@indigoai-us/hq-cli 5.345.156 → 5.345.160

package/dist/command-registration-plan.d.ts

@@ -400,6 +400,12 @@ export declare const REGISTRATION_PLAN: readonly [{
     readonly parent: "program";
     readonly module: "./commands/mcp-status.js";
     readonly exportName: "registerMcpCommand";
+}, {
+    readonly type: "registrar";
+    readonly root: "repo";
+    readonly parent: "program";
+    readonly module: "./commands/repo.js";
+    readonly exportName: "registerRepoCommand";
 }, {
     readonly type: "registrar";
     readonly root: "crm";
@@ -533,6 +539,12 @@ export declare const REGISTRATION_PLAN: readonly [{
     readonly parent: "deploy";
     readonly module: "./commands/deploy-list.js";
     readonly exportName: "registerDeployListCommand";
+}, {
+    readonly type: "registrar";
+    readonly root: "deploy";
+    readonly parent: "deploy";
+    readonly module: "./commands/deploy-access.js";
+    readonly exportName: "registerDeployAccessCommand";
 }, {
     readonly type: "group";
     readonly root: "staff";
@@ -551,6 +563,12 @@ export declare const REGISTRATION_PLAN: readonly [{
     readonly parent: "staff";
     readonly module: "./commands/staff/test-account.js";
     readonly exportName: "registerTestAccountCommand";
+}, {
+    readonly type: "registrar";
+    readonly root: "staff";
+    readonly parent: "staff";
+    readonly module: "./commands/staff/listings.js";
+    readonly exportName: "registerListingsCommand";
 }];
 export declare function registerAllCommands(program: Command): Promise<void>;
 export declare function registerCommandRoot(program: Command, root: string): Promise<boolean>;

package/dist/command-registration-plan.js

@@ -69,6 +69,7 @@ export const REGISTRATION_PLAN = [
     { type: "registrar", root: "reindex", parent: "program", module: "./commands/reindex.js", exportName: "registerReindexCommand" },
     { type: "registrar", root: "rescue", parent: "program", module: "./commands/rescue.js", exportName: "registerRescueCommand" },
     { type: "registrar", root: "mcp", parent: "program", module: "./commands/mcp-status.js", exportName: "registerMcpCommand" },
+    { type: "registrar", root: "repo", parent: "program", module: "./commands/repo.js", exportName: "registerRepoCommand" },
     { type: "registrar", root: "crm", parent: "program", module: "./commands/crm.js", exportName: "registerCrmCommand" },
     { type: "registrar", root: "company", parent: "program", module: "./commands/company.js", exportName: "registerCompanyCommand" },
     { type: "registrar", root: "agents", parent: "program", module: "./commands/agents.js", exportName: "registerAgentsCommand" },
@@ -91,12 +92,15 @@ export const REGISTRATION_PLAN = [
     { type: "group", root: "deploy", id: "deploy", name: "deploy", description: "Manage deployments in hq-deploy" },
     { type: "registrar", root: "deploy", parent: "deploy", module: "./commands/deploy-comments.js", exportName: "registerDeployCommentsCommand" },
     { type: "registrar", root: "deploy", parent: "deploy", module: "./commands/deploy-list.js", exportName: "registerDeployListCommand" },
+    { type: "registrar", root: "deploy", parent: "deploy", module: "./commands/deploy-access.js", exportName: "registerDeployAccessCommand" },
     // onboarding-test-accounts US-007 — super-admin staff CLI wrappers over the
     // hq-pro admin surface. New wrappers land under this group; the reset
     // command mirrors POST /v1/admin/test-account/reset.
     { type: "group", root: "staff", id: "staff", name: "staff", description: "Staff-only commands (super-admin required)" },
     { type: "registrar", root: "staff", parent: "staff", module: "./commands/staff/reset-test-account.js", exportName: "registerResetTestAccountCommand" },
     { type: "registrar", root: "staff", parent: "staff", module: "./commands/staff/test-account.js", exportName: "registerTestAccountCommand" },
+    // Marketplace moderation: queue / approve / reject over /v1/moderation.
+    { type: "registrar", root: "staff", parent: "staff", module: "./commands/staff/listings.js", exportName: "registerListingsCommand" },
 ];
 async function executePlan(program, steps) {
     const parents = new Map([["program", program]]);

package/dist/commands/_patterns.d.ts

@@ -7,6 +7,23 @@ export declare const EMAIL_PATTERN: RegExp;
  * grantee slot on the wire.
  */
 export declare const OUTPOST_UID_PATTERN: RegExp;
+/**
+ * A fleet agent uid: `agt_` plus a 26-character Crockford ULID, upper-case,
+ * the same shape as OUTPOST_UID_PATTERN. A typo (wrong length, lower-case,
+ * or a letter outside the Crockford alphabet: I, L, O, U) fails locally.
+ */
+export declare const AGENT_UID_PATTERN: RegExp;
+/**
+ * The machine email a fleet agent signs in with:
+ * `agt-<ulid>@agents.getindigo.ai`, lower-cased. The CLI sends this email as
+ * the grantee; hq-pro canonicalizes it onto the agent's `agt_…` principal
+ * when the agent is an active member of the company.
+ */
+export declare function agentMachineEmail(agentUid: string): string;
+/** Matches a fleet agent machine email; group 1 is the lower-case ULID. */
+export declare const AGENT_MACHINE_EMAIL_PATTERN: RegExp;
+/** The `agt_…` uid behind a machine email, or null when it is not one. */
+export declare function agentUidFromMachineEmail(email: string): string | null;
 /**
  * Keep an ACL pattern exactly as the caller supplied it.
  *

