACzC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,iBAAS,gBAAgB,CACvB,CAAC,EAAE,MAAM,EACT,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,GAAG,GAAE,MAAsB,GAC1B,MAAM,CAuBR;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,iBAAS,qBAAqB,CAC5B,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EACd,gBAAgB,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,GACvC,OAAO,CAwBT;AA8HD;;;;;;;;;;;GAWG;AACH,iBAAS,YAAY,CACnB,KAAK,EAAE,MAAM,EAAE,EACf,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO,KAAK,OAAO,EAC/C,KAAK,GAAE,YAAiB,GACvB,cAAc,EAAE,CAiGlB"}
+{"version":3,"file":"share.d.ts","sourceRoot":"","sources":["../../src/cli/share.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAKH,OAAO,KAAK,EAAE,aAAa,EAAE,kBAAkB,EAAe,MAAM,aAAa,CAAC;AAelF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AA6B7C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAEL,KAAK,gBAAgB,EACtB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAGL,KAAK,gBAAgB,EACtB,MAAM,uBAAuB,CAAC;AAwE/B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,eAAO,MAAM,sBAAsB,QACmD,CAAC;AAEvF;;;;;;;;;GASG;AACH;;;;;;;;;;GAUG;AACH,eAAO,MAAM,kBAAkB,QAAqB,CAAC;AAErD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AACH,wBAAgB,qBAAqB,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAExD;AAED,wBAAgB,eAAe,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAElD;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAExD;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,0BAA0B,CAAC,GAAG,EAAE,MAAM,EAAE,YAAY,EAAE,OAAO,GAAG,OAAO,CAEtF;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,QAAQ;;;;;;;;CAQpB,CAAC;AA8MF,MAAM,WAAW,YAAY;IAC3B,8CAA8C;IAC9C,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,mEAAmE;IACnE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,mDAAmD;IACnD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,wCAAwC;IACxC,UAAU,CAAC,EAAE,gBAAgB,CAAC;IAC9B;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,kBAAkB,CAAC;IACjC;;;;;;;;;;;;;;;;;;OAkBG;IACH,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B,wBAAwB;IACxB,MAAM,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,iBAAiB,KAAK,IAAI,CAAC;IAC7C;;;;;;;;;OASG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB;;;;;;;;;;;;;;;;OAgBG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAyCG;IACH,qBAAqB,CAAC,EAAE,gBAAgB,GAAG,YAAY,GAAG,KAAK,CAAC;IAChE;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACH,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAC;IAChC;;;;;;OAMG;IACH,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB;;;;;;;;OAQG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB;;;;;OAKG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;;;;;;;;OAYG;IACH,SAAS,CAAC,EAAE,gBAAgB,EAAE,CAAC;IAC/B;;;;;;;;;;;OAWG;IACH,cAAc,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAC/C;;;;;;;;;;;;;;;;;;;OAmBG;IACH,qBAAqB,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;CAC1C;AAED,8DAA8D;AAC9D,MAAM,MAAM,qBAAqB,GAAG,SAAS,GAAG,iBAAiB,GAAG,iBAAiB,CAAC;AAEtF;;;;;GAKG;AACH,qBAAa,yBAA0B,SAAQ,KAAK;IAClD,6EAA6E;IAC7E,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC;IACzB,4DAA4D;IAC5D,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAC;gBAE5C,WAAW,EAAE,WAAW,CAAC,MAAM,EAAE,qBAAqB,CAAC,EAAE,QAAQ,EAAE,MAAM;CAuBtF;AAED,MAAM,WAAW,WAAW;IAC1B,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB;;;;;;;OAOG;IACH,YAAY,EAAE,MAAM,CAAC;IACrB;;;;;;OAMG;IACH,eAAe,EAAE,MAAM,CAAC;IACxB;;;;;;;;;OASG;IACH,iBAAiB,EAAE,MAAM,CAAC;IAC1B;;;;;;;;OAQG;IACH,sBAAsB,EAAE,MAAM,EAAE,CAAC;IACjC;;;;;;;OAOG;IACH,0BAA0B,EAAE,MAAM,CAAC;IACnC;;;;;;;OAOG;IACH,qBAAqB,EAAE,MAAM,CAAC;IAC9B;;;;;;;;OAQG;IACH,oBAAoB,EAAE,MAAM,CAAC;IAC7B;;;;;OAKG;IACH,qBAAqB,EAAE,MAAM,CAAC;IAC9B;;;;;;;;;;;;;;;;;OAiBG;IACH,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B;;;;;;;OAOG;IACH,wBAAwB,EAAE,MAAM,EAAE,CAAC;IACnC;;;;OAIG;IACH,