@indigoai-us/hq-cli 5.117.0 → 5.117.2

package/dist/lib/billing/plan-lock.js

@@ -0,0 +1,230 @@
+/**
+ * `plan-lock` (starter-plan-hard-limits / US-011) — the CLI-side read + render
+ * of the workspace plan lock.
+ *
+ * Starter (free) workspaces are capped at 5 members and 0 integrations. Going
+ * over locks the workspace immediately: it becomes read-only until the owner
+ * trims back under the caps or upgrades to HQ Workforce. The lock decision is
+ * NOT made here — hq-pro's `src/billing/plan-lock.ts` is the single source of
+ * truth and ships the answer on `GET /membership/me` as a per-company
+ * `planLock` object. This module only reads that field and renders it.
+ *
+ * Member counts are decoration, never a second opinion: the count comes from
+ * `GET /v1/billing/usage-limits` on a best-effort basis and its absence only
+ * removes the "n of 5" detail from the notice. An absent field is UNKNOWN, so
+ * nothing here ever infers a lock (or an unlock) from missing data
+ * (hq-absent-field-never-means-constraining-value).
+ */
+import chalk from "chalk";
+import { vaultApiFetch } from "../../utils/vault-api.js";
+/** Starter member cap quoted when the server did not send `removeMembersTo`. */
+export const STARTER_MEMBER_TARGET = 5;
+/** Upgrade destination quoted when the server did not send one. */
+export const DEFAULT_UPGRADE_URL = "https://hq.computer/billing";
+/** The paid plan the lock wall sends owners to. Copy lives in ONE place. */
+export const WORKFORCE_PLAN_LABEL = "HQ Workforce ($500/mo)";
+function asRecord(value) {
+    if (value === null || typeof value !== "object" || Array.isArray(value)) {
+        return null;
+    }
+    return value;
+}
+/**
+ * Defensively parse a `planLock` payload. Anything malformed returns null —
+ * the caller then behaves exactly as if the server had sent nothing, which is
+ * "unknown", not "locked".
+ */
+export function parsePlanLock(value) {
+    const rec = asRecord(value);
+    if (!rec)
+        return null;
+    if (typeof rec.locked !== "boolean")
+        return null;
+    const reasons = [];
+    if (Array.isArray(rec.reasons)) {
+        for (const reason of rec.reasons) {
+            if (reason === "users" || reason === "integrations")
+                reasons.push(reason);
+        }
+    }
+    const fix = asRecord(rec.fixOptions);
+    const removeMembersTo = typeof fix?.removeMembersTo === "number" &&
+        Number.isFinite(fix.removeMembersTo)
+        ? fix.removeMembersTo
+        : STARTER_MEMBER_TARGET;
+    return {
+        locked: rec.locked,
+        reasons,
+        upgradeUrl: typeof rec.upgradeUrl === "string" && rec.upgradeUrl.trim().length > 0
+            ? rec.upgradeUrl.trim()
+            : DEFAULT_UPGRADE_URL,
+        fixOptions: {
+            removeMembersTo,
+            disconnectIntegrations: fix?.disconnectIntegrations === true,
+        },
+    };
+}
+/**
+ * Pick the membership row for `companySlug` (or `cmp_…` uid) out of a decoded
+ * `/membership/me` body and return its parsed lock. No matching row — or no
+ * `planLock` on it — is UNKNOWN, so this returns null rather than guessing.
+ */
+export function selectPlanLock(body, companyRef) {
+    const rec = asRecord(body);
+    const rows = Array.isArray(rec?.memberships) ? rec.memberships : [];
+    const ref = companyRef.trim().toLowerCase();
+    for (const raw of rows) {
+        const row = asRecord(raw);
+        if (!row)
+            continue;
+        if (typeof row.status === "string" && row.status !== "active")
+            continue;
+        const slug = typeof row.companySlug === "string" ? row.companySlug.toLowerCase() : "";
+        const uid = typeof row.companyUid === "string" ? row.companyUid.toLowerCase() : "";
+        if (slug !== ref && uid !== ref)
+            continue;
+        const lock = parsePlanLock(row.planLock);
+        if (!lock)
+            return null;
+        return {
+            lock,
+            companyUid: typeof row.companyUid === "string" ? row.companyUid : undefined,
+        };
+    }
+    return null;
+}
+/** Parse the resolved plan id out of a usage-limits body. Absent → null. */
+export function selectPlan(body) {
+    const plan = asRecord(body)?.plan;
+    return plan === "free" || plan === "paid" || plan === "enterprise"
+        ? plan
+        : null;
+}
+/** Parse the `users` dimension out of a usage-limits body. Absent → null. */
+export function selectMemberUsage(body) {
+    const users = asRecord(asRecord(body)?.users);
+    if (!users)
+        return null;
+    if (typeof users.used !== "number" || !Number.isFinite(users.used)) {
+        return null;
+    }
