@indigoai-us/hq-cli 5.345.156 → 5.345.160

package/dist/hq-cloud-sync-runner/package.json

@@ -1 +1 @@
-{"name":"hq-cli-daemon-sync-runner","type":"module","version":"6.18.91","bundleSha256":"ea41f1765d5015a22304787abedc68a531393d601a349bb8bff3c5428413f3a3","formatVersion":1}
+{"name":"hq-cli-daemon-sync-runner","type":"module","version":"6.18.98","bundleSha256":"70fe5497fffdbb678370515f8b7df63438d7a59a95467102307459e78f9f4715","formatVersion":1}

package/dist/lib/agent-kit/run/inbox.js

@@ -15,6 +15,7 @@
  * item until the bot acks (`POST /v1/agents/{uid}/inbox/{id}/ack`), and the
  * poller dedupes by id so the same item is never mirrored twice.
  */
+import { createWakeSecretResolver } from "../wake-secrets.js";
 import * as fs from "node:fs";
 import * as path from "node:path";
 import { vaultApiFetch } from "../../../utils/vault-api.js";
@@ -247,7 +248,7 @@ async function maybeWake(deps, freshCount) {
         return;
     const notice = buildWakeNotice(deps.agentUid, reason, pending.map((e) => e.id), now);
     try {
-        await (deps.fireWake ?? fireWake)(config, notice, { paths: deps.paths, agentUid: deps.agentUid, log: deps.log, now: deps.now });
+        await (deps.fireWake ?? fireWake)(config, notice, { paths: deps.paths, agentUid: deps.agentUid, log: deps.log, now: deps.now, resolveHeaderSecrets: createWakeSecretResolver(deps.companySlug, deps.getToken, deps.apiBaseUrl) });
     }
     catch (err) {
         deps.log("warn", `wake failed: ${err instanceof Error ? err.message : String(err)}`);

package/dist/lib/agent-kit/wake-secrets.d.ts

@@ -0,0 +1,7 @@
+/** Wake-only vault reads: use the kit machine token, never cache plaintext. */
+import { getCompanyUid, vaultApiFetch } from "../../utils/vault-api.js";
+export declare function createWakeSecretResolver(companySlug: string | undefined, getToken: () => Promise<string>, baseUrl: string, deps?: {
+    getCompanyUid: typeof getCompanyUid;
+    vaultApiFetch: typeof vaultApiFetch;
+}): (names: string[]) => Promise<Map<string, string>>;
+//# sourceMappingURL=wake-secrets.d.ts.map

package/dist/lib/agent-kit/wake-secrets.js

@@ -0,0 +1,32 @@
+/** Wake-only vault reads: use the kit machine token, never cache plaintext. */
+import { getCompanyUid, vaultApiFetch } from "../../utils/vault-api.js";
+export function createWakeSecretResolver(companySlug, getToken, baseUrl, deps = { getCompanyUid, vaultApiFetch }) {
+    return async (names) => {
+        if (!companySlug)
+            throw new Error("Wake secrets require an enrolled company");
+        const token = await getToken();
+        const companyUid = await deps.getCompanyUid(token, companySlug, baseUrl);
+        const response = await deps.vaultApiFetch({
+            token, baseUrl, path: `/secrets/${encodeURIComponent(companyUid)}/load`, method: "POST",
+            body: { names, usage: { channel: "exec", reason: "agent kit webhook wake" } },
+            signal: AbortSignal.timeout(15_000),
+        });
+        if (!response.ok)
+            throw new Error("Wake secret authorization failed");
+        const data = await response.json();
+        if (!Array.isArray(data.secrets) || !Array.isArray(data.errors) || data.errors.length) {
+            throw new Error("Wake secret lookup failed");
+        }
+        const values = new Map();
+        for (const row of data.secrets) {
+            if (!row || typeof row.name !== "string" || !names.includes(row.name) || values.has(row.name) ||
+                typeof row.value !== "string" || row.revokedAt != null)
+                throw new Error("Invalid wake secret response");
+            values.set(row.name, row.value);
+        }
+        if (values.size !== new Set(names).size)
+            throw new Error("Wake secret missing");
+        return values;
+    };
+}
+//# sourceMappingURL=wake-secrets.js.map

