@indigoai-us/hq-cli 5.345.173 → 5.345.174

package/CHANGELOG.md

@@ -2,6 +2,13 @@
 
 ## [Unreleased]
 
+## [5.345.174] — 2026-10-27
+- `hq channels delete <name> --yes` deletes a channel you own, including its
+  messages. Group DMs stay undeletable. Without `--yes` the command refuses.
+- New `hq deploy domains base add | status | remove` sets up a company deploy domain, so every app of the company serves at `<app>.<your-domain>`. `add` shows the monthly price for your company (included on Enterprise) and the two DNS records to create. `status --wait` checks every 15 seconds until the domain is live and gives up after 15 minutes (`--timeout` sets up to 60). `remove` releases the domain.
+- Any signed-in HQ user can now create a bot with `--hq-fleet-runtime`: the CLI downloads the signed HQ Fleet Local release through short-lived links from HQ instead of a private GitHub release, and still checks every file against its pinned hash and the release signature. GitHub access is only used when HQ has no download for the pinned version.
+- A bot created with `--hq-fleet-runtime` now runs HQ's own hooks: its tool calls, prompts and turn ends go through the HQ folder's `.claude` hooks, so it is refused the same core edits, secret dumps and unbound company reads a Claude Code session is, and it binds a company for its conversation before working on that company's files. Messages that arrive while the bot is answering now wait for that answer instead of stalling its inbox. Pins hq-fleet-local v0.4.6.
+
 ## [5.345.173] — 2026-10-27
 - The sync-core reconcile now counts the conflict and merge actions in a vault's read-only plan as writes: a vault is held read-only while its plan would write more than 100 conflict or merge copies, the count is recorded next to the plan's upload, download and delete counts in `~/.hq/sync-core/rollout.json`, and `hq sync-core status` prints it.
 - A machine can keep one vault off the new sync engine while its company switch is on: `~/.hq/sync-core/skip.json` with `{"vaults": {"<vault uid>": "<reason>"}}` makes the reconcile leave that vault on the current sync (stopping its engine unit if one ran), record the uid and reason under `skipped` in `rollout.json`, and show it in `hq sync-core status`. A malformed file is reported as a warning and skips nothing.

package/dist/command-catalog.generated.d.ts

@@ -4365,6 +4365,31 @@ export declare const COMMAND_CATALOG: readonly [{
             readonly hidden: false;
         }];
         readonly subcommands: readonly [];
+    }, {
+        readonly name: "delete";
+        readonly description: "Delete a channel you own, including its messages. Group DMs cannot be deleted.";
+        readonly aliases: readonly [];
+        readonly hidden: false;
+        readonly helpOption: true;
+        readonly helpCommand: false;
+        readonly usage: "[options] <channel>";
+        readonly helpText: readonly [];
+        readonly arguments: readonly [{
+            readonly name: "channel";
+            readonly required: true;
+            readonly variadic: false;
+            readonly description: "";
+        }];
+        readonly options: readonly [{
+            readonly flags: "--json";
+            readonly description: "Output { ok, deleted } as JSON.";
+            readonly hidden: false;
+        }, {
+            readonly flags: "--yes";
+            readonly description: "Confirm the delete. Required.";
+            readonly hidden: false;
+        }];
+        readonly subcommands: readonly [];
     }];
 }, {
     readonly name: "onboard";
@@ -19837,6 +19862,111 @@ export declare const COMMAND_CATALOG: readonly [{
                 readonly hidden: false;
             }];
             readonly subcommands: readonly [];
+        }, {
+            readonly name: "base";
+            readonly description: "Manage the company deploy domain: one domain for every app (<app>.<domain>)";
+            readonly aliases: readonly [];
+            readonly hidden: false;
+            readonly helpOption: true;
+            readonly helpCommand: true;
+            readonly usage: "[options] [command]";
+            readonly helpText: readonly [];
+            readonly arguments: readonly [];
+            readonly options: readonly [];
+            readonly subcommands: readonly [{
+                readonly name: "add";
+                readonly description: "Claim a company deploy domain; prints the price and the DNS records";
+                readonly aliases: readonly [];
+                readonly hidden: false;
+                readonly helpOption: true;
+                readonly helpCommand: false;
+                readonly usage: "[options] <domain>";
+                readonly helpText: readonly [];
+                readonly arguments: readonly [{
+                    readonly name: "domain";
+                    readonly required: true;
+                    readonly variadic: false;
+                    readonly description: "";
+                }];
+                readonly options: readonly [{
+                    readonly flags: "--yes";
+                    readonly description: "add without a prompt (the domain can add a monthly charge)";
+                    readonly hidden: false;
+                }, {
+                    readonly flags: "--company <slug>";
+                    readonly description: "use this company instead of the linked or active company";
+                    readonly hidden: false;
+                }, {
+                    readonly flags: "--path <dir>";
+                    readonly description: "folder linked to an app of the company (default: current folder)";
+                    readonly hidden: false;
+                }, {
+                    readonly flags: "--json";
+                    readonly description: "print machine-readable JSON";
+                    readonly hidden: false;
+                }];
+                readonly subcommands: readonly [];
+            }, {
+                readonly name: "status";
+                readonly description: "Check the company deploy domain and advance it toward live (exits 2 while not live)";
+                readonly aliases: readonly [];
+                readonly hidden: false;
+                readonly helpOption: true;
+                readonly helpCommand: false;
+                readonly usage: "[options]";
+                readonly helpText: readonly [];
+                readonly arguments: readonly [];
+                readonly options: readonly [{
+                    readonly flags: "--wait";
+                    readonly description: "keep checking until it is live or the timeout passes";
+                    readonly hidden: false;
+                }, {
+                    readonly flags: "--timeout <minutes>";
+                    readonly description: "stop waiting after this many minutes (default 15, at most 60)";
+                    readonly hidden: false;
+                }, {
+                    readonly flags: "--company <slug>";
+                    readonly description: "use this company instead of the linked or active company";
+                    readonly hidden: false;
+                }, {
+                    readonly flags: "--path <dir>";
+                    readonly description: "folder linked to an app of the company (default: current folder)";
+                    readonly hidden: false;
+                }, {
+                    readonly flags: "--json";
+                    readonly description: "print machine-readable JSON";
+                    readonly hidden: false;
+                }];
+                readonly subcommands: readonly [];
+            }, {
+                readonly name: "remove";
+                readonly description: "Release the company deploy domain";
+                readonly aliases: readonly [];
+                readonly hidden: false;
+                readonly helpOption: true;
+                readonly helpCommand: false;
+                readonly usage: "[options]";
+                readonly helpText: readonly [];
+                readonly arguments: readonly [];
+                readonly options: readonly [{
+                    readonly flags: "--yes";
+                    readonly description: "remove without a prompt";
+                    readonly hidden: false;
+                }, {
+                    readonly flags: "--company <slug>";
+                    readonly description: "use this company instead of the linked or active company";
+                    readonly hidden: false;
+                }, {
+                    readonly flags: "--path <dir>";
+                    readonly description: "folder linked to an app of the company (default: current folder)";
+                    readonly hidden: false;
+                }, {
+                    readonly flags: "--json";
+                    readonly description: "print machine-readable JSON";
+                    readonly hidden: false;
+                }];
+                readonly subcommands: readonly [];
+            }];
         }, {
             readonly name: "search";
             readonly description: "Check whether a domain can be bought, and its price";

