@indigoai-us/hq-cli 5.345.143 → 5.345.145

package/dist/commands/api-keys.js

@@ -10,6 +10,45 @@ async function requireCognitoForApiKeys(label) {
     requireApiKeyCapability(null, label);
     return ensureCognitoToken();
 }
+/**
+ * Named capability bundles for `api-keys create --preset`. A preset grants
+ * exactly its listed capabilities — no secret scopes, no deploy block — so a
+ * headless agent's key cannot reach anything the preset does not name.
+ */
+const API_KEY_PRESETS = {
+    /** Media library agent: search assets and mint download links. */
+    "library-agent": {
+        capabilities: ["search:query", "files:read"],
+        uploadCapability: "files:write",
+    },
+};
+function isApiKeyPresetName(value) {
+    return Object.prototype.hasOwnProperty.call(API_KEY_PRESETS, value);
+}
+/**
+ * Capabilities for `--preset`. Rejects an unknown preset and any flag that
+ * would widen or reshape the grant, so the minted key matches the preset.
+ */
+function resolvePresetCapabilities(opts) {
+    const name = opts.preset ?? "";
+    if (!isApiKeyPresetName(name)) {
+        throw new Error(`Unknown preset '${name}'. Supported: ${Object.keys(API_KEY_PRESETS).join(", ")}`);
+    }
+    const conflicts = [
+        opts.capability.length > 0 ? "--capability" : null,
+        opts.scope.length > 0 ? "--scope" : null,
+        opts.deploy === true ? "--deploy" : null,
+        opts.deployApp.length > 0 ? "--deploy-app" : null,
+        opts.permission !== undefined ? "--permission" : null,
+    ].filter((flag) => flag !== null);
+    if (conflicts.length > 0) {
+        throw new Error(`--preset ${name} grants a fixed capability set; remove ${conflicts.join(", ")}.`);
+    }
+    const preset = API_KEY_PRESETS[name];
+    return opts.allowUpload === true
+        ? [...preset.capabilities, preset.uploadCapability]
+        : [...preset.capabilities];
+}
 function collectRepeatedOption(value, previous) {
     return [...previous, value];
 }
@@ -160,9 +199,16 @@ export function registerApiKeysCommand(program) {
         .option("--deploy-app <id>", "Deploy app id/slug allowed for publish (repeatable); narrows the deploy grant", collectRepeatedOption, [])
         .option("--permission <level>", "Secret permission level: read | write | admin (applies to secret scopes; defaults to read)")
         .option("--expires <ISO8601>", "Optional ISO-8601 expiry timestamp")
+        .option("--preset <name>", `Grant a fixed capability bundle: ${Object.keys(API_KEY_PRESETS).join(" | ")} (library-agent = search:query, files:read)`)
+        .option("--allow-upload", "With --preset library-agent, also grant files:write (hq library add)")
         .action(async (opts) => {
         try {
-            const capabilities = parseCapabilities(opts.capability);
+            if (opts.allowUpload === true && opts.preset === undefined) {
+                throw new Error("--allow-upload requires --preset library-agent.");
+            }
+            const capabilities = opts.preset !== undefined
+                ? resolvePresetCapabilities(opts)
+                : parseCapabilities(opts.capability);
             const wantsDeploy = hasDeployCapability(capabilities) ||
                 opts.deploy === true ||
                 opts.deployApp.length > 0;
@@ -250,13 +296,25 @@ export function registerApiKeysCommand(program) {
             }
             console.log("  Export it for automation (never falls back to a session):");
             console.log(`\n  export HQ_API_KEY='${data.key.value}'\n`);
-            console.log("  Vault secrets:");
-            console.log("    hq secrets get <NAME> --reveal");
-            console.log("    hq secrets exec --only <NAME> -- <command>");
-            console.log("    hq secrets list --company <cmp_uid>   (secrets:read)");
-            console.log("    hq secrets set <NAME> --from-stdin --company <cmp_uid>   (secrets:write)");
-            console.log("    Or HTTP: POST /v1/keys/secrets/fetch with Authorization: Bearer <key>");
-            console.log(chalk.dim("    Company-scoped commands need --company <cmp_uid> (or HQ_COMPANY_UID) — slug lookup needs a session."));
+            if (opts.preset === "library-agent") {
+                console.log("  Media library:");
+                console.log(`    hq library search <query> --company ${companyRef ?? companyUid}   (search:query)`);
+                console.log(`    hq library link <vault-key> --company ${companyRef ?? companyUid}   (files:read)`);
+                if (capabilities.includes("files:write")) {
+                    console.log(`    hq library add <file> --company ${companyRef ?? companyUid}   (files:write)`);
+                }
+                console.log("    Or HTTP: POST /v1/keys/search and /v1/keys/files/presign with Authorization: Bearer <key>");
+                console.log(chalk.dim("    Download links are bearer URLs — never post them in Slack or shared channels."));
+            }
+            if (opts.preset === undefined) {
+                console.log("  Vault secrets:");
+                console.log("    hq secrets get <NAME> --reveal");
+                console.log("    hq secrets exec --only <NAME> -- <command>");
+                console.log("    hq secrets list --company <cmp_uid>   (secrets:read)");
+                console.log("    hq secrets set <NAME> --from-stdin --company <cmp_uid>   (secrets:write)");
+                console.log("    Or HTTP: POST /v1/keys/secrets/fetch with Authorization: Bearer <key>");
+                console.log(chalk.dim("    Company-scoped commands need --company <cmp_uid> (or HQ_COMPANY_UID) — slug lookup needs a session."));
+            }
             if (data.apiKey.scope.deploy?.apps?.length) {
                 const deployApps = data.apiKey.scope.deploy.apps;
                 console.log(deployApps.includes(DEPLOY_APP_ALL)