+    const limit = typeof users.limit === "number" && Number.isFinite(users.limit)
+        ? users.limit
+        : STARTER_MEMBER_TARGET;
+    return { used: users.used, limit };
+}
+/**
+ * Read the live lock for one company: `planLock` from `/membership/me`, plus a
+ * best-effort member count for the notice. Returns null when the server did not
+ * answer with a lock for this company — callers must then say nothing.
+ */
+export async function fetchPlanLockStatus(token, companyRef, opts = {}) {
+    const timeoutMs = opts.timeoutMs ?? 8000;
+    const res = await vaultApiFetch({
+        token,
+        path: "/membership/me",
+        signal: AbortSignal.timeout(timeoutMs),
+    });
+    if (!res.ok)
+        return null;
+    const selected = selectPlanLock(await res.json().catch(() => null), companyRef);
+    if (!selected)
+        return null;
+    let members;
+    let plan;
+    // Decoration only. The lock answer above is authoritative; the usage read
+    // adds the member count and the plan id that the notices and the `Plan:`
+    // orientation line quote. A failure here must never suppress — or invent —
+    // a lock, so every field it feeds stays optional.
+    if (selected.companyUid) {
+        try {
+            const usage = await vaultApiFetch({
+                token,
+                path: "/v1/billing/usage-limits",
+                query: { companyUid: selected.companyUid },
+                signal: AbortSignal.timeout(timeoutMs),
+            });
+            if (usage.ok) {
+                const body = await usage.json().catch(() => null);
+                members = selectMemberUsage(body) ?? undefined;
+                plan = selectPlan(body) ?? undefined;
+            }
+        }
+        catch {
+            // Network/timeout: leave both unknown.
+        }
+    }
+    return {
+        companySlug: companyRef,
+        companyUid: selected.companyUid,
+        lock: selected.lock,
+        members,
+        plan,
+        checkedAt: new Date().toISOString(),
+    };
+}
+function reasonLabel(reason) {
+    return reason === "users"
+        ? "too many members"
+        : "integrations are not included on Starter";
+}
+/**
+ * The full WORKSPACE LOCKED block: why it locked, where the workspace stands
+ * against the cap, and the two fixes. Plain text — colour is applied by the
+ * caller so scripts capturing stdout get a clean block.
+ */
+export function renderPlanLockNotice(status) {
+    const { lock, members, companySlug } = status;
+    const target = lock.fixOptions.removeMembersTo;
+    const lines = [];
+    lines.push(`WORKSPACE LOCKED — ${companySlug} is over its Starter plan.`);
+    const reasons = lock.reasons.length
+        ? lock.reasons.map(reasonLabel).join("; ")
+        : "over the Starter plan limits";
+    lines.push(`  Why: ${reasons}.`);
+    if (members) {
+        lines.push(`  Members: ${members.used} of ${target}.`);
+    }
+    else {
+        lines.push(`  Members allowed on Starter: ${target}.`);
+    }
+    lines.push("  This workspace is read-only until it is fixed. Two ways out:");
+    lines.push(`    1. Remove members until you are at ${target} or fewer${lock.fixOptions.disconnectIntegrations
+        ? ", and disconnect the workspace's integrations"
+        : ""}.`);
+    lines.push(`    2. Upgrade to ${WORKFORCE_PLAN_LABEL}.`);
+    lines.push(`  Upgrade: ${lock.upgradeUrl}`);
+    return lines.join("\n");
+}
+/**
+ * The one-line form injected on every turn while the workspace stays locked.
+ * Kept to a single line on purpose — it repeats each turn.
+ */
+export function renderPlanLockLine(status) {
+    const target = status.lock.fixOptions.removeMembersTo;
+    const count = status.members
+        ? `${status.members.used} of ${target} members`
+        : `over its ${target}-member limit`;
+    return (`Company ${status.companySlug} is locked on Starter (${count}). ` +
+        `Writes to HQ cloud will fail until fixed: ${status.lock.upgradeUrl}`);
+}
+/**
+ * The `Plan: …` orientation line. Starter only: a paid or enterprise
+ * workspace — and an UNKNOWN plan — gets no line at all.
+ */
+export function renderPlanLine(status) {
+    if (status.lock.locked)
+        return "Plan: Starter — LOCKED";
+    if (status.plan !== "free")
+        return null;
+    const target = status.lock.fixOptions.removeMembersTo;
+    if (status.members) {
+        return `Plan: Starter — ${status.members.used} of ${target} members`;
+    }
+    return `Plan: Starter — ${target} members included`;
+}
+/** Colourised block for interactive output. */
+export function colorizePlanLockNotice(notice) {
+    return chalk.red(notice);
+}
+//# sourceMappingURL=plan-lock.js.map