package/dist/command-catalog.generated.js

@@ -5290,6 +5290,37 @@ export const COMMAND_CATALOG = [
                     }
                 ],
                 "subcommands": []
+            },
+            {
+                "name": "delete",
+                "description": "Delete a channel you own, including its messages. Group DMs cannot be deleted.",
+                "aliases": [],
+                "hidden": false,
+                "helpOption": true,
+                "helpCommand": false,
+                "usage": "[options] <channel>",
+                "helpText": [],
+                "arguments": [
+                    {
+                        "name": "channel",
+                        "required": true,
+                        "variadic": false,
+                        "description": ""
+                    }
+                ],
+                "options": [
+                    {
+                        "flags": "--json",
+                        "description": "Output { ok, deleted } as JSON.",
+                        "hidden": false
+                    },
+                    {
+                        "flags": "--yes",
+                        "description": "Confirm the delete. Required.",
+                        "hidden": false
+                    }
+                ],
+                "subcommands": []
             }
         ]
     },
@@ -24186,6 +24217,134 @@ export const COMMAND_CATALOG = [
                         ],
                         "subcommands": []
                     },
+                    {
+                        "name": "base",
+                        "description": "Manage the company deploy domain: one domain for every app (<app>.<domain>)",
+                        "aliases": [],
+                        "hidden": false,
+                        "helpOption": true,
+                        "helpCommand": true,
+                        "usage": "[options] [command]",
+                        "helpText": [],
+                        "arguments": [],
+                        "options": [],
+                        "subcommands": [
+                            {
+                                "name": "add",
+                                "description": "Claim a company deploy domain; prints the price and the DNS records",
+                                "aliases": [],
+                                "hidden": false,
+                                "helpOption": true,
+                                "helpCommand": false,
+                                "usage": "[options] <domain>",
+                                "helpText": [],
+                                "arguments": [
+                                    {
+                                        "name": "domain",
+                                        "required": true,
+                                        "variadic": false,
+                                        "description": ""
+                                    }
+                                ],
+                                "options": [
+                                    {
+                                        "flags": "--yes",
+                                        "description": "add without a prompt (the domain can add a monthly charge)",
+                                        "hidden": false
+                                    },
+                                    {
+                                        "flags": "--company <slug>",
+                                        "description": "use this company instead of the linked or active company",
+                                        "hidden": false
+                                    },
+                                    {
+                                        "flags": "--path <dir>",
+                                        "description": "folder linked to an app of the company (default: current folder)",
+                                        "hidden": false
+                                    },
+                                    {
+                                        "flags": "--json",
+                                        "description": "print machine-readable JSON",
+                                        "hidden": false
+                                    }
+                                ],
+                                "subcommands": []
+                            },
+                            {
+                                "name": "status",
+                                "description": "Check the company deploy domain and advance it toward live (exits 2 while not live)",
+                                "aliases": [],
+                                "hidden": false,
+                                "helpOption": true,
+                                "helpCommand": false,
+                                "usage": "[options]",
+                                "helpText": [],
+                                "arguments": [],
+                                "options": [
+                                    {
+                                        "flags": "--wait",
+                                        "description": "keep checking until it is live or the timeout passes",
+                                        "hidden": false
+                                    },
+                                    {
+                                        "flags": "--timeout <minutes>",
+                                        "description": "stop waiting after this many minutes (default 15, at most 60)",
+                                        "hidden": false
+                                    },
+                                    {
+                                        "flags": "--company <slug>",
+                                        "description": "use this company instead of the linked or active company",
+                                        "hidden": false
+                                    },
+                                    {
+                                        "flags": "--path <dir>",
+                                        "description": "folder linked to an app of the company (default: current folder)",
+                                        "hidden": false
+                                    },
+                                    {
+                                        "flags": "--json",
+                                        "description": "print machine-readable JSON",
+                                        "hidden": false
+                                    }
+                                ],
+                                "subcommands": []
+                            },
+                            {
+                                "name": "remove",
+                                "description": "Release the company deploy domain",
+                                "aliases": [],
+                                "hidden": false,
+                                "helpOption": true,
+                                "helpCommand": false,
+                                "usage": "[options]",
+                                "helpText": [],
+                                "arguments": [],
+                                "options": [
+                                    {
+                                        "flags": "--yes",
+                                        "description": "remove without a prompt",
+                                        "hidden": false
+                                    },
+                                    {
+                                        "flags": "--company <slug>",
+                                        "description": "use this company instead of the linked or active company",
+                                        "hidden": false
+                                    },
+                                    {
+                                        "flags": "--path <dir>",
+                                        "description": "folder linked to an app of the company (default: current folder)",
+                                        "hidden": false
+                                    },
+                                    {
+                                        "flags": "--json",
+                                        "description": "print machine-readable JSON",
+                                        "hidden": false
+                                    }
+                                ],
+                                "subcommands": []
+                            }
+                        ]
+                    },
                     {
                         "name": "search",
                         "description": "Check whether a domain can be bought, and its price",