package/dist/commands/billing-sponsor.d.ts

@@ -19,6 +19,10 @@
  * them: it resolves the caller's person id and the company's admin set
  * server-side, so nothing here is trusted from the client.
  *
+ * USAGE PRICING (US-012). A person whose person billing summary carries a
+ * `personalUsage` block is on usage pricing and has no personal plan to
+ * sponsor. `request` tells them so and files nothing.
+ *
  * FEATURE SWITCH. The `plan` request kind only exists while hq-pro's
  * `PLAN_SPONSORSHIP_REQUESTS_ENABLED` switch is on. With the switch off the
  * backend does not recognise `plan` and answers 400 `MISSING_FIELDS` — which

package/dist/commands/billing-sponsor.js

@@ -19,6 +19,10 @@
  * them: it resolves the caller's person id and the company's admin set
  * server-side, so nothing here is trusted from the client.
  *
+ * USAGE PRICING (US-012). A person whose person billing summary carries a
+ * `personalUsage` block is on usage pricing and has no personal plan to
+ * sponsor. `request` tells them so and files nothing.
+ *
  * FEATURE SWITCH. The `plan` request kind only exists while hq-pro's
  * `PLAN_SPONSORSHIP_REQUESTS_ENABLED` switch is on. With the switch off the
  * backend does not recognise `plan` and answers 400 `MISSING_FIELDS` — which
@@ -31,6 +35,7 @@ import { diagnosticsEnabled } from "../lib/diagnostics.js";
 import { ensureCognitoToken } from "../utils/cognito-session.js";
 import { isCompanySelectionError } from "../utils/company-selection-error.js";
 import { vaultApiFetch, getCompanyUid } from "../utils/vault-api.js";
+import { fetchCompanyPricingPlan, fetchPersonPricingPlan, isUsageOnly, usageOnlySponsorLines, } from "../lib/billing/usage-only.js";
 /** The request kind this command files. Matches hq-pro's contract. */
 export const PLAN_RESOURCE = "plan";
 /** What a person is told when hq-pro's plan-sponsorship switch is off. */
@@ -163,18 +168,41 @@ async function transition(requestId, op) {
     });
     return { ...data.request, code: data.code, addCardUrl: data.addCardUrl };
 }
+/** Whether the sponsoring company is on usage pricing. Unknown counts as no. */
+async function companyIsUsageOnly(companyUid) {
+    if (!companyUid)
+        return false;
+    try {
+        return isUsageOnly(await fetchCompanyPricingPlan(await ensureCognitoToken(), companyUid));
+    }
+    catch {
+        return false;
+    }
+}
 export function registerBillingSponsorCommands(billing) {
     const sponsor = billing
         .command("sponsor")
-        .description("Ask a company to cover your $50 plan, or answer a request");
+        .description("Ask a company to cover your personal HQ plan, or answer a request");
     sponsor
         .command("request")
         .argument("<company>", "Company slug or uid to ask")
-        .description("Ask a company to cover your $50 HQ plan")
+        .description("Ask a company to cover your personal HQ plan")
         .option("--json", "Emit raw JSON")
         .action(async function (company, opts) {
         try {
             const token = await ensureCognitoToken();
+            // Usage pricing (US-012): a person on usage pricing has no personal
+            // plan for a company to cover, so nothing is filed.
+            if (isUsageOnly(await fetchPersonPricingPlan(token))) {
+                const lines = usageOnlySponsorLines();
+                if (opts.json) {
+                    process.stdout.write(JSON.stringify({ pricingPlan: "usage-only", request: null, message: lines.join(" ") }, null, 2) + "\n");
+                    return;
+                }
+                for (const line of lines)
+                    console.log(line);
+                return;
+            }
             const companyUid = await getCompanyUid(token, company);
             const data = await callApi(token, "/v1/billing/sponsorship/request", { method: "POST", body: { companyUid, resource: PLAN_RESOURCE } });
             if (opts.json) {
@@ -235,6 +263,12 @@ export function registerBillingSponsorCommands(billing) {
                     console.log(line);
                     return;
                 }
+                // Usage pricing (US-012): no personal plan, so no plan status to show.
+                if (!opts.json && isUsageOnly(await fetchPersonPricingPlan(token))) {
+                    for (const line of usageOnlySponsorLines())
+                        console.log(line);
+                    return;
+                }
                 const state = await readSelfState(token, companyUid);
                 if (opts.json) {
                     process.stdout.write(JSON.stringify(state, null, 2) + "\n");
@@ -277,7 +311,7 @@ export function registerBillingSponsorCommands(billing) {
     sponsor
         .command("approve")
         .argument("<id>", "Request id")
-        .description("Say yes — put someone's $50 plan on the company bill")
+        .description("Say yes — put someone's personal plan on the company bill")
         .option("--json", "Emit raw JSON")
         .action(async function (id, opts) {
         try {
@@ -292,7 +326,9 @@ export function registerBillingSponsorCommands(billing) {
                     console.log(`  ${chalk.cyan(result.addCardUrl)}`);
                 return;
             }
-            console.log("Approved. Their $50 plan is now on the company bill.");
+            console.log((await companyIsUsageOnly(result.companyUid))
+                ? "Approved. Their personal plan is now on the company bill."
+                : "Approved. Their $50 plan is now on the company bill.");
         }
         catch (err) {
             fail(err);
@@ -332,7 +368,9 @@ export function registerBillingSponsorCommands(billing) {
                 process.stdout.write(JSON.stringify(result, null, 2) + "\n");
                 return;
             }
-            console.log("Ended. Their $50 plan goes back to them from the next bill.");
+            console.log((await companyIsUsageOnly(result.companyUid))
+                ? "Ended. Their personal plan goes back to them from the next bill."
+                : "Ended. Their $50 plan goes back to them from the next bill.");
         }
         catch (err) {
             fail(err);
@@ -353,6 +391,11 @@ export function registerBillingSponsorCommands(billing) {
                 process.stdout.write(JSON.stringify(result, null, 2) + "\n");
                 return;
             }
+            if (isUsageOnly(await fetchPersonPricingPlan(await ensureCognitoToken()))) {
+                console.log("Withdrawn.");
+                console.log(usageOnlySponsorLines()[2]);
+                return;
+            }
             console.log("Withdrawn. You can pay the $50 yourself, reduce what you store, or ask another company.");
         }
         catch (err) {