package/dist/lib/agent-kit/wake.d.ts

@@ -30,12 +30,15 @@ export type WakeConfig = {
     kind: "url";
     url: string;
     retryMs: number;
+    headerSecrets?: Record<string, string>;
 } | {
     kind: "command";
     command: string[];
     timeoutMs: number;
     retryMs: number;
 };
+/** Store references only. Reject ambiguous and transport-controlled headers. */
+export declare function parseHeaderSecrets(specs: string[]): Record<string, string>;
 export interface WakeNotice {
     event: "hq.inbox.pending";
     agentUid: string;
@@ -59,6 +62,7 @@ export interface WakeDeps {
     agentUid: string;
     log: KitLogger;
     now?: () => Date;
+    resolveHeaderSecrets?: (names: string[]) => Promise<Map<string, string>>;
     fetchImpl?: typeof fetch;
     spawnImpl?: typeof spawn;
     pidAlive?: (pid: number | undefined) => boolean;

package/dist/lib/agent-kit/wake.js

@@ -18,6 +18,7 @@
  * The inbox poller fires the wake when new items are mirrored, and re-fires
  * every `retryMs` while items stay pending, so a missed webhook heals.
  */
+import { SECRET_NAME_PATTERN } from "../../commands/_patterns.js";
 import { spawn } from "node:child_process";
 import * as fs from "node:fs";
 import * as path from "node:path";
@@ -27,6 +28,33 @@ export const WAKE_STATE_NAME = "wake-state.json";
 export const DEFAULT_WAKE_RETRY_MS = 10 * 60_000;
 export const WAKE_URL_TIMEOUT_MS = 15_000;
 export const DEFAULT_WAKE_COMMAND_TIMEOUT_MS = 10 * 60_000;
+/** Store references only. Reject ambiguous and transport-controlled headers. */
+export function parseHeaderSecrets(specs) {
+    const result = {};
+    const seen = new Set();
+    for (const spec of specs) {
+        const at = spec.indexOf("=");
+        const header = spec.slice(0, at);
+        const name = spec.slice(at + 1);
+        const lower = header.toLowerCase();
+        if (at < 1 || !/^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/.test(header) || !SECRET_NAME_PATTERN.test(name) ||
+            ["host", "content-length", "transfer-encoding", "connection", "content-type", "user-agent", "__proto__"].includes(lower) || seen.has(lower)) {
+            throw new Error("Invalid --header-secret: use a unique Header-Name=VAULT_SECRET_NAME reference");
+        }
+        seen.add(lower);
+        result[header] = name;
+    }
+    return result;
+}
+function validateHeaderSecrets(raw) {
+    if (!raw || typeof raw !== "object" || Array.isArray(raw))
+        throw new Error("Invalid header secret references");
+    return parseHeaderSecrets(Object.entries(raw).map(([header, name]) => {
+        if (typeof name !== "string")
+            throw new Error("Invalid header secret reference");
+        return `${header}=${name}`;
+    }));
+}
 export const WAKE_INSTRUCTIONS = "New HQ messages are waiting. Run `hq agent inbox` (or the hq_inbox_read tool). Reply where each message " +
     "arrived: if it has a channelId, post in that channel with `hq dm <channelId> \"…\"`; otherwise reply to the " +
     "sender with `hq dm <sender-uid> \"…\"` (or hq_dm_send). Do not reply to another bot's greeting, thanks or " +
@@ -82,7 +110,7 @@ export function readWakeConfig(paths) {
     const retryMs = typeof raw.retryMs === "number" && raw.retryMs >= 60_000 ? raw.retryMs : DEFAULT_WAKE_RETRY_MS;
     if (raw.kind === "url" && typeof raw.url === "string") {
         try {
-            return { kind: "url", url: validateWakeUrl(raw.url), retryMs };
+            return { kind: "url", url: validateWakeUrl(raw.url), retryMs, ...(raw.headerSecrets === undefined ? {} : { headerSecrets: validateHeaderSecrets(raw.headerSecrets) }) };
         }
         catch {
             return null;
@@ -167,9 +195,27 @@ export async function fireWake(config, notice, deps) {
         const timer = setTimeout(() => controller.abort(), WAKE_URL_TIMEOUT_MS);
         const target = redactWakeUrl(config.url);
         try {
+            const headers = new Headers({ "content-type": "application/json", "user-agent": "hq-agent-kit" });
+            if (config.headerSecrets !== undefined) {
+                const refs = validateHeaderSecrets(config.headerSecrets);
+                const names = [...new Set(Object.values(refs))];
+                if (names.length) {
+                    if (!deps.resolveHeaderSecrets)
+                        throw new Error("Secret resolution unavailable");
+                    const values = await deps.resolveHeaderSecrets(names);
+                    for (const [header, name] of Object.entries(refs)) {
+                        const value = values.get(name);
+                        if (!value || /[\r\n\0]/.test(value))
+                            throw new Error("Invalid secret header value");
+                        headers.set(header, value);
+                    }
+                }
+            }
             const res = await doFetch(config.url, {
                 method: "POST",
-                headers: { "content-type": "application/json", "user-agent": "hq-agent-kit" },
+                headers,
+                // Custom authentication headers must never follow a redirect.
+                redirect: "error",
                 body: JSON.stringify(notice),
                 signal: controller.signal,
             });
@@ -180,7 +226,7 @@ export async function fireWake(config, notice, deps) {
             return { fired: true, ok, detail };
         }
         catch (err) {
-            const detail = `wake url ${target} failed: ${err instanceof Error ? err.name === "AbortError" ? "timeout" : err.message : String(err)}`;
+            const detail = `wake url ${target} failed: ${err instanceof Error ? err.name === "AbortError" ? "timeout" : ["ECONNREFUSED", "ENOTFOUND", "ETIMEDOUT", "ECONNRESET"].includes(err.message) ? err.message : "request or secret resolution failed" : "request or secret resolution failed"}`;
             deps.log("warn", detail);
             return { fired: true, ok: false, detail };
         }

