@indigoai-us/hq-cli 5.345.163 → 5.345.165

package/dist/commands/billing.js

@@ -30,8 +30,9 @@ import { vaultApiFetch, getCompanyUid } from "../utils/vault-api.js";
 import { mintPaymentLink } from "../utils/billing-gate.js";
 import { openUsageSwitch } from "../utils/team-upgrade.js";
 import { registerBillingSponsorCommands } from "./billing-sponsor.js";
-import { fetchCompanyPricingPlan, isUsageOnly, usageOnlyUpgradeLines, } from "../lib/billing/usage-only.js";
+import { fetchCompanyPricingPlan, isUsageOnly, pricingPlanFromBody, readBillingState, usageOnlyUpgradeLines, } from "../lib/billing/usage-only.js";
 import { fetchUsageCard } from "../lib/billing/usage-card.js";
+import { accountStatusLines } from "../lib/billing/billing-status-lines.js";
 import { registerBillingUsageCommand } from "./billing-usage.js";
 const CHARGED_ON = {
     team: "the Team subscription",
@@ -62,6 +63,94 @@ export function formatDatabaseBilling(db) {
     }
     return lines;
 }
+function asRecord(value) {
+    return value !== null && typeof value === "object" && !Array.isArray(value)
+        ? value
+        : null;
+}
+/**
+ * The plan a person can act on, in words. The summary's `billingStatus.plan`
+ * is the Stripe webhook's label and says "usage" for ANY non-Workforce
+ * subscription (a metered usage subscription on a company that still prices
+ * as a flat plan reads "usage" there, hq-pro summary.ts). The plan the server
+ * actually prices by is `billingState.kind` (hq-pro #5088) or, on an older
+ * server, `pricingPlan`; `billingStatus.plan` only separates Workforce from
+ * the rest. DEV-5179: a reporter read "usage" off the status JSON while
+ * `hq billing usage` said "flat plan"; both were right about different fields.
+ */
+export function describePlan(summary) {
+    const state = readBillingState(summary);
+    if (state) {
+        switch (state.kind) {
+            case "usage":
+                return "usage pricing";
+            case "usage-trial":
+                return state.trial
+                    ? `usage pricing (trial, ${state.trial.daysLeft} days left)`
+                    : "usage pricing (trial)";
+            case "legacy-payer":
+                // legacy-payer also covers invoice-billed companies, which have no
+                // Workforce subscription behind them.
+                return asRecord(summary.billingStatus)?.plan === "team"
+                    ? "Workforce (flat plan)"
+                    : "flat plan (billed by invoice)";
+            case "legacy-free":
+                return "Starter (free)";
+            case "enterprise":
+                return "Enterprise";
+            case "comped":
+                return "comped (not billed)";
+        }
+    }
+    if (pricingPlanFromBody(summary) === "usage-only")
+        return "usage pricing";
+    if (pricingPlanFromBody(summary) === "current") {
+        // An older server says "flat plan" but not which one: only a Workforce
+        // subscription is visible here, so anything else is named no further.
+        return asRecord(summary.billingStatus)?.plan === "team" ? "Workforce (flat plan)" : "flat plan";
+    }
+    // The server did not say which plan prices this company. Naming one here
+    // would guess, and a guess of "Starter (free)" told a paying company it was
+    // on the free plan.
+    return PLAN_UNAVAILABLE;
+}
+export const PLAN_UNAVAILABLE = "unavailable right now";
+/** True when the plan description already says the company prices by usage. */
+function isUsagePricingLabel(label) {
+    return label.startsWith("usage pricing");
+}
+/**
+ * A scheduled switch to usage pricing (hq-pro US-014 `GET
+ * /v1/billing/usage-switch`), or null. The route is owner-only and absent on
+ * older servers. A refusal (403, 404) reads as "nothing scheduled"; any other
+ * failure is "unreadable" so the status view can say so instead of implying
+ * no switch. The status view never fails on it.
+ */
+export async function fetchScheduledUsageSwitch(token, companyUid) {
+    try {
+        const res = await vaultApiFetch({
+            token,
+            path: "/v1/billing/usage-switch",
+            query: { companyUid },
+        });
+        if (res.status === 403 || res.status === 404)
+            return null;
+        if (!res.ok)
+            return "unreadable";
+        const body = asRecord(await res.json());
+        const phase = body?.phase;
+        const switchDate = body?.switchDate;
+        if ((phase === "scheduled" || phase === "preview") &&
+            typeof switchDate === "string" &&
+            Number.isFinite(Date.parse(switchDate))) {
+            return { switchDate, phase };
+        }
+        return null;
+    }
+    catch {
+        return "unreadable";
+    }
+}
 function fail(err) {
     console.error(chalk.red("Error:"), err instanceof Error ? err.message : String(err));
     process.exit(1);
@@ -101,6 +190,18 @@ export function registerBillingCommand(program) {
             }
             const sub = summary.subscriptionStatus ?? "none";
             console.log(`${chalk.bold("Subscription")}: ${sub}`);
+            const planLabel = describePlan(summary);
+            console.log(`${chalk.bold("Plan")}: ${planLabel}`);
+            if (!isUsagePricingLabel(planLabel) && planLabel !== PLAN_UNAVAILABLE) {
+                const scheduled = await fetchScheduledUsageSwitch(token, companyUid);
+                if (scheduled === "unreadable") {
+                    console.log("  Switch to usage pricing: could not be read right now.");
+                }
+                else if (scheduled) {
+                    console.log(`  Switch to usage pricing scheduled for ${scheduled.switchDate.slice(0, 10)}` +
+                        (scheduled.phase === "preview" ? " (preview window open)." : "."));
+                }
+            }
             const pm = summary.defaultPaymentMethod;
             if (pm?.present) {
                 const detail = pm.brand && pm.last4 ? `${pm.brand} ••••${pm.last4}` : "on file";
@@ -110,6 +211,12 @@ export function registerBillingCommand(program) {
                 console.log(`${chalk.bold("Card")}: ${chalk.yellow("no card on file")} — ` +
                     `run \`hq billing checkout\` to add one before provisioning paid resources.`);
             }
+            const state = readBillingState(summary);
+            if (state && (state.kind === "usage" || state.kind === "usage-trial")) {
+                const { card } = await fetchUsageCard();
+                for (const line of accountStatusLines(state, card))
+                    console.log(line);
+            }
             for (const line of formatDatabaseBilling(summary.databases))
                 console.log(line);
         }