package/dist/commands/billing-usage.d.ts

@@ -0,0 +1,59 @@
+/**
+ * `hq billing usage` (usage-only-pricing US-015, rates per the 2026-10-16 card
+ * in US-012): this month's usage per meter, the projected bill, the included
+ * usage left, and the biggest drivers with a fix for each. Rates come from the
+ * `usage` block of `GET /v1/pricing`, or the bundled card
+ * (src/lib/billing/usage-card.ts) when the feed has none. The /hq-cost skill in hq-core runs this, previews a fix, and only
+ * applies it after the user says yes.
+ *
+ * Read-only. It never prunes, deletes, runs gc or reclaims space: the cloud
+ * storage split uses the same listing as `hq storage status`, which is
+ * read-only too.
+ *
+ * Tenant boundary: the company comes from the caller's own active memberships
+ * (`/membership/me`); a slug outside them is refused before any read. The
+ * usage-limits routes are member-gated on the server as well. With no cloud
+ * company (or `--personal`) it reads the caller's personal scope.
+ *
+ * Usage numbers come through `readMonthUsage` (src/lib/billing/usage-cost.ts),
+ * the single seam to switch to the US-005 daily rollup once it has a read route.
+ */
+import type { Command } from "commander";
+import { type ReadMonthUsageDeps, type StorageSplit, type UsageReport, type UsageScope } from "../lib/billing/usage-cost.js";
+export interface MembershipRef {
+    uid: string;
+    slug: string;
+    role?: string;
+}
+export interface BillingUsageDeps {
+    listCompanies(): Promise<MembershipRef[]>;
+    fetchUsageLimits: ReadMonthUsageDeps["fetchUsageLimits"];
+    readStorageSplit?: (company: MembershipRef, opts: {
+        fresh: boolean;
+    }) => Promise<StorageSplit | null>;
+    fetchPricing(): Promise<unknown | null>;
+    /** Whether the usage trial is running for the scope. Null = unknown. */
+    readTrialActive?: (scope: UsageScope) => Promise<boolean | null>;
+    now(): Date;
+}
+export interface BillingUsageOptions {
+    company?: string;
+    personal?: boolean;
+    storageScan?: boolean;
+    fresh?: boolean;
+}
+export declare class UsageScopeError extends Error {
+}
+/** Pick the scope. Never reaches outside the caller's own memberships. */
+export declare function resolveUsageScope(memberships: MembershipRef[], opts: BillingUsageOptions): UsageScope;
+export declare function runBillingUsage(opts: BillingUsageOptions, deps: BillingUsageDeps): Promise<UsageReport>;
+/**
+ * `hq billing usage --card`: the card from GET /v1/pricing, or the bundled
+ * card when the feed has none. Needs no sign-in.
+ */
+export declare function renderUsageCard(opts?: {
+    json?: boolean;
+    fetchPricing?: () => Promise<unknown | null>;
+}): Promise<string>;
+export declare function registerBillingUsageCommand(billing: Command): void;
+//# sourceMappingURL=billing-usage.d.ts.map