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,4EAA4E;IAC5E,WAAW,CAAC,EAAE,eAAe,EAAE,CAAC;IAChC,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,MAAM,wBAAwB,GAChC,YAAY,GACZ,gBAAgB,GAChB,gBAAgB,GAChB,iBAAiB,GACjB,uBAAuB,GACvB,gBAAgB,GAChB,mBAAmB,GACnB,gBAAgB,CAAC;AAErB,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,UAAU,GAAG,SAAS,CAAC;IAC/B,SAAS,EAAE,QAAQ,GAAG,WAAW,CAAC;IAClC,MAAM,CAAC,EAAE,wBAAwB,CAAC;CACnC;AAmDD;;;;;;GAMG;AACH,wBAAgB,8BAA8B,CAC5C,UAAU,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO,KAAK,OAAO,EACzD,MAAM,EAAE,MAAM,EACd,gBAAgB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,EAC3C,aAAa,CAAC,EAAE,MAAM,IAAI,GACzB,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO,KAAK,OAAO,CAW/C;AAED;;GAEG;AACH,wBAAsB,KAAK,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC,CA4CvE;AA+nCD;;;GAGG;AACH,iBAAS,oBAAoB,CAAC,KAAK,EAAE,iBAAiB,GAAG,IAAI,CAuH5D;AAED;;;;;;;;;GASG;AACH,KAAK,cAAc,GACf;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GAC5D;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAEpF;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,UAAU,YAAY;IACpB,iBAAiB,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,qBAAqB,KAAK,IAAI,CAAC;IAC/E,eAAe,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CACzC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,iBAAS,gBAAgB,CACvB,CAAC,EAAE,MAAM,EACT,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,GAAG,GAAE,MAAsB,GAC1B,MAAM,CAuBR;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,iBAAS,qBAAqB,CAC5B,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EACd,gBAAgB,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,GACvC,OAAO,CAwBT;AA8HD;;;;;;;;;;;GAWG;AACH,iBAAS,YAAY,CACnB,KAAK,EAAE,MAAM,EAAE,EACf,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO,KAAK,OAAO,EAC/C,KAAK,GAAE,YAAiB,GACvB,cAAc,EAAE,CAiGlB"}

package/dist/cli/share.js

@@ -12,8 +12,8 @@ import { createSyncProgressRecorder } from "../sync-progress.js";
 import { localPathForVaultKey, vaultKeyForLocalPath } from "../local-path-codec.js";
 import { uploadFile, uploadSymlink, toPosixKey, headRemoteFile, deleteRemoteFile, downloadFile, primeObjectTransport, primeUploads, } from "../s3.js";
 import * as crypto from "crypto";
-import { readJournal, writeJournal, hashFile, hashSymlinkTarget, updateEntry, removeEntry, normalizeEtag, PERSONAL_VAULT_JOURNAL_SLUG, migratePersonalVaultJournal, } from "../journal.js";
-import { createIgnoreFilter, isExpectedIgnore, isWithinSizeLimit } from "../ignore.js";
+import { readJournal, writeJournal, hashFile, hashSymlinkTarget, updateEntry, removeEntry, isTombstone, normalizeEtag, PERSONAL_VAULT_JOURNAL_SLUG, migratePersonalVaultJournal, } from "../journal.js";
+import { createIgnoreFilter, hasControlCharacters, isExpectedIgnore, isWithinSizeLimit, } from "../ignore.js";
 import { wrapFilterWithPersonalVaultDefaults, } from "../personal-vault-exclusions.js";
 import { isGeneratedCoreMirrorKey, isPersonalVaultDeletionExcluded, } from "../personal-vault.js";
 import { resolveConflict } from "./conflict.js";
@@ -235,6 +235,7 @@ export const _testing = {
     collectFiles,
     resolveNamedPath,
     isWithinLexicalOrReal,
+    defaultConsoleLogger,
 };
 /**
  * Pure Stage-1 pass for push: walk the candidate file list, hash each one,
@@ -489,7 +490,7 @@ export async function share(options) {
 const REFUSED_STALE_PATH_CAP = 50;
 async function createPushRunContext(options) {
     const { paths, company, message, onConflict, vaultConfig, entityContext, hqRoot, skipUnchanged, propagateDeletes } = options;
-    let propagateDeletePolicy = options.propagateDeletePolicy ?? "owned-only";
+    const propagateDeletePolicy = options.propagateDeletePolicy ?? "owned-only";
     const baseEmit = options.onEvent ?? defaultConsoleLogger;
     if (vaultConfig && entityContext) {