package/dist/commands/deploy-domains.d.ts

@@ -17,6 +17,8 @@ export declare const deployDomainsPrompt: {
 };
 /** The sentence `buy` adds when the order's outcome is not known. */
 export declare function resumeOrderSentence(idempotencyKey: string): string;
+/** Shown when hq-pro registered the domain but could not capture the card charge. */
+export declare function retryChargeSentence(idempotencyKey: string): string;
 interface Binding {
     appId: string;
     orgSlug?: string;

package/dist/commands/deploy-domains.js

@@ -117,6 +117,10 @@ const SETTLED_PURCHASE_CODES = new Set([
 export function resumeOrderSentence(idempotencyKey) {
     return `The order may still be in progress. Run the same command again with --idempotency-key ${idempotencyKey} to finish or check it. Do not start a new order.`;
 }
+/** Shown when hq-pro registered the domain but could not capture the card charge. */
+export function retryChargeSentence(idempotencyKey) {
+    return `Run the same command again with --idempotency-key ${idempotencyKey} to retry the charge. Do not start a new order.`;
+}
 /** The registrant fields hq-pro accepts; nothing else from the file is sent. */
 const REGISTRANT_FIELDS = [
     "firstName", "lastName", "companyName", "address1", "address2",
@@ -312,16 +316,18 @@ async function resolveTarget(token, options) {
     if (!binding.orgSlug && options.company === undefined) {
         throw new DeployDomainsError("The folder's link does not name a company. Pass --company <slug>, or re-link the folder.", "COMPANY_REQUIRED");
     }
-    if (binding.orgSlug && options.company !== undefined && options.company !== binding.orgSlug) {
+    if (binding.orgSlug && options.company !== undefined && options.company.toLowerCase() !== binding.orgSlug) {
         throw new DeployDomainsError(`This folder is linked to an app in '${binding.orgSlug}', not '${displayText(options.company)}'. Drop --company, or pass --app <name or id>.`, "COMPANY_MISMATCH");
     }
     return {
         appId: binding.appId,
-        orgSlug: resolveSlug(options.company, binding.orgSlug),
+        // A matching --company may differ only in case; the link's slug is canonical.
+        orgSlug: binding.orgSlug ?? resolveSlug(options.company, undefined),
         appLabel: binding.appId,
     };
 }
 const HOSTNAME_LABEL = /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/;
+const ALL_DIGITS = /^\d+$/;
 /**
  * Normalize a domain to the ASCII form the server stores, using the same
  * hostname rule hq-deploy's validateAppHostname enforces: at least two
@@ -344,6 +350,13 @@ export function normalizeDomain(raw) {
     if (labels.length < 2 || labels.some((label) => label.length > 63 || !HOSTNAME_LABEL.test(label))) {
         throw invalid();
     }
+    // domainToASCII applies WHATWG IPv4 parsing ("1.2" becomes "1.0.0.2",
+    // "0x7f.1" becomes "127.0.0.1"), and a name it cannot parse as one comes
+    // back empty. No real top-level domain is numeric, so a numeric last label
+    // after the conversion is an address.
+    if (ALL_DIGITS.test(labels[labels.length - 1])) {
+        throw invalid();
+    }
     return domain;
 }
 function domainRoute(appId, domain, suffix = "") {
@@ -727,8 +740,10 @@ async function buyAction(domainArg, options) {
     }
     else if (body.paymentCaptured === false) {
         // hq-pro registered the name, but capturing the card authorization failed.
+        // A retry with the same key retrieves the same authorization, replays the
+        // registration for this order and captures again (hq-pro domain-purchase.ts).
         console.log(`Registered ${displayText(domain)}.${expires} The card was authorized for ${usd(expectedPriceUsd)}, ` +
-            `but the charge has not completed yet. HQ billing follows up on it. Do not buy the domain again.`);
+            `but the charge did not complete. ${retryChargeSentence(idempotencyKey)}`);
     }
     else {
         console.log(`Bought ${displayText(domain)} for ${usd(expectedPriceUsd)}.${expires}`);