package/dist/lib/billing/plan-limit-refusals.d.ts

@@ -18,6 +18,12 @@
  * stops re-sending paused keys. The `path`/`paths`/`count` reads below consume
  * that event; the `error`-message parsing stays for runners older than
  * 6.18.17.
+ *
+ * US-024: the server's sentence wins. A `plan-limit` event carries the 402
+ * body's `message` (for a usage pause, the `usagePause` message hq-pro writes
+ * for the person who hit it), and a runner that forwards `usagePause` gives
+ * its message and `actionUrl` directly. The CLI adds no plan name and labels
+ * the link `Billing:`, never "Upgrade".
  */
 import { type SyncProgressEvent } from "@indigoai-us/hq-cloud";
 /** What one push leg was refused. `null` from the tracker means nothing was. */
@@ -29,10 +35,12 @@ export interface PlanLimitRefusalSummary {
     count: number;
     /** Vault-relative paths the runner named, de-duplicated, in report order. */
     paths: string[];
-    /** Server sentence from a refused file's error, when one was carried. */
+    /** Server sentence (usage pause message, event message, or a refused file's error). */
     message?: string;
-    /** Server-selected (or company billing fallback) upgrade link. */
+    /** Server-selected (or company billing fallback) billing link. */
     upgradeUrl?: string;
+    /** True when the server said this is a usage pause (`usagePause`). */
+    usagePause?: boolean;
 }
 export interface PlanLimitRefusalTracker {
     observe(event: SyncProgressEvent): void;
@@ -57,9 +65,11 @@ export declare function createPlanLimitRefusalTracker(opts?: {
 export declare function trackingProgressRecorder(tracker: PlanLimitRefusalTracker, company: string | null): (event: SyncProgressEvent) => void;
 /** Add a later leg's refusals to an earlier total. */
 export declare function mergePlanLimitRefusals(a: PlanLimitRefusalSummary | null | undefined, b: PlanLimitRefusalSummary | null | undefined): PlanLimitRefusalSummary | null;
+/** The sentence when the server sent none. Names no plan. */
+export declare const REFUSAL_FALLBACK_SENTENCE = "New files are paused for this account. Open its Billing page to see why.";
 /**
  * Plain lines describing a refusal: what was not uploaded, why, and the
- * upgrade link. Colour and the leading status line are the caller's.
+ * billing link. Colour and the leading status line are the caller's.
  */
 export declare function renderPlanLimitRefusalLines(summary: PlanLimitRefusalSummary, indent?: string): string[];
 /** "1 new file" / "3 new files", or "new files" when only a notice said so. */