         throw new Error("share() requires exactly one of `vaultConfig` or `entityContext`, not both. " +
@@ -507,9 +508,30 @@ async function createPushRunContext(options) {
     const ctx = entityContext
         ? entityContext
         : await resolveEntityContext(companyRef, vaultConfig);
-    if (ctx.uid.startsWith("prs_") && propagateDeletePolicy === "owned-only") {
-        propagateDeletePolicy = "currency-gated";
-    }
+    // NOTE (removed 6.14.48): a `prs_`-scoped coercion used to silently rewrite
+    // `owned-only` -> `currency-gated` here (366721b). It was correct for the
+    // problem it was written against and is now actively harmful, for three
+    // reasons that only became true later:
+    //
+    //   1. Its ONLY reachable effect in production was to override an EXPLICIT
+    //      `owned-only`. Every live caller passes a policy
+    //      (`sync-runner-company.ts` -> `resolveDeletePolicy()`), and that
+    //      resolver already defaults to `currency-gated`. So the coercion never
+    //      fired on a default run — it fired exactly when an operator had set
+    //      `HQ_SYNC_DELETE_POLICY=owned-only`, i.e. the documented rollback.
+    //   2. Once delete authorization moved to ETag currency (no watcher-minted
+    //      intent required), that override stopped being cosmetic: an operator
+    //      reaching for the rollback because deletes were misbehaving would keep
+    //      getting intent-less etag-only deletes on their personal vault. A
+    //      rollback knob that silently exempts a vault is not a rollback knob.
+    //   3. Its motivating bug — the May-27 `personal/.obsidian/*.drift-*` leak —
+    //      is fixed twice over by mechanisms that postdate it: the vault-litter
+    //      drain (6.0.2) drains `.drift-*` markers ahead of every policy gate,
+    //      and etag-gated deletes propagate an intent-less `direction:"down"`
+    //      removal under the default policy without needing any coercion.
+    //
+    // So `owned-only` now means owned-only on every vault kind. It is the strict
+    // rollback path and must stay strictly stricter than the default everywhere.
     // Mirror push progress into the shared cross-process snapshot (see sync.ts).
     // Record the friendly company slug, or null for the personal vault so the
     // menubar shows "Personal" — never the raw prs_/cmp_ UID.
@@ -620,6 +642,35 @@ async function buildSharePlans(run) {
         emitUnreachablePathEvent(run);
         throw new UnreachablePushPathsError(fatal, run.syncRoot);
     }
+    // Control-character key filter (macOS Finder Icon\r incident). A key
+    // containing a control character can never be stored — validateVaultUploadKey
+    // rejects it with INVALID_KEY_CONTROL_CHARS — so planning an upload for one
+    // only buys a guaranteed throw inside executeUploads, which lands in the
+    // generic catch and emits `type: "error"`. That is the failure this filter
+    // exists to stop: a non-empty errors[] makes the runner return
+    // PARTIAL_SYNC_EXIT, so ONE such file on disk marks EVERY sync pass failed
+    // forever. A macOS tree seeded with Finder `Icon\r` files produced 100+ per
+    // run, wedging sync indefinitely.
+    //
+    // Structurally identical to the size-limit skip in executeUploads: a
+    // permanently-invalid path is a benign skip, never an error. Symmetric with
+    // the pull leg, which has classified such keys since the 2026-07-11 incident
+    // (see computePullPlan's classifyVaultKey call). Applied before the mode
+    // branch below so it covers personal and company vaults alike.
+    //
+    // Finder icon files are normally already gone by here — createIgnoreFilter
+    // drops them during the walk. This stays as the general guard for any other
+    // control-char path, and as defense for callers that bypass the walker.
