@indigoai-us/hq-cli 5.247.1 → 5.249.0

package/CHANGELOG.md

@@ -2,10 +2,26 @@
 
 ## [Unreleased]
 
+## [5.249.0] — 2026-09-27
+
+### Fixed
+
+- Plan-limit notices prefer the current usage-limits upgrade URL and can use
+  the company console billing page as a default-off hq-flags fallback.
+
+## [5.248.0] — 2026-09-27
+
+### Changed
+
+- Internal: moved the message and resume subcommands out of src/commands/lanes.ts; no behaviour change
+
 ## [5.247.1] — 2026-09-27
 
 ### Fixed
 
+- `hq core hq-session set company_slug` accepts case-sensitive ASCII company
+  IDs that match company directory names and writes the same value to the
+  session scope capability.
 - `hq bot create setup` stops before creating a bot when the reserved setup slug exists but its record cannot be verified.
 
 ## [5.247.0] — 2026-09-27

package/assets/scaffold/core/scripts/hq-session.sh

@@ -99,8 +99,8 @@ cmd_set() {
   # session_scope_mint's own character-set rule; `personal` is a valid slug.
   if [ "$key" = "company_slug" ] && [ -n "$value" ]; then
     case "$value" in
-      *[!a-z0-9_-]*)
-        echo "hq-session: invalid company_slug: '$value' (allowed characters: a-z 0-9 - _)" >&2
+      *[!a-zA-Z0-9_-]*)
+        echo "hq-session: invalid company_slug: '$value' (allowed characters: A-Z a-z 0-9 - _)" >&2
         exit 1
         ;;
     esac

package/assets/scaffold/core/scripts/lib/session-scope-capability.sh

@@ -29,7 +29,7 @@ session_scope_mint() {
   [ -n "$root" ] && [ -n "$sid" ] && [ -n "$slug" ] || return 1
 
   case "$slug" in
-    ''|*[!a-z0-9_-]*)
+    ''|*[!a-zA-Z0-9_-]*)
       echo "session-scope-capability: invalid company_slug: $slug" >&2
       return 1
       ;;

package/dist/commands/integrations-connect.d.ts

@@ -17,6 +17,8 @@
  * "key" but is really OAuth-protected still connects on the first try.
  */
 import { Command } from "commander";
+import { consoleOrigin } from "../utils/console-origin.js";
+export { consoleOrigin };
 import type { AdminConnection } from "./integrations-core.js";
 import { type InstallInput } from "./integrations-api.js";
 interface ConnectOptions {
@@ -57,19 +59,6 @@ interface ConnectTarget {
     /** Human label for prompts and success lines. */
     label: string;
 }
-/**
- * The console that fronts the control plane this CLI is pointed at.
- *
- * A handoff must land on the console for the SAME backend, because that
- * console starts its own OAuth flow against its own backend. Sending a staging
- * session to the production console would connect the app in the wrong place —
- * so when the control plane is overridden and its console cannot be derived,
- * return undefined and say so rather than guess a host.
- *
- * `HQ_CONSOLE_URL` is the explicit override; otherwise the console is the
- * control-plane host with its `hqapi.` prefix removed.
- */
-export declare function consoleOrigin(vaultApiUrl?: string): string | undefined;
 /**
  * The console's Integrations page for a company, the console root when the
  * caller never named one (a single-membership session resolves the company
@@ -95,5 +84,4 @@ export declare function bringYourOwnClientHandoff(target: ConnectTarget, opts: C
 export declare function googleClientTypeHint(clientId: string, authorizationUrl: string): string | null;
 export declare function findAlreadyConnected(connections: readonly AdminConnection[], app: string): AdminConnection | undefined;
 export declare function registerConnectCommands(integrations: Command): void;
-export {};
 //# sourceMappingURL=integrations-connect.d.ts.map

package/dist/commands/integrations-connect.js

@@ -18,7 +18,9 @@
  */
 import chalk from "chalk";
 import open from "open";
-import { DEFAULT_VAULT_API_URL, ensureCognitoIdToken, } from "../utils/cognito-session.js";
+import { ensureCognitoIdToken } from "../utils/cognito-session.js";
+import { consoleOrigin } from "../utils/console-origin.js";
+export { consoleOrigin };
 import { getCompanyUid } from "../utils/vault-api.js";
 import { redactSensitiveUrl, redactUrlsInText } from "../utils/redact-url.js";
 import { IntegrationsCliError, bareProvider, connectionDomain, fetchAdminSurface, printJson, revokedConnectionDetails, resolveConnection, } from "./integrations-core.js";
@@ -536,37 +538,6 @@ async function connectViaOAuth(token, companyUid, target, opts) {
         listener.close();
     }
 }
-const PRODUCTION_CONSOLE_ORIGIN = "https://hq.computer";
-const PRODUCTION_VAULT_API_HOST = "hqapi.hq.computer";
-/**
- * The console that fronts the control plane this CLI is pointed at.
- *
- * A handoff must land on the console for the SAME backend, because that
- * console starts its own OAuth flow against its own backend. Sending a staging
- * session to the production console would connect the app in the wrong place —
- * so when the control plane is overridden and its console cannot be derived,
- * return undefined and say so rather than guess a host.
- *
- * `HQ_CONSOLE_URL` is the explicit override; otherwise the console is the
- * control-plane host with its `hqapi.` prefix removed.
- */
-export function consoleOrigin(vaultApiUrl = DEFAULT_VAULT_API_URL) {
-    const explicit = process.env.HQ_CONSOLE_URL?.trim();
-    if (explicit)
-        return explicit.replace(/\/+$/, "");
-    let api;
-    try {
-        api = new URL(vaultApiUrl);
-    }
-    catch {
-        return undefined;
-    }
-    if (api.host === PRODUCTION_VAULT_API_HOST)
-        return PRODUCTION_CONSOLE_ORIGIN;
-    if (!api.hostname.startsWith("hqapi."))
-        return undefined;
-    return `${api.protocol}//${api.host.slice("hqapi.".length)}`;
-}
 /**
  * The console's Integrations page for a company, the console root when the
  * caller never named one (a single-membership session resolves the company

package/dist/commands/lanes-message.d.ts

@@ -0,0 +1,9 @@
+import { type Ctx, type LaneMessageHandlerDeps, type LaneMessageOptions } from "./lanes-shared.js";
+export declare function createLaneMessageHandlers(deps: LaneMessageHandlerDeps): {
+    runMessage: (ctx: Ctx, laneId: string, opts: LaneMessageOptions) => Promise<void>;
+    recoverQueuedMessages: (ctx: Ctx, laneId: string) => Promise<{
+        action: "none" | "resumed" | "undeliverable";
+        message_count: number;
+    }>;
+};
+//# sourceMappingURL=lanes-message.d.ts.map