package/dist/lib/billing/plan-limit-refusals.js

@@ -18,9 +18,16 @@
  * stops re-sending paused keys. The `path`/`paths`/`count` reads below consume
  * that event; the `error`-message parsing stays for runners older than
  * 6.18.17.
+ *
+ * US-024: the server's sentence wins. A `plan-limit` event carries the 402
+ * body's `message` (for a usage pause, the `usagePause` message hq-pro writes
+ * for the person who hit it), and a runner that forwards `usagePause` gives
+ * its message and `actionUrl` directly. The CLI adds no plan name and labels
+ * the link `Billing:`, never "Upgrade".
  */
 import { createSyncProgressRecorder, } from "@indigoai-us/hq-cloud";
 import { planLimitUpgradeFallbackUrl } from "./plan-limit-upgrade-url.js";
+import { usagePauseFromBody } from "./usage-pause.js";
 /** Upgrade destination when neither the event nor the error named one. */
 const FALLBACK_UPGRADE_URL = "https://hq.computer/billing";
 const PLAN_LIMIT_CODE_TOKEN = /\bcode=(?:PLAN_LIMIT_EXCEEDED|PLAN_LIMIT_REACHED|plan_limit_reached)\b/;
@@ -72,6 +79,7 @@ export function createPlanLimitRefusalTracker(opts = {}) {
     let reportedCount = 0;
     let message;
     let upgradeUrl;
+    let usagePaused = false;
     const addPath = (value) => {
         if (typeof value === "string" && value && !paths.includes(value)) {
             paths.push(value);
@@ -82,7 +90,17 @@ export function createPlanLimitRefusalTracker(opts = {}) {
             const record = event;
             if (event.type === "plan-limit") {
                 noticeSeen = true;
+                const pause = usagePauseFromBody(record);
+                if (pause) {
+                    usagePaused = true;
+                    message = pause.message;
+                    if (pause.actionUrl)
+                        upgradeUrl = pause.actionUrl;
+                }
                 upgradeUrl ??= safeHttpsUrl(record.upgradeUrl);
+                if (typeof record.message === "string" && record.message.trim()) {
+                    message ??= record.message.trim();
+                }
                 addPath(record.path);
                 if (Array.isArray(record.paths))
                     record.paths.forEach(addPath);
@@ -111,6 +129,7 @@ export function createPlanLimitRefusalTracker(opts = {}) {
                 paths: [...paths],
                 ...(message ? { message } : {}),
                 ...(url ? { upgradeUrl: url } : {}),
+                ...(usagePaused ? { usagePause: true } : {}),
             };
         },
     };
@@ -141,22 +160,26 @@ export function mergePlanLimitRefusals(a, b) {
             paths.push(p);
     const message = a.message ?? b.message;
     const upgradeUrl = a.upgradeUrl ?? b.upgradeUrl;
+    const usagePause = a.usagePause === true || b.usagePause === true;
     return {
         count: a.count + b.count,
         paths,
         ...(message ? { message } : {}),
         ...(upgradeUrl ? { upgradeUrl } : {}),
+        ...(usagePause ? { usagePause } : {}),
     };
 }
 /** How many named paths to print before summarising the rest. */
 const MAX_LISTED_PATHS = 20;
+/** The sentence when the server sent none. Names no plan. */
+export const REFUSAL_FALLBACK_SENTENCE = "New files are paused for this account. Open its Billing page to see why.";
 /**
  * Plain lines describing a refusal: what was not uploaded, why, and the
- * upgrade link. Colour and the leading status line are the caller's.
+ * billing link. Colour and the leading status line are the caller's.
  */
 export function renderPlanLimitRefusalLines(summary, indent = "  ") {
     const lines = [];
-    lines.push(`${indent}${summary.message ?? "New files are paused by your plan limit."}`);
+    lines.push(`${indent}${summary.message ?? REFUSAL_FALLBACK_SENTENCE}`);
     if (summary.paths.length > 0) {
         lines.push(`${indent}Not uploaded:`);
         for (const p of summary.paths.slice(0, MAX_LISTED_PATHS)) {
@@ -170,7 +193,7 @@ export function renderPlanLimitRefusalLines(summary, indent = "  ") {
         lines.push(`${indent}New files stay on this machine and were not uploaded.`);
     }
     if (summary.upgradeUrl)
-        lines.push(`${indent}Upgrade: ${summary.upgradeUrl}`);
+        lines.push(`${indent}Billing: ${summary.upgradeUrl}`);
     return lines;
 }
 /** "1 new file" / "3 new files", or "new files" when only a notice said so. */