package/dist/lib/mesh/live/daemon/credentials.d.ts

@@ -131,4 +131,31 @@ export declare class CredentialRenewalManager {
     stop(): void;
     private clear;
 }
+/**
+ * Contract-2 (personal) realtime vend. Backed server-side by the personal
+ * session policy, which grants Subscribe/Receive on the caller's own
+ * `hq/{principalUid}/{dm,sessions,work,notifications,meeting,sync}` topics —
+ * unlike contract 3, whose policy only covers company presence and the thread
+ * directory. Doorbell listeners on personal topics MUST use this contract;
+ * subscribing to personal topics with a contract-3 session makes AWS IoT drop
+ * the connection before SUBACK.
+ */
+export interface PersonalRealtimeBundle {
+    contractVersion: 2;
+    credentials: IotCredentials;
+    iotEndpoint: string;
+    region: string;
+    clientId: string;
+    actorUid: string;
+    /** Advertised personal topics keyed by kind (dm, sessions, work, notifications, …). */
+    topics: Record<string, string>;
+    expiresAt: string;
+}
+export type PersonalCredentialsFetcher = () => Promise<PersonalRealtimeBundle>;
+export declare function normalizePersonalRealtimeBundle(raw: unknown): PersonalRealtimeBundle;
+export declare function createPersonalRealtimeFetcher(opts: {
+    token: string;
+    baseUrl?: string;
+    post?: (path: string, body: unknown) => Promise<CredentialVendPostResult>;
+}): PersonalCredentialsFetcher;
 //# sourceMappingURL=credentials.d.ts.map