package/dist/commands/scan.d.ts

@@ -4,6 +4,9 @@
  *   hq scan secrets               scan the staged changes of the current repo
  *   hq scan secrets <file...>     scan whole files instead
  *   hq scan secrets --json        findings as JSON
+ *   hq scan secrets --repo <dir> [--snapshot-root <dir>] [--allowlist-rev <rev>] <file...>
+ *                                 scan files with that repo's committed
+ *                                 .gitleaks.toml allowlists (used by pr-check)
  *
  * Rules: the vendored gitleaks default rule set (MIT, vendor/gitleaks/) plus
  * HQ's own token patterns. No network, no account, no quota. A staged scan also
@@ -18,6 +21,9 @@ import { Command } from "commander";
 interface ScanSecretsOptions {
     json?: boolean;
     staged?: boolean;
+    repo?: string;
+    snapshotRoot?: string;
+    allowlistRev?: string;
 }
 export declare function runScanSecrets(paths: string[], opts: ScanSecretsOptions, cwd?: string): number;
 export declare function registerScanCommand(program: Command): void;

package/dist/commands/scan.js

@@ -4,6 +4,9 @@
  *   hq scan secrets               scan the staged changes of the current repo
  *   hq scan secrets <file...>     scan whole files instead
  *   hq scan secrets --json        findings as JSON
+ *   hq scan secrets --repo <dir> [--snapshot-root <dir>] [--allowlist-rev <rev>] <file...>
+ *                                 scan files with that repo's committed
+ *                                 .gitleaks.toml allowlists (used by pr-check)
  *
  * Rules: the vendored gitleaks default rule set (MIT, vendor/gitleaks/) plus
  * HQ's own token patterns. No network, no account, no quota. A staged scan also
@@ -31,7 +34,11 @@ function report(findings, scope) {
 export function runScanSecrets(paths, opts, cwd = process.cwd()) {
     let findings;
     try {
-        findings = paths.length && !opts.staged ? scanFiles(paths) : scanStaged(cwd);
+        if (opts.snapshotRoot !== undefined && opts.repo === undefined)
+            throw new ScanInputError("--snapshot-root needs --repo");
+        if (opts.allowlistRev !== undefined && opts.repo === undefined)
+            throw new ScanInputError("--allowlist-rev needs --repo");
+        findings = paths.length && !opts.staged ? scanFiles(paths, { repo: opts.repo, snapshotRoot: opts.snapshotRoot, allowlistRev: opts.allowlistRev }) : scanStaged(cwd);
     }
     catch (err) {
         const msg = err instanceof ScanInputError || err instanceof ScanConfigError ? err.message : `scan failed: ${err instanceof Error ? err.message : String(err)}`;
@@ -56,6 +63,9 @@ export function registerScanCommand(program) {
         .argument("[files...]", "Scan these files instead of the staged changes")
         .option("--staged", "Scan the staged changes (default when no files are given)")
         .option("--json", "Print findings as JSON")
+        .option("--repo <dir>", "With files: apply this repo's committed .gitleaks.toml allowlists, matching repo-relative paths")
+        .option("--snapshot-root <dir>", "With --repo: files under <dir>/<commit>/<path> are matched as <path>")
+        .option("--allowlist-rev <rev>", "With --repo: read .gitleaks.toml from this commit instead of HEAD")
         .action((files, opts) => {
         process.exitCode = runScanSecrets(files ?? [], opts);
     });