package/dist/lib/billing/plan-limit-upgrade-url.d.ts

@@ -3,6 +3,14 @@ export interface PlanLimitUpgradeUrlChoices {
     nestedUrl?: string | null;
     legacyUrl: string;
 }
+/**
+ * The console's self-serve switch to usage pricing for one company. While HQ
+ * Workforce is closed to companies not already on it (hq-pro
+ * `billing.legacy-plans-closed`, owner decision 2026-10-19) this is where an
+ * upgrade leads; the Workforce checkout refuses. Null when no console origin
+ * can be derived; without a slug the generic billing page.
+ */
+export declare function usageSwitchPageUrl(companySlug?: string): string | null;
 /** Resolve and attribute the final selected company billing destination. */
 export declare function selectPlanLimitUpgradeUrl(companySlug: string | undefined, choices: PlanLimitUpgradeUrlChoices): string;
 export declare function withCliLimitEntrySurface(value: string): string;

package/dist/lib/billing/plan-limit-upgrade-url.js

@@ -11,6 +11,24 @@ function companyBillingUrl(companySlug) {
         : "/billing";
     return `${origin}${route}`;
 }
+/**
+ * The console's self-serve switch to usage pricing for one company. While HQ
+ * Workforce is closed to companies not already on it (hq-pro
+ * `billing.legacy-plans-closed`, owner decision 2026-10-19) this is where an
+ * upgrade leads; the Workforce checkout refuses. Null when no console origin
+ * can be derived; without a slug the generic billing page.
+ */
+export function usageSwitchPageUrl(companySlug) {
+    const controlPlaneUrl = process.env.HQ_VAULT_API_URL?.trim() || DEFAULT_VAULT_API_URL;
+    const origin = consoleOrigin(controlPlaneUrl);
+    if (!origin)
+        return null;
+    const slug = companySlug?.trim();
+    const route = slug
+        ? `/companies/${encodeURIComponent(slug)}/billing/usage-switch?entrySurface=cli_limit`
+        : "/billing";
+    return `${origin}${route}`;
+}
 /** Resolve and attribute the final selected company billing destination. */
 export function selectPlanLimitUpgradeUrl(companySlug, choices) {
     const topLevelUrl = choices.topLevelUrl?.trim() || undefined;