package/dist/commands/channels.js

@@ -212,6 +212,88 @@ async function runChannelsMembers(channelName, opts) {
         process.exit(1);
     }
 }
+function channelDeleteError(status, err) {
+    const code = err.code ?? "";
+    if (code === "CHANNEL_NOT_OWNER" || status === 403) {
+        return "Only the channel owner may delete the channel.";
+    }
+    if (code === "CHANNEL_GROUP_NOT_DELETABLE" || status === 409) {
+        return "Group DMs cannot be deleted.";
+    }
+    if (code === "CHANNEL_DELETE_INCOMPLETE" || status === 503) {
+        return "Channel deletion did not finish — try again.";
+    }
+    return err.error ?? err.message ?? `Could not delete channel (HTTP ${status}).`;
+}
+/**
+ * `hq channels delete` — owner-only. The server already accepts
+ * DELETE /v1/notify/channels/{id} and removes messages with the channel.
+ * `--yes` is required so a mistyped name cannot wipe a room.
+ */
+async function runChannelsDelete(channelName, opts) {
+    try {
+        if (!opts.yes) {
+            const message = "This permanently deletes the channel and its messages. Re-run with --yes to confirm.";
+            if (opts.json) {
+                console.log(JSON.stringify({ ok: false, error: message }, null, 2));
+            }
+            console.error(chalk.red(message));
+            process.exit(1);
+        }
+        const token = await ensureCognitoToken();
+        const channels = await fetchChannels(token);
+        const matches = matchChannelsByName(channels, channelName);
+        if (matches.length === 0) {
+            const message = `No channel named '${channelName}' — run \`hq channels\` to see your channels.`;
+            const suggestions = suggestChannels(channels, channelName);
+            if (opts.json) {
+                console.log(JSON.stringify({ ok: false, error: message, suggestions }, null, 2));
+            }
+            console.error(chalk.red(withChannelSuggestions(message, suggestions)));
+            process.exit(1);
+        }
+        if (matches.length > 1) {
+            const scopes = matches.map((match) => match.scope ?? "?").join(", ");
+            console.error(chalk.red(`'${channelName}' matches ${matches.length} channels (${scopes}) — this is ambiguous.`));
+            process.exit(1);
+        }
+        const target = matches[0];
+        if (target.scope === "group") {
+            const message = "Group DMs cannot be deleted.";
+            if (opts.json) {
+                console.log(JSON.stringify({ ok: false, error: message, code: "CHANNEL_GROUP_NOT_DELETABLE" }, null, 2));
+            }
+            console.error(chalk.red(message));
+            process.exit(1);
+        }
+        const res = await vaultApiFetch({
+            token,
+            path: `/v1/notify/channels/${encodeURIComponent(target.channelId)}`,
+            method: "DELETE",
+        });
+        if (!res.ok) {
+            const err = (await res.json().catch(() => ({})));
+            const message = channelDeleteError(res.status, err);
+            if (opts.json) {
+                console.log(JSON.stringify({ ok: false, error: message, code: err.code ?? null, status: res.status }, null, 2));
+            }
+            console.error(chalk.red(message));
+            process.exit(1);
+        }
+        const body = (await res.json().catch(() => ({})));
+        const deleted = body.deleted ?? target.channelId;
+        if (opts.json) {
+            console.log(JSON.stringify({ ok: true, deleted }, null, 2));
+        }
+        else {
+            console.log(`Deleted ${target.name ?? target.slug ?? deleted}.`);
+        }
+    }
+    catch (err) {
+        console.error(chalk.red("Error:"), err instanceof Error ? err.message : String(err));
+        process.exit(1);
+    }
+}
 export function registerChannelsCommand(program) {
     const channels = program
         .command("channels")
@@ -239,5 +321,13 @@ export function registerChannelsCommand(program) {
         .action(async (channelName, opts) => {
         await runChannelsMembers(channelName, opts);
     });
+    channels
+        .command("delete <channel>")
+        .description("Delete a channel you own, including its messages. Group DMs cannot be deleted.")
+        .option("--json", "Output { ok, deleted } as JSON.")
+        .option("--yes", "Confirm the delete. Required.")
+        .action(async (channelName, opts) => {
+        await runChannelsDelete(channelName, opts);
+    });
 }
 //# sourceMappingURL=channels.js.map