+    const controlCharFiltered = collected.filter((entry) => {
+        if (!hasControlCharacters(entry.relativePath))
+            return true;
+        run.emit({
+            type: "skip-invalid-scoped-key",
+            path: entry.relativePath,
+            errorCode: "INVALID_KEY_CONTROL_CHARS",
+        });
+        return false;
+    });
     // Scope-invalid key filter (incident 2026-07-11). In company mode the sync
     // root IS the company folder, so a local entry whose vault key starts with
     // `companies/` can only come from a stale doubled local tree
@@ -632,7 +683,7 @@ async function buildSharePlans(run) {
     // of this leg ever re-uploading it. Personal vaults legitimately carry
     // `companies/{slug}/…` keys, so this only applies in company mode.
     const filesToShare = run.options.personalMode === true
-        ? collected.filter((entry) => {
+        ? controlCharFiltered.filter((entry) => {
             // `core/<type>` symlinks are generated projections of canonical
             // personal/package content. Reindex or package wiring owns their
             // lifecycle, so uploading them creates remote objects that a later
@@ -652,7 +703,7 @@ async function buildSharePlans(run) {
             }
             return false;
         })
-        : collected.filter((entry) => {
+        : controlCharFiltered.filter((entry) => {
             if (!entry.relativePath.startsWith("companies/"))
                 return true;
             run.emit({
@@ -827,7 +878,11 @@ async function executeUploads(run, pushPlan, counters, conflictPaths) {
             }
             if (freshContentConverged) {
                 const lstat = fs.lstatSync(absolutePath);
-                updateEntry(run.journal, relativePath, localHash, lstat.size, "up", remoteMeta.etag, lstat.mtimeMs, undefined, item.kind);
+                updateEntry(run.journal, relativePath, localHash, lstat.size, "up", absolutePath, {
+                    remoteEtag: remoteMeta.etag,
+                    mtimeMs: lstat.mtimeMs,
+                    kind: item.kind,
+                });
                 run.emit({ type: "reconciled", path: relativePath, direction: "push" });
                 counters.filesSkipped++;
                 return;
@@ -893,7 +948,7 @@ async function executeUploads(run, pushPlan, counters, conflictPaths) {
             const { etag } = isSymlinkUpload
                 ? await uploadSymlink(run.ctx, item.target, relativePath, run.options.author, pc)
                 : await uploadFile(run.ctx, absolutePath, relativePath, run.options.author, pc);
-            updateEntry(run.journal, relativePath, localHash, size, "up", etag, mtimeMs, undefined, item.kind);
+            updateEntry(run.journal, relativePath, localHash, size, "up", absolutePath, { remoteEtag: etag, mtimeMs, kind: item.kind });
             if (run.message) {
                 run.journal.files[relativePath] = {
                     ...run.journal.files[relativePath],
@@ -1041,19 +1096,32 @@ async function executeDeletes(run, deletePlan, decommissionPlan, counters, files
         }
         try {
             const entry = run.journal.files[relativePath];
-            if (!item.decommission &&
+            // Last-second absence re-check. Applies to EVERY propagated delete,
+            // intent-backed or etag-only: a pull leg or the user can recreate the
+            // file between planning and applying, and deleting it remotely then
+            // destroys a file that exists locally right now. This used to sit inside
+            // the intent-version check, which meant it was skipped for any item
+            // carrying `intentVersion: null` — harmless while that only covered
+            // litter and decommission, but not once etag-only candidates travel that
+            // way too.
+            //
+            // Codec boundary: journal keys are canonical; the probe must use the
+            // ENCODED local path or a win32 colon key always looks absent (a raw `:`
+            // name can never exist on disk) and the remote delete proceeds while the
+            // encoded local file is still present.
+            const recreatedLocally = !item.decommission &&
+                !isLocallyAbsent(localPathForVaultKey(run.syncRoot, relativePath));
+            const intentChanged = !item.decommission &&
                 item.intentVersion !== null &&
                 (!hasCurrentLocalDeleteIntent(entry) ||
-                    entry.localDeleteIntent.version !== item.intentVersion ||
-                    // Codec boundary: journal keys are canonical; the last-second
-                    // absence re-check must probe the ENCODED local path or a win32
-                    // colon key always looks absent (a raw `:` name can never exist
-                    // on disk) and the remote delete proceeds while the encoded local
-                    // file is still present.