package/dist/lib/billing/plan-lock.d.ts

@@ -17,6 +17,13 @@
  * Copy rule (US-036): no string a customer reads may contain "locked" or
  * "read-only". `plan-lock.test.ts` scans every rendered string for both.
  *
+ * Copy rule (US-024): the flat plans are closed, so nothing here offers the
+ * Workforce plan, its price or the free month, and nothing says "Upgrade".
+ * The plan is named (Starter) only when hq-pro said the company is on an
+ * earlier plan (`billingState` or `pricingPlan: "current"`); an unknown plan
+ * gets copy that names no plan, and the way out besides trimming is the
+ * switch to usage pricing or the company's Billing page.
+ *
  * An absent field is UNKNOWN, so nothing here ever infers over-limit from
  * missing data (hq-absent-field-never-means-constraining-value).
  */
@@ -58,8 +65,18 @@ export interface PlanLimitStatus {
      * which keeps the legacy copy.
      */
     pricingPlan?: PricingPlan;
+    /**
+     * True when hq-pro says HQ Workforce is closed to this company (hq-flags
+     * `billing.legacy-plans-closed`, owner decision 2026-10-19). `upgradeUrl`
+     * is then the console's usage-pricing switch page, the free month never
+     * stands, and the renderers offer the switch instead of a Workforce
+     * upgrade. Absent keeps the legacy copy (older servers).
+     */
+    legacyPlansClosed?: boolean;
     checkedAt: string;
 }
+/** The way out while HQ Workforce is closed. Copy lives in ONE place. */
+export declare const USAGE_SWITCH_LABEL = "Switch to usage pricing";
 /** Starter member cap quoted when the server did not send a users.limit. */
 export declare const STARTER_MEMBER_TARGET = 5;
 /**
@@ -71,10 +88,8 @@ export declare const STARTER_INTEGRATION_TARGET = 3;
 export declare const STARTER_SECRET_TARGET = 10;
 /** Starter agent cap quoted when the server did not send an agents.limit. */
 export declare const STARTER_AGENT_TARGET = 0;
-/** Upgrade destination quoted when the server did not send one. */
+/** Billing destination quoted when the server did not send one. */
 export declare const DEFAULT_UPGRADE_URL = "https://hq.computer/billing";
-/** The paid plan the nag sends owners to. Copy lives in ONE place. */
-export declare const WORKFORCE_PLAN_LABEL = "HQ Workforce ($500/mo)";
 /**
  * Pick the membership row for `companySlug` (or `cmp_…` uid) out of a decoded
  * `/membership/me` body. No matching row is UNKNOWN. Does not read `planLock`.
@@ -133,9 +148,10 @@ export declare function renderPlanLimitNotice(status: PlanLimitStatus, opts?: {
  */
 export declare function renderPlanLimitLine(status: PlanLimitStatus): string;
 /**
- * The `Plan: …` orientation line. Starter only: a paid or enterprise
- * workspace — and an UNKNOWN plan — gets no line at all. A usage-pricing
- * company gets the usage line instead.
+ * The `Plan: …` orientation line. Starter only, and only when hq-pro said the
+ * company is on an earlier plan: a paid or enterprise workspace gets no line,
+ * and an UNKNOWN pricing plan names no plan. A usage-pricing company gets the
+ * usage line instead.
  */
 export declare function renderPlanLine(status: PlanLimitStatus): string | null;
 /**