package/dist/commands/billing-usage.js

@@ -0,0 +1,162 @@
+/**
+ * `hq billing usage` (usage-only-pricing US-015, rates per the 2026-10-16 card
+ * in US-012): this month's usage per meter, the projected bill, the included
+ * usage left, and the biggest drivers with a fix for each. Rates come from the
+ * `usage` block of `GET /v1/pricing`, or the bundled card
+ * (src/lib/billing/usage-card.ts) when the feed has none. The /hq-cost skill in hq-core runs this, previews a fix, and only
+ * applies it after the user says yes.
+ *
+ * Read-only. It never prunes, deletes, runs gc or reclaims space: the cloud
+ * storage split uses the same listing as `hq storage status`, which is
+ * read-only too.
+ *
+ * Tenant boundary: the company comes from the caller's own active memberships
+ * (`/membership/me`); a slug outside them is refused before any read. The
+ * usage-limits routes are member-gated on the server as well. With no cloud
+ * company (or `--personal`) it reads the caller's personal scope.
+ *
+ * Usage numbers come through `readMonthUsage` (src/lib/billing/usage-cost.ts),
+ * the single seam to switch to the US-005 daily rollup once it has a read route.
+ */
+import chalk from "chalk";
+import { ensureCognitoToken } from "../utils/cognito-session.js";
+import { vaultApiFetch, vaultApiFetchPublic } from "../utils/vault-api.js";
+import { buildReport, formatReport, readMonthUsage, } from "../lib/billing/usage-cost.js";
+import { ratesFromPricingStatement } from "../lib/billing/usage-rate-card.js";
+import { fetchUsageCard, formatUsageCardLines } from "../lib/billing/usage-card.js";
+import { fetchCompanyBillingSummary, usageTrialActiveFromBody } from "../lib/billing/usage-only.js";
+export class UsageScopeError extends Error {
+}
+/** Pick the scope. Never reaches outside the caller's own memberships. */
+export function resolveUsageScope(memberships, opts) {
+    if (opts.personal && opts.company) {
+        throw new UsageScopeError("Pass --company or --personal, not both.");
+    }
+    if (opts.personal)
+        return { kind: "person" };
+    if (opts.company) {
+        const match = memberships.find((m) => m.slug === opts.company || m.uid === opts.company);
+        if (!match) {
+            throw new UsageScopeError(`You are not an active member of '${opts.company}'. hq billing usage only shows your own companies.`);
+        }
+        return { kind: "company", companyUid: match.uid, companySlug: match.slug, ...(match.role ? { role: match.role } : {}) };
+    }
+    if (memberships.length === 0)
+        return { kind: "person" };
+    if (memberships.length === 1) {
+        const [m] = memberships;
+        return { kind: "company", companyUid: m.uid, companySlug: m.slug, ...(m.role ? { role: m.role } : {}) };
+    }
+    throw new UsageScopeError("You are in more than one company. Re-run with one of:\n" +
+        memberships.map((m) => `  --company ${m.slug}`).join("\n") +
+        "\n  --personal");
+}
+export async function runBillingUsage(opts, deps) {
+    const memberships = await deps.listCompanies();
+    const scope = resolveUsageScope(memberships, opts);
+    const membership = scope.kind === "company" ? memberships.find((m) => m.uid === scope.companyUid) : undefined;
+    const [usage, pricing] = await Promise.all([
+        readMonthUsage(scope, {
+            fetchUsageLimits: deps.fetchUsageLimits,
+            now: deps.now,
+            ...(deps.readTrialActive ? { readTrialActive: deps.readTrialActive } : {}),
+            ...(opts.storageScan !== false && deps.readStorageSplit && membership
+                ? { readStorageSplit: () => deps.readStorageSplit(membership, { fresh: opts.fresh === true }) }
+                : {}),
+        }),
+        deps.fetchPricing().catch(() => null),
+    ]);
+    return buildReport(usage, ratesFromPricingStatement(pricing));
+}
+// ── Production deps ─────────────────────────────────────────────────────────
+function productionDeps() {
+    let tokenP;
+    const token = () => (tokenP ??= ensureCognitoToken());
+    return {
+        async listCompanies() {
+            const res = await vaultApiFetch({ token: await token(), path: "/membership/me" });
+            if (!res.ok)
+                throw new Error(`Could not load your companies (HTTP ${res.status}). Run \`hq login\`.`);