package/dist/commands/deploy-domains.d.ts

@@ -47,6 +47,26 @@ export declare function addOnConfirmQuestion(domain: string, environment: string
 export declare const PURCHASE_TERMS_UNAVAILABLE = "The renewal and refund terms could not be loaded. Check them on the HQ pricing page before you buy.";
 /** The purchase terms published as usage.domains.purchase. Null when not published. */
 export declare function purchaseTermsLine(pricing: Record<string, unknown> | null): string | null;
+/** Hard deadline for `base status --wait`, so a script never waits forever. */
+export declare const BASE_WAIT_DEFAULT_MINUTES = 15;
+export declare const BASE_WAIT_MAX_MINUTES = 60;
+/** Clock hooks for `base status --wait`. Tests replace these. */
+export declare const deployDomainsClock: {
+    now: () => number;
+    sleep: (ms: number) => Promise<void>;
+};
+/**
+ * The price line for a company deploy domain, from the server's answer:
+ * Enterprise includes it; a company with a price override (or comped) pays
+ * what the server says, $0 included; otherwise the server's price, falling
+ * back to the published premium price, then $500.
+ */
+export declare function baseDomainPriceLine(body: {
+    billingBasis?: unknown;
+    monthlyPriceUsd?: unknown;
+}, pricing: Record<string, unknown> | null): string | undefined;
+/** The approval question for `base add`, before the server says the basis. */
+export declare function baseAddConfirmQuestion(domain: string, orgSlug: string, pricing: Record<string, unknown> | null): string;
 export declare function parsePrice(raw: string): number;
 export declare function registerDeployDomainsCommand(deploy: Command): void;
 export {};