package/dist/lib/mesh/live/daemon/credentials.js

@@ -385,4 +385,99 @@ export class CredentialRenewalManager {
         }
     }
 }
+export function normalizePersonalRealtimeBundle(raw) {
+    if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
+        throw new Error("contract-2 vend response is not an object");
+    }
+    const r = raw;
+    if (r.contractVersion !== 2) {
+        throw new Error(`expected contractVersion 2, got ${String(r.contractVersion)}`);
+    }
+    const creds = r.credentials;
+    if (!creds ||
+        typeof creds.accessKeyId !== "string" ||
+        typeof creds.secretAccessKey !== "string" ||
+        typeof creds.sessionToken !== "string") {
+        throw new Error("contract-2 vend missing credentials");
+    }
+    for (const key of ["clientId", "iotEndpoint", "region"]) {
+        if (typeof r[key] !== "string" || !r[key].trim()) {
+            throw new Error(`contract-2 vend missing ${key}`);
+        }
+    }
+    const topicsRaw = r.topics && typeof r.topics === "object" && !Array.isArray(r.topics)
+        ? r.topics
+        : {};
+    const topics = {};
+    for (const [k, v] of Object.entries(topicsRaw)) {
+        if (typeof v === "string" && v.trim())
+            topics[k] = v.trim();
+    }
+    if (!topics.dm && typeof r.topic === "string")
+        topics.dm = r.topic;
+    const actorUid = (typeof r.principalUid === "string" && /^(?:prs|agt)_[A-Za-z0-9]+$/.test(r.principalUid)
+        ? r.principalUid
+        : undefined) ||
+        actorUidFromPersonalTopic(topics.dm) ||
+        "";
+    if (!actorUid)
+        throw new Error("contract-2 vend could not derive actorUid");
+    // Only keep topics that belong to the vended principal.
+    for (const [k, v] of Object.entries(topics)) {
+        if (actorUidFromPersonalTopic(v) !== actorUid)
+            delete topics[k];
+    }
+    const expiresAt = (typeof r.expiresAt === "string" && r.expiresAt) ||
+        (typeof creds.expiration === "string" && creds.expiration) ||
+        "";
+    if (!expiresAt)
+        throw new Error("contract-2 vend missing expiresAt");
+    return {
+        contractVersion: 2,
+        credentials: {
+            accessKeyId: creds.accessKeyId,
+            secretAccessKey: creds.secretAccessKey,
+            sessionToken: creds.sessionToken,
+            expiration: expiresAt,
+        },
+        iotEndpoint: r.iotEndpoint,
+        region: r.region,
+        clientId: r.clientId,
+        actorUid,
+        topics,
+        expiresAt,
+    };
+}
+export function createPersonalRealtimeFetcher(opts) {
+    return async () => {
+        if (opts.post) {
+            const res = await opts.post(REALTIME_CREDENTIALS_PATH, { contractVersion: 2 });
+            if (res.status < 200 || res.status >= 300) {
+                throw classifyCredentialVendFailure(res.status, res.body, headerGet(res.headers, "Retry-After"));
+            }
+            return normalizePersonalRealtimeBundle(res.body);
+        }
+        const res = await vaultApiFetch({
+            token: opts.token,
+            path: REALTIME_CREDENTIALS_PATH,
+            method: "POST",
+            body: { contractVersion: 2 },
+            baseUrl: opts.baseUrl ?? DEFAULT_VAULT_API_URL,
+        });
+        const text = await res.text();
+        let body = {};
+        if (text) {
+            try {
+                body = JSON.parse(text);
+            }
+            catch {
+                body = { raw: text.slice(0, 200) };
+            }
+        }
+        if (!res.ok) {
+            throw classifyCredentialVendFailure(res.status, body, res.headers.get("Retry-After"));
+        }
+        return normalizePersonalRealtimeBundle(body);
+    };
+}
 //# sourceMappingURL=credentials.js.map

package/dist/lib/plan-limit-nag.js

@@ -224,7 +224,7 @@ export function emitPlanLimitNag(opts = {}) {
         if (worst === null)
             return;
         warningShownThisSession = true;
-        const line = `⚠ HQ free plan: ${formatEntryLine(worst.key, worst.entry)}. Upgrade: ${resolvedUpgradeUrl}`;
+        const line = `⚠ HQ Starter plan: ${formatEntryLine(worst.key, worst.entry)}. Upgrade: ${resolvedUpgradeUrl}`;
         write(chalk.yellow(line) + "\n");
     }
     catch {