+            const { companiesFromMemberships } = await import("./storage.js");
+            return companiesFromMemberships(await res.json());
+        },
+        async fetchUsageLimits(scope) {
+            const res = await vaultApiFetch(scope.kind === "company"
+                ? { token: await token(), path: "/v1/billing/usage-limits", query: { companyUid: scope.companyUid } }
+                : { token: await token(), path: "/v1/billing/person/usage-limits" });
+            if (!res.ok)
+                return null;
+            return res.json().catch(() => null);
+        },
+        async readStorageSplit(company, { fresh }) {
+            const storage = await import("./storage.js");
+            const deps = await storage.buildStorageDeps();
+            const hit = fresh ? undefined : deps.cloudCache?.read(company);
+            const status = hit ?? (await storage.getCloudStatus(company, deps));
+            if (!hit)
+                deps.cloudCache?.write(company, status);
+            if (!status.available)
+                return null;
+            return {
+                currentBytes: status.current_bytes,
+                oldVersionBytes: status.noncurrent_bytes,
+                oldVersionCount: status.noncurrent_count,
+                ...(status.listed_at ? { listedAt: status.listed_at } : {}),
+                canDelete: status.can_delete,
+            };
+        },
+        async fetchPricing() {
+            const res = await vaultApiFetchPublic({ path: "/v1/pricing" });
+            return res.ok ? res.json().catch(() => null) : null;
+        },
+        async readTrialActive(scope) {
+            // The trial is a company thing; the owner-gated summary says whether it
+            // runs. A member who is not an owner gets 403 and the answer is unknown.
+            if (scope.kind !== "company")
+                return null;
+            const body = await fetchCompanyBillingSummary(await token(), scope.companyUid);
+            return body === null ? null : usageTrialActiveFromBody(body);
+        },
+        now: () => new Date(),
+    };
+}
+/**
+ * `hq billing usage --card`: the card from GET /v1/pricing, or the bundled
+ * card when the feed has none. Needs no sign-in.
+ */
+export async function renderUsageCard(opts = {}) {
+    const { card, source } = await fetchUsageCard(opts.fetchPricing ? { fetchPricing: opts.fetchPricing } : {});
+    if (opts.json)
+        return JSON.stringify({ source, card }, null, 2);
+    const from = source === "feed"
+        ? "from GET /v1/pricing"
+        : "bundled copy; the pricing feed has no usage card yet";
+    return [`HQ usage pricing (card ${card.version}, ${from})`, "", ...formatUsageCardLines(card)].join("\n");
+}
+export function registerBillingUsageCommand(billing) {
+    billing
+        .command("usage")
+        .description("Show this month's usage, projected bill, included usage left and what drives it (read-only)")
+        .option("--company <slug>", "One of your companies (default: your only company)")
+        .option("--personal", "Your personal HQ instead of a company")
+        .option("--no-storage-scan", "Skip listing cloud file versions (faster; no old-versions split)")
+        .option("--fresh", "List cloud file versions live instead of using figures from the last 15 minutes")
+        .option("--card", "Print the usage price card (meters, included usage, trial, boxes, domains) and exit")
+        .option("--json", "Print JSON")
+        .action(async function (opts) {
+        try {
+            if (opts.card) {
+                console.log(await renderUsageCard({ json: opts.json === true }));
+                return;
+            }
+            const parentCompany = this.parent?.opts().company ?? undefined;
+            const report = await runBillingUsage({ ...opts, company: opts.company ?? parentCompany }, productionDeps());
+            console.log(opts.json ? JSON.stringify(report, null, 2) : formatReport(report));
+        }
+        catch (err) {
+            console.error(chalk.red("Error:"), err instanceof Error ? err.message : String(err));
+            process.exitCode = 1;
+        }
+    });
+}
+//# sourceMappingURL=billing-usage.js.map