package/dist/commands/deploy-domains.js

@@ -615,6 +615,223 @@ async function removeAction(domainArg, options) {
         console.log(displayText(warning));
     }
 }
+// ---------------------------------------------------------------------------
+// Company deploy domain (`base`): one domain for every app of the company
+// (`<app>.<domain>`), served by hq-deploy's /api/orgs/:orgSlug/base-domain
+// routes, the same ones the desktop Deployments panel uses. The flag,
+// Enterprise and price checks run on the server (hq-pro), so this command
+// prints the server's answer: billingBasis and monthlyPriceUsd.
+/** Hard deadline for `base status --wait`, so a script never waits forever. */
+export const BASE_WAIT_DEFAULT_MINUTES = 15;
+export const BASE_WAIT_MAX_MINUTES = 60;
+const BASE_POLL_INTERVAL_MS = 15_000;
+/** Clock hooks for `base status --wait`. Tests replace these. */
+export const deployDomainsClock = {
+    now: () => Date.now(),
+    sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms)),
+};
+const BASE_MESSAGES = {
+    DOMAIN_NOT_ENTITLED: "A company deploy domain is not enabled for this company yet.",
+    BASE_DOMAIN_NOT_FOUND: "This company has no deploy domain. Add one with 'hq deploy domains base add <domain>'.",
+    BASE_DOMAIN_ALREADY_SET: "This company already has a deploy domain. Remove it first with 'hq deploy domains base remove'.",
+    BASE_DOMAIN_CLAIM_EXPIRED: "The claim expired before it went live. Add the domain again to get new DNS records.",
+    BASE_DOMAIN_CLAIMED: "That domain is already the deploy domain of another company.",
+    ORG_ACCESS_DENIED: "You are not a member of that company.",
+};
+async function baseError(response, orgSlug) {
+    const clone = response.clone();
+    const body = await readBody(clone);
+    const code = apiCode(body, response.status);
+    if (BASE_MESSAGES[code] && !SERVER_WORDED_CODES.has(code)) {
+        return new DeployDomainsError(BASE_MESSAGES[code], code, response.status);
+    }
+    if (response.status === 409 && !DEPLOY_MESSAGES[code]) {
+        const serverMessage = apiField(body, "message");
+        if (typeof serverMessage === "string" && serverMessage.trim()) {
+            return new DeployDomainsError(displayText(serverMessage), code, response.status);
+        }
+    }
+    return deployError(response, orgSlug);
+}
+/**
+ * The price line for a company deploy domain, from the server's answer:
+ * Enterprise includes it; a company with a price override (or comped) pays
+ * what the server says, $0 included; otherwise the server's price, falling
+ * back to the published premium price, then $500.
+ */
+export function baseDomainPriceLine(body, pricing) {
+    const basis = body.billingBasis;
+    const price = typeof body.monthlyPriceUsd === "number" && body.monthlyPriceUsd >= 0 ? body.monthlyPriceUsd : undefined;
+    if (basis === "enterprise")
+        return "Included with the Enterprise plan: no monthly charge.";
+    if (basis === "comped")
+        return `This company deploy domain is included for this company: ${usd(price ?? 0)}/month.`;
+    if (basis === "paid") {
+        const published = domainsBlock(pricing)?.premiumUsd;
+        const amount = price ?? (typeof published === "number" && published > 0 ? published : 500);
+        return amount === 0
+            ? "This company deploy domain is $0/month for this company (price override)."
+            : `This company deploy domain adds ${usd(amount)}/month to the company bill.`;
+    }
+    return undefined;
+}
+/** The approval question for `base add`, before the server says the basis. */
+export function baseAddConfirmQuestion(domain, orgSlug, pricing) {
+    const premium = domainsBlock(pricing)?.premiumUsd;
+    const price = typeof premium === "number" && premium > 0 ? `${usd(premium)}/month` : "a monthly add-on";
+    return `Make ${displayText(domain)} the deploy domain of '${orgSlug}', so every app serves at <app>.${displayText(domain)}? ` +
+        `It costs ${price}, billed to '${orgSlug}', unless the company is Enterprise or has a price override.`;
+}
+function baseSlug(options) {
+    if (options.company !== undefined)
+        return resolveSlug(options.company, undefined);
+    const binding = readLinkedApp(path.resolve(options.path ?? process.cwd()));
+    return resolveSlug(undefined, binding?.orgSlug);
+}
+function baseRoute(orgSlug, suffix = "") {
+    return `/api/orgs/${encodeURIComponent(orgSlug)}/base-domain${suffix}`;
+}
+function baseState(body) {
+    const certificate = body.certificate && typeof body.certificate === "object" ? body.certificate : {};
+    const serving = body.serving && typeof body.serving === "object" ? body.serving : {};
+    const status = typeof body.status === "string" ? body.status : "unknown";
+    const servingStatus = typeof serving.status === "string" ? serving.status : null;
+    return {
+        ...(typeof body.baseDomain === "string" ? { baseDomain: body.baseDomain } : {}),
+        status,
+        certStatus: typeof certificate.status === "string" ? certificate.status : null,
+        servingStatus,
+        servingError: typeof serving.error === "string" && serving.error ? serving.error : null,
+        records: dnsRecords(body.records),
+        live: status === "live" || servingStatus === "live",
+        raw: body,
+    };
+}
+function describeBaseState(state) {
+    if (state.live)
+        return "live";
+    if (state.status === "failed")
+        return "failed";
+    if (state.certStatus !== "ISSUED")
+        return `waiting for DNS validation (certificate ${state.certStatus ?? "not requested"})`;
+    return `certificate issued, serving ${state.servingStatus ?? "not attached yet"}`;
+}
+async function baseAddAction(domainArg, options) {
+    const domain = normalizeDomain(domainArg);
+    const token = await ensureCognitoToken();
+    const orgSlug = baseSlug(options);
+    const pricing = await fetchPricingBody();
+    await confirm(baseAddConfirmQuestion(domain, orgSlug, pricing), options.yes, "add the company deploy domain");
+    const response = await request(token, orgSlug, baseRoute(orgSlug), "POST", { baseDomain: domain });
+    if (!response.ok)
+        throw await baseError(response, orgSlug);
+    const body = await readBody(response);
+    const state = baseState(body);
+    const priceLine = baseDomainPriceLine(body, pricing);
+    if (options.json) {
+        console.log(safeJson({
+            ok: true,
+            orgSlug,
+            baseDomain: state.baseDomain ?? domain,
+            status: state.status,
+            certificate: state.certStatus,
+            records: state.records,
+            ...(typeof body.billingBasis === "string" ? { billingBasis: body.billingBasis } : {}),
+            ...(typeof body.monthlyPriceUsd === "number" ? { monthlyPriceUsd: body.monthlyPriceUsd } : {}),