-                    !isLocallyAbsent(localPathForVaultKey(run.syncRoot, relativePath)))) {
+                    entry.localDeleteIntent.version !== item.intentVersion);
+            if (recreatedLocally || intentChanged) {
                 if (entry?.localDeleteIntent) {
                     delete entry.localDeleteIntent;
                 }
+                const refusalReason = recreatedLocally
+                    ? "recreated-locally"
+                    : "intent-changed";
                 counters.filesRefusedStale++;
                 if (filesRefusedStalePaths.length < REFUSED_STALE_PATH_CAP) {
                     filesRefusedStalePaths.push(relativePath);
@@ -1063,13 +1131,13 @@ async function executeDeletes(run, deletePlan, decommissionPlan, counters, files
                     path: relativePath,
                     journalEtag: entry?.remoteEtag ?? "<missing-delete-intent>",
                     remoteEtag: "<not-checked>",
-                    reason: "intent-changed",
+                    reason: refusalReason,
                 });
                 pathResults.push({
                     path: relativePath,
                     status: "refused",
                     operation: "delete",
-                    reason: "intent-changed",
+                    reason: refusalReason,
                 });
                 continue;
             }
@@ -1402,6 +1470,29 @@ function defaultConsoleLogger(event) {
             // the summary banner.
             console.error(`  ⚠ bulk-asymmetry refusal, kept on remote: ${event.path}`);
         }
+        else if (event.reason === "missing-delete-intent") {
+            // NEITHER etag is meaningful here: no HEAD was issued, so `remoteEtag`
+            // is the `<not-checked>` sentinel, and `journalEtag` is the entry's
+            // real recorded etag. Printing them under the `stale-etag` wording
+            // (which this branch used to fall through to) reads as an etag
+            // conflict and has repeatedly sent operators chasing a currency bug
+            // that does not exist — the actual cause is that no watcher observed
+            // the removal, so no delete authorization was ever recorded.
+            console.error(`  ⚠ no-delete-authorization, kept on remote: ${event.path} ` +
+                `(the sync watcher did not observe this removal, so the delete was never authorized)`);
+        }
+        else if (event.reason === "recreated-locally") {
+            console.error(`  ⚠ recreated-locally, kept on remote: ${event.path} ` +
+                `(the file exists locally again, so the delete was abandoned)`);
+        }
+        else if (event.reason === "divergent-local") {
+            // Same trap as above — `remoteEtag` is `<not-checked>`. The entry's
+            // recorded etag was stamped only to silence a re-fired conflict; the
+            // local copy never matched it, so propagating the delete would destroy
+            // divergent remote work.
+            console.error(`  ⚠ divergent-local, kept on remote: ${event.path} ` +
+                `(the local copy never matched the recorded remote version; pull to reconcile first)`);
+        }
         else {
             console.error(`  ⚠ stale-etag, kept on remote: ${event.path} (journal=${event.journalEtag}, remote=${event.remoteEtag})`);
         }
@@ -2231,6 +2322,40 @@ companyScoped = true) {
             relativeKey.startsWith(`${root}/`));
         if (!inScope)
             continue;
+        // A tombstoned entry has ALREADY had its disposition decided — by a scope
+        // shrink, `hq sync narrow --apply`, a manual prune, or a pull-side
+        // intentional-delete record. It must never be re-evaluated as a fresh
+        // delete candidate.
+        //
+        // This matters most for `all` -> `shared`: `tombstoneEntry` deliberately
+        // KEEPS `hash`, `direction` and `remoteEtag` (so a recovery flow can see
+        // what was there), and the shrink removes the file locally. Every one of
+        // those entries therefore presents as locally-absent, intent-less and
+        // etag-current — which, now that authorization is etag-only, is an
+        // instruction to delete another member's files out of the shared company
+        // vault, for the crime of having narrowed one's own sync scope.
+        //
+        // Until now the ONLY thing standing in the way was `shouldSync` happening
+        // to carry a `prefixSet` (see `createPushRunContext`); any run that
+        // resolved no prefix set — a degraded scope lookup, a caller that does not
+        // set one — would have walked straight through. That is far too load-
+        // bearing for an implicit dependency, so the invariant is stated here
+        // directly.
+        //
+        // `local-delete` is the ONE reason that must pass: the pull leg stamps it
+        // as a deliberate producer hand-off ("the user removed this; push leg,
+        // finish the job"), and skipping it would strand exactly the deletes this
+        // change exists to enable. Every other reason — scope_shrink,
+        // narrow_apply, manual, or an absent/unrecognised one — means "stop
+        // tracking, do NOT touch the remote", so the test is written fail-closed:
+        // only the explicit hand-off is let through.
+        //
+        // Skipped BEFORE `inScopeJournalEntries++` so these inflate neither the
+        // numerator nor the denominator of the bulk-asymmetry ratio. Excluding
+        // them from the denominator can only make the breaker MORE likely to trip,
+        // which is the safe direction.