package/dist/commands/billing.d.ts

@@ -11,9 +11,18 @@
  * Subcommands:
  *   hq billing status   [--company <slug>]              — subscription + card on file
  *   hq billing checkout [--company <slug>] [--personal] — mint a card-capture link
+ *   hq billing usage    [--company <slug>] [--personal] — usage, projected bill,
+ *                                                         drivers (read-only)
+ *   hq billing upgrade  [--company <slug>]              — Workforce checkout
+ *                                                         (legacy plans only)
  *   hq billing sponsor  …                               — ask a company to cover
  *                                                         your $50 plan, or
  *                                                         answer such a request
+ *
+ * Usage pricing (US-012): a company whose billing summary says
+ * `pricingPlan: "usage-only"` has no plan to upgrade to. `hq billing upgrade`
+ * tells it so and points at `hq billing usage` instead of opening Workforce
+ * checkout. Legacy companies keep the Workforce flow unchanged.
  */
 import { Command } from "commander";
 interface DatabaseBilling {

package/dist/commands/billing.js

@@ -11,9 +11,18 @@
  * Subcommands:
  *   hq billing status   [--company <slug>]              — subscription + card on file
  *   hq billing checkout [--company <slug>] [--personal] — mint a card-capture link
+ *   hq billing usage    [--company <slug>] [--personal] — usage, projected bill,
+ *                                                         drivers (read-only)
+ *   hq billing upgrade  [--company <slug>]              — Workforce checkout
+ *                                                         (legacy plans only)
  *   hq billing sponsor  …                               — ask a company to cover
  *                                                         your $50 plan, or
  *                                                         answer such a request
+ *
+ * Usage pricing (US-012): a company whose billing summary says
+ * `pricingPlan: "usage-only"` has no plan to upgrade to. `hq billing upgrade`
+ * tells it so and points at `hq billing usage` instead of opening Workforce
+ * checkout. Legacy companies keep the Workforce flow unchanged.
  */
 import chalk from "chalk";
 import { ensureCognitoToken } from "../utils/cognito-session.js";
@@ -21,6 +30,9 @@ import { vaultApiFetch, getCompanyUid } from "../utils/vault-api.js";
 import { mintPaymentLink } from "../utils/billing-gate.js";
 import { upgradeToTeam } from "../utils/team-upgrade.js";
 import { registerBillingSponsorCommands } from "./billing-sponsor.js";
+import { fetchCompanyPricingPlan, isUsageOnly, usageOnlyUpgradeLines, } from "../lib/billing/usage-only.js";
+import { fetchUsageCard } from "../lib/billing/usage-card.js";
+import { registerBillingUsageCommand } from "./billing-usage.js";
 const CHARGED_ON = {
     team: "the Team subscription",
     dedicated: "the separate HQ database apps subscription",
@@ -145,14 +157,28 @@ export function registerBillingCommand(program) {
     });
     billing
         .command("upgrade")
-        .description("Open Stripe Checkout to upgrade this company to HQ Workforce ($500/mo)")
+        .description("Open Stripe Checkout to upgrade a company on an earlier plan (usage-pricing companies have no plan to upgrade)")
         .option("--company <slug>", "Company slug (resolves to companyUid)")
         .option("--no-browser", "Print the Stripe Checkout URL instead of opening it")
         .option("--json", "Emit the Checkout URL as JSON")
         .action(async function (opts) {
         try {