package/dist/lib/billing/billing-status-lines.d.ts

@@ -0,0 +1,14 @@
+/**
+ * The account lines `hq billing status`, `hq billing usage` and
+ * `hq billing usage --card` print from hq-pro's shared `billingState` (US-025).
+ * One helper so every surface shows the same trial usage, included usage,
+ * spend limit and card prompt for the same state.
+ */
+import { type UsageCard } from "./usage-card.js";
+import type { SharedBillingState } from "./usage-only.js";
+/**
+ * Lines for one billing state. Legacy, enterprise and comped accounts get no
+ * lines. The member view carries no money figures, so it gets none either.
+ */
+export declare function accountStatusLines(state: SharedBillingState | null, card?: UsageCard): string[];
+//# sourceMappingURL=billing-status-lines.d.ts.map

package/dist/lib/billing/billing-status-lines.js

@@ -0,0 +1,43 @@
+/**
+ * The account lines `hq billing status`, `hq billing usage` and
+ * `hq billing usage --card` print from hq-pro's shared `billingState` (US-025).
+ * One helper so every surface shows the same trial usage, included usage,
+ * spend limit and card prompt for the same state.
+ */
+import { BUNDLED_USAGE_CARD, formatCardUsd } from "./usage-card.js";
+function usd(cents) {
+    return `$${(cents / 100).toFixed(2)}`;
+}
+function onUsagePricing(state) {
+    return state.kind === "usage" || state.kind === "usage-trial";
+}
+/**
+ * Lines for one billing state. Legacy, enterprise and comped accounts get no
+ * lines. The member view carries no money figures, so it gets none either.
+ */
+export function accountStatusLines(state, card = BUNDLED_USAGE_CARD) {
+    if (!state || !onUsagePricing(state))
+        return [];
+    const lines = [];
+    if (state.kind === "usage-trial" && state.trial) {
+        lines.push(`Trial: ${state.trial.daysLeft} days left (ends ${state.trial.endsAt.slice(0, 10)})`);
+        if (state.view === "full" && state.trial.usedCents !== null) {
+            const capCents = state.trial.capCents ?? card.trial.capUsd * 100;
+            lines.push(`Trial usage: ${usd(state.trial.usedCents)} of the ${usd(capCents)} trial cap`);
+        }
+    }
+    if (state.view !== "full")
+        return lines;
+    lines.push(`Included usage: ${formatCardUsd(card.includedUsd)} each month`);
+    if (state.spendLimit) {
+        lines.push(state.spendLimit.cents === null
+            ? "Spend limit: none set"
+            : `Spend limit: ${usd(state.spendLimit.cents)} a month`);
+    }
+    if (state.cardPrompt) {
+        lines.push(`Add a card: usage is past the ${formatCardUsd(card.includedUsd)} included this month. ` +
+            "Run `hq billing checkout` to keep working past it.");
+    }
+    return lines;
+}
+//# sourceMappingURL=billing-status-lines.js.map

package/dist/lib/billing/usage-only.d.ts

@@ -35,10 +35,28 @@ export interface SharedBillingState {
     kind: BillingStateKind;
     scope: "company" | "person";
     view: "full" | "member";
+    /**
+     * The usage trial, or null. `capCents` is the trial's usage cap and
+     * `usedCents` what the trial has used so far; both are null when the server
+     * does not say (member view, older server).
+     */
     trial: {
         daysLeft: number;
         endsAt: string;
+        capCents: number | null;
+        usedCents: number | null;
+    } | null;
+    /**
+     * The monthly spend limit. `cents: null` means no limit is set. The whole
+     * field is null off usage pricing and in the member view.
+     */
+    spendLimit: {
+        cents: number | null;
     } | null;
+    /** Whether a card is on file. Null when the server does not say. */
+    cardOnFile: boolean | null;
+    /** Usage passed the included allowance with no card on file. */
+    cardPrompt: boolean;
     /** A pause the server is applying now, or null. */
     paused: {
         reason: string;