package/dist/utils/plan-gate-error.js

@@ -1,4 +1,4 @@
-const TEAM_UPGRADE_HINT = "Run `hq billing upgrade` to move to Team.";
+const TEAM_UPGRADE_HINT = "Run `hq billing upgrade` to move to HQ Workforce.";
 export class PlanGateError extends Error {
     code;
     details;
@@ -23,19 +23,19 @@ function formatPlanGateDetails(code, details) {
         typeof details.used === "number" &&
         typeof details.limit === "number") {
         const upgrade = typeof details.upgradeUrl === "string"
-            ? `Upgrade to HQ Team ($500/mo) to remove limits: ${details.upgradeUrl}`
-            : "Upgrade to HQ Team ($500/mo) to remove limits.";
+            ? `Upgrade to HQ Workforce ($500/mo) to remove limits: ${details.upgradeUrl}`
+            : "Upgrade to HQ Workforce ($500/mo) to remove limits.";
         return [
-            `Free plan limit reached: ${details.resource} ${details.used}/${details.limit} used.`,
+            `Starter plan limit reached: ${details.resource} ${details.used}/${details.limit} used.`,
             upgrade,
             existingResourcesNote,
         ].join("\n");
     }
     const upgrade = typeof details.upgradeUrl === "string"
-        ? `Upgrade to HQ Team ($500/mo) to remove limits: ${details.upgradeUrl}`
-        : "Upgrade to HQ Team ($500/mo) to remove limits.";
+        ? `Upgrade to HQ Workforce ($500/mo) to remove limits: ${details.upgradeUrl}`
+        : "Upgrade to HQ Workforce ($500/mo) to remove limits.";
     return [
-        "HQ Team plan required for this feature.",
+        "HQ Workforce plan required for this feature.",
         upgrade,
         existingResourcesNote,
     ].join("\n");
@@ -56,7 +56,7 @@ export async function offerTeamUpgrade(onConfirm, deps = {}) {
     if (!(deps.interactive ?? canOfferTeamUpgrade(deps.argv)))
         return false;
     if (deps.ask) {
-        const answer = await deps.ask("Upgrade to HQ Team ($500/mo) now? [y/N] ");
+        const answer = await deps.ask("Upgrade to HQ Workforce ($500/mo) now? [y/N] ");
         if (!/^y(?:es)?$/i.test(answer.trim()))
             return false;
         await onConfirm();
@@ -65,7 +65,7 @@ export async function offerTeamUpgrade(onConfirm, deps = {}) {
     const { createInterface } = await import("node:readline/promises");
     const readline = createInterface({ input: process.stdin, output: process.stderr });
     try {
-        const answer = await readline.question("Upgrade to HQ Team ($500/mo) now? [y/N] ");
+        const answer = await readline.question("Upgrade to HQ Workforce ($500/mo) now? [y/N] ");
         if (!/^y(?:es)?$/i.test(answer.trim()))
             return false;
         await onConfirm();

package/dist/utils/team-upgrade.d.ts

@@ -10,7 +10,7 @@ export interface TeamUpgradeOptions {
     error?: (text: string) => void;
 }
 /**
- * Start the owner-gated HQ Team Checkout flow. Stripe collects payment details
+ * Start the owner-gated HQ Workforce Checkout flow. Stripe collects payment details
  * in its hosted browser page; the CLI never receives card data.
  */
 export declare function upgradeToTeam(opts?: TeamUpgradeOptions): Promise<string>;

package/dist/utils/team-upgrade.js

@@ -14,7 +14,7 @@ function ownerUpgradeError() {
     return Object.assign(new Error("Only a company owner can upgrade. Ask a company owner to upgrade."), { expected: true });
 }
 /**
- * Start the owner-gated HQ Team Checkout flow. Stripe collects payment details
+ * Start the owner-gated HQ Workforce Checkout flow. Stripe collects payment details
  * in its hosted browser page; the CLI never receives card data.
  */
 export async function upgradeToTeam(opts = {}) {
@@ -35,7 +35,7 @@ export async function upgradeToTeam(opts = {}) {
         if (response.status === 403 || /owner/i.test(`${body.error ?? ""} ${body.message ?? ""}`)) {
             throw ownerUpgradeError();
         }
-        throw Object.assign(new Error(`Could not start HQ Team checkout: ${body.error ?? body.message ?? response.statusText}`), { expected: true });
+        throw Object.assign(new Error(`Could not start HQ Workforce checkout: ${body.error ?? body.message ?? response.statusText}`), { expected: true });
     }
     const { url } = (await response.json());
     if (typeof url !== "string" || !url) {
@@ -46,7 +46,7 @@ export async function upgradeToTeam(opts = {}) {
         write(`${JSON.stringify({ url })}\n`);
         return url;
     }
-    write("Opening HQ Team checkout ($500/mo) in your browser — finish there and you're upgraded.\n");
+    write("Opening HQ Workforce checkout ($500/mo) in your browser — finish there and you're upgraded.\n");
     const skipBrowser = opts.noBrowser || (opts.headless ?? isHeadless());
     if (skipBrowser) {
         write(`Open this URL to continue: ${url}\n`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.117.0",
+  "version": "5.117.2",
   "description": "HQ by Indigo management CLI \u2014 modules and cloud sync",
   "main": "dist/index.js",
   "bin": {