+        if (isTombstone(entry) && entry.removedReason !== "local-delete")
+            continue;
         inScopeJournalEntries++;
         const localPath = localPathForVaultKey(syncRoot, relativeKey);
         // Scope-invalid journal keys (incident 2026-07-11): in a COMPANY-scoped
@@ -2306,11 +2431,78 @@ companyScoped = true) {
             continue;
         }
         if (!hasCurrentLocalDeleteIntent(entry)) {
-            if (policy === "currency-gated" ||
-                (policy === "owned-only" && entry.direction === "up")) {
+            // A delete intent is minted ONLY by a live watcher, at the instant it
+            // observes the unlink. Three of the four ways HQ syncs never construct a
+            // watcher at all — outpost/agent boxes run a one-shot runner, `hq sync
+            // now` is one-shot, and the desktop app drops `--event-push` (and with it
+            // the whole TreeWatcher) whenever Instant-sync is off. On those surfaces
+            // an intent can never exist, so requiring one made deletes structurally
+            // impossible rather than merely gated. Files deleted while no watcher was
+            // running also stranded permanently: the file is already gone, so no
+            // watcher can ever retroactively witness it.
+            //
+            // `currency-gated` therefore authorizes on ETag currency alone. The
+            // per-file question it answers is unchanged — "is the remote object still
+            // exactly what this journal recorded, i.e. has no peer touched it since"
+            // — and a mismatch still refuses (`stale-etag`) so a peer's newer work is
+            // never destroyed.
+            //
+            // The whole-set question ("does my local mirror look catastrophically
+            // empty") is NOT answered by the ETag, and must not be conflated with it:
+            // in the steady state nobody has overwritten anything, so a moved hqRoot,
+            // unmounted volume, fresh clone or partial restore presents mass-ENOENT
+            // with perfectly matching ETags. That is exactly how the 2026-05-25
+            // indigo vault mass-delete destroyed 559 objects. The bulk-asymmetry
+            // breaker below is the guard for that class and is deliberately left
+            // intact — these candidates are counted into `bulkCandidatePicks` on the
+            // SAME line as intent-backed ones, so relaxing the per-file gate cannot
+            // weaken the whole-set one. See policy `sync-delete-bulk-asymmetry-guard`
+            // (hard) and workspace/reports/indigo-vault-mass-delete-debug.md.
+            //
+            // `owned-only` keeps requiring an intent: it is the documented rollback
+            // knob, and an operator who selects it is asking for the stricter path.
+            if (policy === "owned-only") {
+                // Still counted into the breaker exactly as before: an owned-only run
+                // whose mirror has gone missing must trip the whole-set guard even
+                // though each individual key is refused for want of an intent.
+                if (entry.direction === "up") {
+                    bulkCandidatePicks++;
+                    intentlessKeys.add(relativeKey);
+                }
+                plan.refusedStale.push({
+                    key: relativeKey,
+                    journalEtag: entry.remoteEtag ?? "<missing-delete-intent>",
+                    remoteEtag: "<not-checked>",
+                    reason: "missing-delete-intent",
+                });
+                continue;
+            }
+            if (policy === "currency-gated") {
                 bulkCandidatePicks++;
                 intentlessKeys.add(relativeKey);
+                // No etag on record ⇒ nothing to compare ⇒ no authorization. Refused
+                // for the same reason an intent-backed legacy entry is (below).
+                if (!entry.remoteEtag) {
+                    plan.refusedStale.push({
+                        key: relativeKey,
+                        journalEtag: "<legacy-no-etag>",
+                        remoteEtag: "<unknown>",
+                        reason: "legacy-no-etag",
+                    });
+                    continue;
+                }
+                headCandidates.push({
+                    key: relativeKey,
+                    journalEtag: entry.remoteEtag,
+                    intentVersion: null,
+                });
+                continue;
             }
+            // policy === "all" is deliberately NOT relaxed here. It already skips the
+            // bulk-asymmetry breaker, so letting it skip the intent gate too would
+            // make it a wholly unguarded mass delete — a strictly larger blast radius
+            // than this change is scoped to. It keeps refusing intent-less entries
+            // exactly as before.
             plan.refusedStale.push({
                 key: relativeKey,
                 journalEtag: entry.remoteEtag ?? "<missing-delete-intent>",