package/dist/lib/billing/usage-only.js

@@ -65,7 +65,21 @@ function readTrial(value) {
         !Number.isFinite(Date.parse(trial.endsAt))) {
         return undefined;
     }
-    return { daysLeft: trial.daysLeft, endsAt: trial.endsAt };
+    return {
+        daysLeft: trial.daysLeft,
+        endsAt: trial.endsAt,
+        capCents: centsOrNull(trial.capCents),
+        usedCents: centsOrNull(trial.usedCents),
+    };
+}
+function centsOrNull(value) {
+    return typeof value === "number" && Number.isFinite(value) && value >= 0 ? value : null;
+}
+function readSpendLimit(value) {
+    const limit = asRecord(value);
+    if (!limit)
+        return null;
+    return { cents: centsOrNull(limit.cents) };
 }
 function readPaused(value) {
     const paused = asRecord(value);
@@ -102,6 +116,9 @@ export function readBillingState(body) {
         scope: state.scope,
         view: state.view,
         trial,
+        spendLimit: readSpendLimit(state.spendLimit),
+        cardOnFile: typeof state.cardOnFile === "boolean" ? state.cardOnFile : null,
+        cardPrompt: state.cardPrompt === true,
         paused: readPaused(state.paused),
         actions: {
             addCard: actions?.addCard === true,

package/dist/lib/doctor/checks/sync-runtime.d.ts

@@ -1,13 +1,47 @@
+import { readSessionCompanyLock } from "../../session-company-lock.js";
 import type { CheckResult } from "../types.js";
 export declare const SYNC_RUNTIME_WINDOW_MS: number;
 /** Ignore timing and restart signals until a newly started receiver has settled. */
 export declare const SYNC_RUNTIME_RESTART_WARMUP_MS: number;
+/** Most refused vault keys named by `sync.runtime.pull-access-denied`. */
+export declare const PULL_DENIED_KEY_CAP = 10;
+/** A key refused on at least this many pulls in the hour is a standing condition, not a one-off. */
+export declare const PULL_DENIED_MIN_REPEATS = 2;
 export interface SyncRuntimeOptions {
     now: number;
     conflictCount?: number;
+    /**
+     * Company scopes whose refused vault keys may be named. `undefined` means
+     * the session holds no company lock, so every scope may be named. Keys in
+     * any other scope (including `personal` when it is not listed) are counted
+     * but never named, so `hq doctor` in a session locked to company A cannot
+     * print company B's file names from the machine-wide sync log.
+     */
+    nameableCompanies?: readonly string[];
 }
+/**
+ * Which cloud call a receiver permission refusal came from. Closed vocabulary
+ * derived from the hq-cloud receiver's event names, so the breakdown can be
+ * reported without the error prose.
+ *
+ *   - `subscribe`: `POST /v1/sync/subscribe` itself answered 403 while the
+ *     receiver re-vended its queue credentials.
+ *   - `sqs-receive` / `sqs-visibility` / `sqs-delete`: the per-device queue
+ *     credentials vended by subscribe were refused by SQS. One bad vend
+ *     repeats on every poll and lease heartbeat until the runner restarts.
+ *   - `cloudwatch-metric`: the latency metric publisher was refused.
+ *   - `targeted-pull`: the object pull after a change event failed; the
+ *     refused keys are named by `sync.runtime.pull-access-denied`.
+ *   - `runner-error`: a runner `error` record outside the receiver.
+ */
+export type ReceiverRefusalCall = "subscribe" | "sqs-receive" | "sqs-visibility" | "sqs-delete" | "cloudwatch-metric" | "targeted-pull" | "runner-error" | "other";
 /** Classify the last hour of sync log lines into privacy-safe results. */
 export declare function analyzeSyncRuntimeLog(lines: readonly string[], options: SyncRuntimeOptions): CheckResult[];
+/**
+ * Company scopes this session may see named: `undefined` (all) when there is
+ * no session or no company lock; nothing when the lock cannot be verified.
+ */
+export declare function sessionNameableCompanies(env: NodeJS.ProcessEnv, readLock?: typeof readSessionCompanyLock): readonly string[] | undefined;
 /** Read the machine's sync logs and client health file. */
 export declare function defaultSyncRuntimeResults(now: Date, hqHome?: string, env?: NodeJS.ProcessEnv): CheckResult[];
 //# sourceMappingURL=sync-runtime.d.ts.map