+            const token = await ensureCognitoToken();
+            const companyUid = await getCompanyUid(token, companyOf(this));
+            const plan = await fetchCompanyPricingPlan(token, companyUid);
+            if (isUsageOnly(plan)) {
+                const { card } = await fetchUsageCard();
+                const lines = usageOnlyUpgradeLines(card);
+                if (opts.json) {
+                    process.stdout.write(JSON.stringify({ pricingPlan: "usage-only", url: null, message: lines.join(" ") }, null, 2) + "\n");
+                    return;
+                }
+                for (const line of lines)
+                    console.log(line);
+                return;
+            }
             await upgradeToTeam({
-                company: companyOf(this),
+                companyUid,
                 noBrowser: opts.browser === false,
                 json: opts.json,
             });
@@ -162,5 +188,6 @@ export function registerBillingCommand(program) {
         }
     });
     registerBillingSponsorCommands(billing);
+    registerBillingUsageCommand(billing);
 }
 //# sourceMappingURL=billing.js.map

package/dist/commands/core-checkpoint-native.d.ts

@@ -27,6 +27,14 @@ export declare const NO_BACKEND_RETRY_MS: number;
  * always releases the queue before the lock would be presumed abandoned.
  */
 export declare const SIBLING_MAX_RUNTIME_MS: number;
+/**
+ * Queued payloads one sibling run may process, across its launch claim and its
+ * own queue drain. Each one runs the full upgrade flow, so a 50-deep queue in
+ * one run outlasts SIBLING_MAX_RUNTIME_MS and the grok turn cap; the run is
+ * then killed with work half done. The launcher re-queues the overflow for the
+ * next sibling instead.
+ */
+export declare const MAX_QUEUED_PAYLOADS_PER_RUN = 5;
 type Backend = "claude" | "codex" | "grok" | "none";
 type SpawnableBackend = Exclude<Backend, "none">;
 /**
@@ -121,6 +129,28 @@ export declare function siblingLaunch(backend: SpawnableBackend, args: string[],
     command: string;
     args: string[];
 };
+/**
+ * Keep the oldest {@link MAX_QUEUED_PAYLOADS_PER_RUN} claimed payloads for this
+ * run and append the rest back to the queue, so a deep queue is worked off
+ * across several runs instead of being lost when one run hits its cap. The
+ * claim file is rewritten to hold only what this run owns.
+ */
+export declare function limitClaimedPayloads(entries: unknown[], claimPath: string, pendingPath: string, limit?: number): unknown[];
+/** Times one queued record may be recovered from a finished run before it is dropped. */
+export declare const MAX_CLAIM_RECOVERIES = 3;
+/**
+ * Put back the queued records a finished sibling claimed but never processed.
+ *
+ * A sibling stopped at its wall-clock or turn cap leaves its claim files
+ * (pending-claimed*.jsonl) in its run directory. A record whose thread file
+ * still exists at its thread_path was not upgraded (the sibling renames the
+ * -auto- file when it is done), so it is appended back to pending.jsonl for
+ * this launch to claim. Only runs whose process is gone are read, records
+ * already queued are not duplicated, and each record is recovered at most
+ * {@link MAX_CLAIM_RECOVERIES} times so one the sibling keeps skipping cannot
+ * cycle forever. Each claim file read is renamed to *.recovered.
+ */
+export declare function recoverOrphanedClaims(siblingRoot: string, pendingPath: string, liveRoot: string): number;
 /** Attach the native checkpoint command to the hidden `hq core` group. */
 export declare function registerCoreCheckpointCommand(core: Command, preResolvedHqRoot?: string): void;
 export {};