+            ...(priceLine ? { billingMessage: priceLine } : {}),
+        }));
+        return;
+    }
+    console.log(`${displayText(domain)} is now the deploy domain of '${orgSlug}'. It is not live yet.`);
+    if (priceLine)
+        console.log(priceLine);
+    printDnsRecords(state.records);
+    if (state.records.length < 2) {
+        console.log("The certificate's validation record can take a few seconds to appear; 'hq deploy domains base status' prints it.");
+    }
+    console.log("When the records are in place, run: hq deploy domains base status --wait");
+}
+async function baseStatusAction(options) {
+    const token = await ensureCognitoToken();
+    const orgSlug = baseSlug(options);
+    const minutes = options.timeout === undefined ? BASE_WAIT_DEFAULT_MINUTES : Number(options.timeout);
+    if (!Number.isFinite(minutes) || minutes <= 0 || minutes > BASE_WAIT_MAX_MINUTES) {
+        throw new DeployDomainsError(`--timeout must be 1 to ${BASE_WAIT_MAX_MINUTES} minutes.`, "INVALID_TIMEOUT");
+    }
+    const deadline = deployDomainsClock.now() + minutes * 60_000;
+    let state;
+    let attempts = 0;
+    for (;;) {
+        attempts += 1;
+        // Refresh advances the claim itself: it re-checks the certificate and,
+        // once issued, attaches serving and polls it to live.
+        const response = await request(token, orgSlug, baseRoute(orgSlug, "/refresh"), "POST");
+        if (!response.ok)
+            throw await baseError(response, orgSlug);
+        state = baseState(await readBody(response));
+        if (state.live || state.status === "failed" || !options.wait)
+            break;
+        if (!options.json)
+            console.error(`${new Date(deployDomainsClock.now()).toISOString()}  ${describeBaseState(state)}`);
+        if (deployDomainsClock.now() + BASE_POLL_INTERVAL_MS > deadline)
+            break;
+        await deployDomainsClock.sleep(BASE_POLL_INTERVAL_MS);
+    }
+    const timedOut = Boolean(options.wait) && !state.live && state.status !== "failed";
+    if (!state.live)
+        process.exitCode = state.status === "failed" ? 1 : REFRESH_NOT_SERVING_EXIT_CODE;
+    if (options.json) {
+        console.log(safeJson({
+            ok: true,
+            orgSlug,
+            baseDomain: state.baseDomain ?? null,
+            status: state.status,
+            live: state.live,
+            certificate: state.certStatus,
+            serving: state.servingStatus,
+            ...(state.servingError ? { servingError: state.servingError } : {}),
+            records: state.live ? [] : state.records,
+            attempts,
+            ...(timedOut ? { timedOut: true } : {}),
+        }));
+        return;
+    }
+    const name = displayText(state.baseDomain ?? "The company deploy domain");
+    if (state.live) {
+        console.log(`${name} is live. Every app of '${orgSlug}' serves at <app>.${name}.`);
+        return;
+    }
+    if (state.status === "failed") {
+        console.log(`${name} failed to go live${state.servingError ? `: ${displayText(state.servingError)}` : "."} Remove it and add it again.`);
+        return;
+    }
+    console.log(`${name} is not live yet: ${describeBaseState(state)}.`);
+    printDnsRecords(state.records);
+    console.log(timedOut
+        ? `Stopped waiting after ${minutes} minutes. Run 'hq deploy domains base status --wait' again to keep waiting.`
+        : "Run 'hq deploy domains base status --wait' to wait until it is live.");
+}
+async function baseRemoveAction(options) {
+    const token = await ensureCognitoToken();
+    const orgSlug = baseSlug(options);
+    await confirm(`Remove the deploy domain of '${orgSlug}'? Every app stops serving on it, and if it is billed, its monthly charge stops.`, options.yes, "remove the company deploy domain");
+    const response = await request(token, orgSlug, baseRoute(orgSlug), "DELETE");
+    if (!response.ok)
+        throw await baseError(response, orgSlug);
+    const body = await readBody(response);
+    const removed = body.removed === true;
+    const billingRemovalPending = body.billingRemovalPending === true;
+    const warning = typeof body.warning === "string" ? body.warning : undefined;
+    if (options.json) {
+        console.log(safeJson({ ok: true, orgSlug, removed, billingRemovalPending, ...(warning ? { warning } : {}) }));
+        return;
+    }
+    console.log(removed ? `Removed the deploy domain of '${orgSlug}'.` : `'${orgSlug}' had no deploy domain to remove.`);
+    if (warning)
+        console.log(displayText(warning));
+    else if (billingRemovalPending)
+        console.log("Its charge could not be stopped right away. HQ keeps retrying until the charge is removed.");
+}
 async function purchaseRequest(token, companyUid, suffix, body) {
     try {
         return await vaultApiFetch({
@@ -782,6 +999,26 @@ export function registerDeployDomainsCommand(deploy) {
         .description("Unlink a custom domain from an app")
         .option("--env <name>", "pick the environment when the domain points at more than one")
         .option("--yes", "remove without a prompt")).action((domain, options) => run(options.json, () => removeAction(domain, options)));
+    const base = domains
+        .command("base")
+        .description("Manage the company deploy domain: one domain for every app (<app>.<domain>)");
+    const baseCommon = (command) => command
+        .option("--company <slug>", "use this company instead of the linked or active company")
+        .option("--path <dir>", "folder linked to an app of the company (default: current folder)")
+        .option("--json", "print machine-readable JSON");
+    baseCommon(base
+        .command("add <domain>")
+        .description("Claim a company deploy domain; prints the price and the DNS records")
+        .option("--yes", "add without a prompt (the domain can add a monthly charge)")).action((domain, options) => run(options.json, () => baseAddAction(domain, options)));
+    baseCommon(base
+        .command("status")
+        .description(`Check the company deploy domain and advance it toward live (exits ${REFRESH_NOT_SERVING_EXIT_CODE} while not live)`)
+        .option("--wait", "keep checking until it is live or the timeout passes")
+        .option("--timeout <minutes>", `stop waiting after this many minutes (default ${BASE_WAIT_DEFAULT_MINUTES}, at most ${BASE_WAIT_MAX_MINUTES})`)).action((options) => run(options.json, () => baseStatusAction(options)));
+    baseCommon(base
+        .command("remove")
+        .description("Release the company deploy domain")
+        .option("--yes", "remove without a prompt")).action((options) => run(options.json, () => baseRemoveAction(options)));
     domains
         .command("search <query>")
         .description("Check whether a domain can be bought, and its price")