package/dist/lib/billing/plan-lock.js

@@ -17,6 +17,13 @@
  * Copy rule (US-036): no string a customer reads may contain "locked" or
  * "read-only". `plan-lock.test.ts` scans every rendered string for both.
  *
+ * Copy rule (US-024): the flat plans are closed, so nothing here offers the
+ * Workforce plan, its price or the free month, and nothing says "Upgrade".
+ * The plan is named (Starter) only when hq-pro said the company is on an
+ * earlier plan (`billingState` or `pricingPlan: "current"`); an unknown plan
+ * gets copy that names no plan, and the way out besides trimming is the
+ * switch to usage pricing or the company's Billing page.
+ *
  * An absent field is UNKNOWN, so nothing here ever infers over-limit from
  * missing data (hq-absent-field-never-means-constraining-value).
  */
@@ -24,7 +31,7 @@ import chalk from "chalk";
 import { diagnosticsEnabled } from "../diagnostics.js";
 import { vaultApiFetch } from "../../utils/vault-api.js";
 import { parseFreeMonth } from "./free-month.js";
-import { selectPlanLimitUpgradeUrl } from "./plan-limit-upgrade-url.js";
+import { selectPlanLimitUpgradeUrl, usageSwitchPageUrl, } from "./plan-limit-upgrade-url.js";
 import { fetchCompanyPricingPlan, isUsageOnly, pricingPlanFromBody, pricingPlanFromMembership, usageOnlyPlanLine, usageOnlyUpgradeLines, } from "./usage-only.js";
 // The free-month parser lives in a leaf module so the plan-gate 402 decoder can
 // share it without importing the HTTP layer; re-exported so existing callers
@@ -41,6 +48,8 @@ export const PLAN_LIMIT_REASONS = [
     "secrets",
     "agents",
 ];
+/** The way out while HQ Workforce is closed. Copy lives in ONE place. */
+export const USAGE_SWITCH_LABEL = "Switch to usage pricing";
 /** Starter member cap quoted when the server did not send a users.limit. */
 export const STARTER_MEMBER_TARGET = 5;
 /**
@@ -52,10 +61,8 @@ export const STARTER_INTEGRATION_TARGET = 3;
 export const STARTER_SECRET_TARGET = 10;
 /** Starter agent cap quoted when the server did not send an agents.limit. */
 export const STARTER_AGENT_TARGET = 0;
-/** Upgrade destination quoted when the server did not send one. */
+/** Billing destination quoted when the server did not send one. */
 export const DEFAULT_UPGRADE_URL = "https://hq.computer/billing";
-/** The paid plan the nag sends owners to. Copy lives in ONE place. */
-export const WORKFORCE_PLAN_LABEL = "HQ Workforce ($500/mo)";
 function finiteNumber(value) {
     return typeof value === "number" && Number.isFinite(value) ? value : null;
 }
@@ -157,6 +164,17 @@ function selectUpgradeUrl(body, companySlug) {
     const nestedUrl = typeof nested?.upgradeUrl === "string" && nested.upgradeUrl.trim().length > 0
         ? nested.upgradeUrl.trim()
         : undefined;
+    // While HQ Workforce is closed the way out is the usage-pricing switch, not
+    // the company billing page the generated URL would land on. Build it from
+    // the slug when known; otherwise keep the server's own switch URL.
+    if (rec?.legacyPlansClosed === true) {
+        const slug = companySlug?.trim();
+        return (slug ? usageSwitchPageUrl(slug) : undefined) ??
+            topLevelUrl ??
+            nestedUrl ??
+            usageSwitchPageUrl(undefined) ??
+            DEFAULT_UPGRADE_URL;
+    }
     return selectPlanLimitUpgradeUrl(companySlug, {
         topLevelUrl,
         nestedUrl,
@@ -210,6 +228,7 @@ function statusFromUsage(companySlug, companyUid, body, upgradeCompanySlug) {
         upgradeUrl: selectUpgradeUrl(body, upgradeCompanySlug),
         freeMonth: parseFreeMonth(rec?.freeMonth),
         plan: selectPlan(body) ?? undefined,
+        ...(rec?.legacyPlansClosed === true ? { legacyPlansClosed: true } : {}),
         checkedAt: new Date().toISOString(),
     }, pricingPlan);
 }
@@ -295,6 +314,10 @@ export async function fetchPlanLimitStatus(token, companyRef, opts = {}) {
         return null;
     }
 }
+/** True when hq-pro said the company is on an earlier (flat) plan. */
+function knownEarlierPlan(status) {
+    return status.pricingPlan === "current";
+}
 /** Why the workspace is over, one clause per reason. */
 export function reasonLabel(reason) {
     switch (reason) {
@@ -305,7 +328,7 @@ export function reasonLabel(reason) {
         case "secrets":
             return "too many secrets";
         case "agents":
-            return "agents are not included on Starter";
+            return "agents are not included";
     }
 }
 function usageTarget(reason, status) {
@@ -357,7 +380,7 @@ function reasonDetail(reason, status) {
                 ? `${row.used} of ${target} secrets`
                 : `over its ${target}-secret limit`;
         case "agents":
-            return "agents are not included on Starter";
+            return "agents are not included";
     }
 }
 function usageLine(reason, status) {
@@ -368,20 +391,20 @@ function usageLine(reason, status) {
             const members = row ?? status.members;
             return members
                 ? `  Members: ${members.used} of ${target}.`
-                : `  Members allowed on Starter: ${target}.`;
+                : `  Members allowed: ${target}.`;
         }
         case "integrations":
             return row
                 ? `  Integrations: ${row.used} of ${target}.`
-                : `  Integrations allowed on Starter: ${target}.`;
+                : `  Integrations allowed: ${target}.`;
         case "secrets":
             return row
                 ? `  Secrets: ${row.used} of ${target}.`
-                : `  Secrets allowed on Starter: ${target}.`;
+                : `  Secrets allowed: ${target}.`;
         case "agents":
             return row
                 ? `  Agents: ${row.used} of ${target}.`
-                : `  Agents allowed on Starter: ${target}.`;
+                : `  Agents allowed: ${target}.`;
     }
 }
 /**
@@ -409,15 +432,17 @@ function capitalize(text) {
  * about a dimension nobody measured.
  */
 export function renderPlanLimitNotice(status, opts = {}) {
-    const { companySlug, freeMonth } = status;
+    const { companySlug } = status;
     const lines = [];
     if (isUsageOnly(status.pricingPlan)) {
         return [`${companySlug}:`, ...usageOnlyUpgradeLines().map((l) => `  ${l}`)].join("\n");
     }
-    lines.push(`HQ Starter — ${companySlug} is over its plan limits.`);
+    lines.push(knownEarlierPlan(status)
+        ? `HQ Starter — ${companySlug} is over its Starter limits.`
+        : `${companySlug} is over its limits.`);
     const reasons = status.reasons.length
         ? status.reasons.map(reasonLabel).join("; ")
-        : "over the Starter plan limits";
+        : "over its limits";
     lines.push(`  Why: ${reasons}.`);
     for (const reason of status.reasons) {
         lines.push(usageLine(reason, status));
@@ -426,21 +451,20 @@ export function renderPlanLimitNotice(status, opts = {}) {
     lines.push(HARD_STOP_SENTENCE_LINES[1]);
     const remedy = status.reasons.length
         ? status.reasons.map((reason) => reasonRemedy(reason, status)).join(", and ")
-        : "come back under the Starter plan limits";
-    const freeMonthUrl = freeMonth?.url;
-    const hasFreeMonth = Boolean(freeMonth?.eligible && freeMonthUrl);
-    if (hasFreeMonth) {
-        lines.push("  Three ways to sort it:");
-        lines.push(`    1. Start your free month — add a card, first month free: ${freeMonthUrl}`);
-        lines.push(`    2. ${capitalize(remedy)}.`);
-        lines.push(`    3. Upgrade to ${WORKFORCE_PLAN_LABEL}.`);
+        : "come back under its limits";
+    // The flat plans are closed: no Workforce offer and no free month (it led
+    // to the closed checkout). The second way out is the switch to usage
+    // pricing when the server said the company is on an earlier plan or that
+    // the flat plans are closed to it; otherwise the company's Billing page.
+    lines.push("  Two ways to sort it:");
+    lines.push(`    1. ${capitalize(remedy)}.`);
+    if (status.legacyPlansClosed || knownEarlierPlan(status)) {
+        lines.push(`    2. ${USAGE_SWITCH_LABEL}: no plan fee, and these limits stop applying.`);
     }
     else {
-        lines.push("  Two ways to sort it:");
-        lines.push(`    1. ${capitalize(remedy)}.`);
-        lines.push(`    2. Upgrade to ${WORKFORCE_PLAN_LABEL}.`);
+        lines.push("    2. Open the company's Billing page.");
     }
-    lines.push(`  Upgrade: ${status.upgradeUrl}`);
+    lines.push(`  ${status.legacyPlansClosed ? "Switch" : "Billing"}: ${status.upgradeUrl}`);
     if (opts.inviteTeammateEnabled === true &&
         status.plan === "free" &&
         status.over &&
@@ -459,18 +483,22 @@ export function renderPlanLimitLine(status) {
     }
     const detail = status.reasons.length
         ? status.reasons.map((reason) => reasonDetail(reason, status)).join("; ")
-        : "over the Starter plan limits";
-    return (`Company ${status.companySlug} is over its Starter limits (${detail}). ` +
+        : "over its limits";
+    const limits = knownEarlierPlan(status) ? "its Starter limits" : "its limits";
+    return (`Company ${status.companySlug} is over ${limits} (${detail}). ` +
         `New files and new secrets are paused until this is sorted: ${status.upgradeUrl}`);
 }
 /**
- * The `Plan: …` orientation line. Starter only: a paid or enterprise
- * workspace — and an UNKNOWN plan — gets no line at all. A usage-pricing
- * company gets the usage line instead.
+ * The `Plan: …` orientation line. Starter only, and only when hq-pro said the
+ * company is on an earlier plan: a paid or enterprise workspace gets no line,
+ * and an UNKNOWN pricing plan names no plan. A usage-pricing company gets the
+ * usage line instead.
  */
 export function renderPlanLine(status) {
     if (isUsageOnly(status.pricingPlan))
         return usageOnlyPlanLine();
+    if (!knownEarlierPlan(status))
+        return status.over ? "Plan: over its limits" : null;
     if (status.over)
         return "Plan: Starter — over its limits";
     if (status.plan !== "free")