package/dist/lib/bot/fleet-local.d.ts

@@ -56,6 +56,7 @@ export interface FleetLocalInstallDeps {
     fleetHome?: string;
     fetch?: typeof fetch;
     token?: () => string;
+    hqReleaseLinks?: (release: FleetLocalReleasePin) => Promise<Map<string, string> | null>;
     now?: () => Date;
     release?: FleetLocalReleasePin;
     publicKey?: string;
@@ -114,6 +115,7 @@ export declare const HQ_FLEET_LOCAL_PUBLIC_KEY = "-----BEGIN PUBLIC KEY-----\nMC
 export declare function fleetHome(home?: string, env?: NodeJS.ProcessEnv): string;
 export declare function verifyFleetLocalRelease(files: FleetLocalReleaseFiles, release?: FleetLocalReleasePin, publicKey?: string): void;
 export declare function resolveFleetReleaseToken(env?: NodeJS.ProcessEnv): string;
+export declare function fetchHqFleetReleaseLinks(release: FleetLocalReleasePin): Promise<Map<string, string> | null>;
 export declare const FLEET_LOCAL_METADATA_DOWNLOAD_TIMEOUT_MS = 30000;
 export declare const FLEET_LOCAL_ARCHIVE_DOWNLOAD_TIMEOUT_MS: number;
 export declare const FLEET_LOCAL_RUNTIME_DOWNLOAD_TIMEOUT_MS: number;

package/dist/lib/bot/fleet-local.js

@@ -5,16 +5,18 @@ import * as os from "node:os";
 import * as path from "node:path";
 import { HQ_FLEET_RUNTIME_ENGINE_ID, } from "./config.js";
 import { ensureFleetPython, fleetUvEnv } from "./fleet-python.js";
+import { ensureCognitoToken } from "../../utils/cognito-session.js";
+import { vaultApiFetch } from "../../utils/vault-api.js";
 export const HQ_FLEET_LOCAL_RELEASE = {
     repository: "indigoai-us/hq-fleet-local",
-    tag: "v0.4.5",
-    version: "0.4.5",
-    artifact: "hq-fleet-local-0.4.5.zip",
-    artifactSha256: "5dc05b1a9c8a3fce0d748c1f642a908c4166958cf4e1c3cec8ee3799148eef80",
+    tag: "v0.4.6",
+    version: "0.4.6",
+    artifact: "hq-fleet-local-0.4.6.zip",
+    artifactSha256: "24e48887dd4450ad63eda11e61f78363b0cc53b3fc87e3fd21bfe97e4a430865",
     runtimeArtifact: "hq-fleet-runtime-abccac13bd9e.tar",
     runtimeArtifactSha256: "29bcfe718ad7fbd3636afd00623772f2a25bc84c4f6f10d8d57f38e549d528d5",
-    manifestSha256: "ffb81d7cbb61cdd05e91208ac3eccf045789d9e068309da3164fe002991f7780",
-    signatureSha256: "3792d43c191c65c731e9f27a003d86334b4695a43feb8ac23a7b679f79531616",
+    manifestSha256: "5cc06b30a724419c22f4ab116db1ae745158d33c4aa46c7be04d29639172af1d",
+    signatureSha256: "b7a6c771dc674423b56db36f58b5a2a2a49eb2e27b33a41206fcc228a11d1def",
     runtimeCommit: "abccac13bd9ea593b24c8cd9c0ba28d5c6050cc9",
 };
 export const HQ_FLEET_LOCAL_PUBLIC_KEY = `-----BEGIN PUBLIC KEY-----
@@ -92,9 +94,69 @@ export function resolveFleetReleaseToken(env = process.env) {
             return value;
     }
     catch {
-        throw expectedError("HQ Fleet Local is a private Indigo preview. Sign in with GitHub CLI or set HQ_FLEET_RELEASE_GITHUB_TOKEN before creating this bot.");
+        throw expectedError("HQ could not provide the HQ Fleet Runtime download. Sign in with `hq login` and retry.");
     }
-    throw expectedError("GitHub CLI returned an empty token for the private HQ Fleet Local release. Run gh auth login and retry.");
+    throw expectedError("HQ could not provide the HQ Fleet Runtime download. Sign in with `hq login` and retry.");
+}
+export async function fetchHqFleetReleaseLinks(release) {
+    let token;
+    try {
+        token = await ensureCognitoToken({ tokenSource: "person", interactive: false });
+    }
+    catch {
+        return null;
+    }
+    const response = await vaultApiFetch({
+        token,
+        path: `/v1/fleet-local/releases/${encodeURIComponent(release.version)}`,
+        signal: AbortSignal.timeout(FLEET_LOCAL_METADATA_DOWNLOAD_TIMEOUT_MS),
+    });
+    if (response.status === 401 || response.status === 403) {
+        throw expectedError("HQ refused the HQ Fleet Runtime download. Sign in with `hq login` and retry.");
+    }
+    if (response.status === 404)
+        return null;
+    if (!response.ok) {
+        throw expectedError(`Could not get the HQ Fleet Local ${release.tag} download: HQ returned HTTP ${response.status}.`);
+    }
+    const body = (await response.json());
+    const links = new Map();
+    for (const asset of body.assets ?? []) {
+        if (typeof asset.name === "string" && typeof asset.url === "string")
+            links.set(asset.name, asset.url);
+    }
+    return links.size > 0 ? links : null;
+}
+function trustedReleaseLink(url) {
+    try {
+        const parsed = new URL(url);
+        return parsed.protocol === "https:" && parsed.hostname.endsWith(".amazonaws.com");
+    }
+    catch {
+        return false;
+    }
+}
+async function downloadFleetLocalReleaseFromHq(release, fetcher, links) {
+    const get = async (name, timeoutMs) => {
+        const url = links.get(name);
+        if (!url)
+            throw expectedError(`HQ Fleet Local ${release.tag} is missing release asset ${name}.`);
+        if (!trustedReleaseLink(url)) {
+            throw expectedError(`HQ Fleet Local ${release.tag} returned an untrusted download link for ${name}.`);
+        }
+        const response = await fetcher(url, { signal: AbortSignal.timeout(timeoutMs) });
+        if (!response.ok) {
+            throw expectedError(`Could not download ${name}: HQ storage returned HTTP ${response.status}.`);
+        }
+        return Buffer.from(await response.arrayBuffer());
+    };
+    const [archive, runtimeArchive, manifest, signature] = await Promise.all([
+        get(release.artifact, FLEET_LOCAL_ARCHIVE_DOWNLOAD_TIMEOUT_MS),
+        get(release.runtimeArtifact, FLEET_LOCAL_RUNTIME_DOWNLOAD_TIMEOUT_MS),
+        get("release-manifest.json", FLEET_LOCAL_METADATA_DOWNLOAD_TIMEOUT_MS),
+        get("release-manifest.sig", FLEET_LOCAL_METADATA_DOWNLOAD_TIMEOUT_MS),
+    ]);
+    return { archive, runtimeArchive, manifest, signature };
 }
 async function responseBytes(response, label) {
     if (!response.ok) {
@@ -196,8 +258,11 @@ export async function installPinnedFleetLocalDistribution(deps = {}) {
         verifyFleetLocalRelease(current, release, publicKey);
     }
     else {
-        const token = (deps.token ?? resolveFleetReleaseToken)();
-        const files = await downloadFleetLocalRelease(release, deps.fetch ?? fetch, token);
+        const fetcher = deps.fetch ?? fetch;
+        const links = await (deps.hqReleaseLinks ?? fetchHqFleetReleaseLinks)(release);
+        const files = links
+            ? await downloadFleetLocalReleaseFromHq(release, fetcher, links)
+            : await downloadFleetLocalRelease(release, fetcher, (deps.token ?? resolveFleetReleaseToken)());
         verifyFleetLocalRelease(files, release, publicKey);
         installFiles(dir, files, release, publicKey);
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.345.173",
+  "version": "5.345.174",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {
@@ -114,11 +114,11 @@
     "*.{ts,tsx,mts,cts,js,jsx,mjs,cjs}": "eslint --cache --no-error-on-unmatched-pattern"
   },
   "optionalDependencies": {
-    "@indigoai-us/hq-hook-win32-x64": "5.345.173",
-    "@indigoai-us/hq-hook-win32-arm64": "5.345.173",
-    "@indigoai-us/hq-hook-darwin-x64": "5.345.173",
-    "@indigoai-us/hq-hook-darwin-arm64": "5.345.173",
-    "@indigoai-us/hq-hook-linux-x64": "5.345.173",
-    "@indigoai-us/hq-hook-linux-arm64": "5.345.173"
+    "@indigoai-us/hq-hook-win32-x64": "5.345.174",
+    "@indigoai-us/hq-hook-win32-arm64": "5.345.174",
+    "@indigoai-us/hq-hook-darwin-x64": "5.345.174",
+    "@indigoai-us/hq-hook-darwin-arm64": "5.345.174",
+    "@indigoai-us/hq-hook-linux-x64": "5.345.174",
+    "@indigoai-us/hq-hook-linux-arm64": "5.345.174"
   }
 }