package/dist/commands/_patterns.js

@@ -7,6 +7,28 @@ export const EMAIL_PATTERN = /^[^\s]+@[^\s]+$/;
  * grantee slot on the wire.
  */
 export const OUTPOST_UID_PATTERN = /^out_[0-9A-HJKMNP-TV-Z]{26}$/;
+/**
+ * A fleet agent uid: `agt_` plus a 26-character Crockford ULID, upper-case,
+ * the same shape as OUTPOST_UID_PATTERN. A typo (wrong length, lower-case,
+ * or a letter outside the Crockford alphabet: I, L, O, U) fails locally.
+ */
+export const AGENT_UID_PATTERN = /^agt_[0-9A-HJKMNP-TV-Z]{26}$/;
+/**
+ * The machine email a fleet agent signs in with:
+ * `agt-<ulid>@agents.getindigo.ai`, lower-cased. The CLI sends this email as
+ * the grantee; hq-pro canonicalizes it onto the agent's `agt_…` principal
+ * when the agent is an active member of the company.
+ */
+export function agentMachineEmail(agentUid) {
+    return `agt-${agentUid.slice(4).toLowerCase()}@agents.getindigo.ai`;
+}
+/** Matches a fleet agent machine email; group 1 is the lower-case ULID. */
+export const AGENT_MACHINE_EMAIL_PATTERN = /^agt-([0-9a-hjkmnp-tv-z]{26})@agents\.getindigo\.ai$/i;
+/** The `agt_…` uid behind a machine email, or null when it is not one. */
+export function agentUidFromMachineEmail(email) {
+    const m = AGENT_MACHINE_EMAIL_PATTERN.exec(email.trim());
+    return m ? `agt_${m[1].toUpperCase()}` : null;
+}
 /**
  * Keep an ACL pattern exactly as the caller supplied it.
  *

package/dist/commands/access.d.ts

@@ -15,6 +15,7 @@
  */
 import { Command } from "commander";
 import { type CompanyBrowseClientFactory, type FilesBrowseVaultClient, type RunGetResult } from "./files-browse.js";
+import { type AclLock } from "./acl-lock.js";
 export type AccessOutcome = "never-existed" | "local" | "not-synced" | "no-access" | "ambiguous" | "pending-confirmation";
 export interface AccessAclTree {
     prefix: string;
@@ -145,6 +146,11 @@ export interface RunAccessResult {
     requestSentAt?: string;
     alreadyAskedAt?: string;
     requestNote?: string;
+    /**
+     * Most-specific ACL row covering the path when it has no grants. Broader
+     * grants (including a root `*` company-wide grant) do not apply.
+     */
+    lockedBy?: AclLock;
 }
 export interface AccessAsResult {
     personUid: string;

package/dist/commands/access.js

@@ -23,6 +23,7 @@ import { getCompanyUid, vaultApiFetch, resolveCallerUid } from "../utils/vault-a
 import { parseCompanySlugFromPath, classifyAclSource, resolveBrowseSession, makeCompanyPresignFactory, runGet, toBucketRelative, } from "./files-browse.js";
 import { listJournals, syncDoctor, } from "@indigoai-us/hq-cloud";
 import { listActiveMembers } from "./members.js";
+import { aclLockedBy } from "./acl-lock.js";
 import { buildDmBody } from "./dm.js";
 import { peekIdToken } from "../utils/id-token.js";
 import { findRecentAccessRequest, formatTimeAgo, recordAccessRequest, } from "../utils/access-requests.js";
@@ -458,10 +459,23 @@ async function completeTarget(input, deps, located) {
     const { resolvedKey, directory, vendDenied, listDenied, verdict, steps } = located;
     const resolvedPath = `companies/${slug}/${resolvedKey}`;
     let noAccess = vendDenied || listDenied;
+    // Name the empty fencing row only when the tree denies access. A role
+    // bypass or creator grant still reads the same as the acl/resolve fast
+    // path, which never fetches the tree.
+    const lockRow = verdict.kind === "tree" && aclDenied(verdict.tree) ? aclLockedBy(verdict.tree) : null;
+    const lockedBy = lockRow
+        ? { ...lockRow, path: `companies/${slug}/${toBucketRelative(lockRow.path, slug)}` }
+        : undefined;
+    if (lockedBy) {
+        steps.push(lockedBy.readUnknown
+            ? `acl: locked by ${lockedBy.path} unless that row is open (it has no grants; broader grants such as * apply only if it is open)`
+            : `acl: locked by ${lockedBy.path} (that row has no grants and is not open; broader grants such as * do not apply)`);
+    }
     if (verdict.kind === "resolved") {
         steps.push(`acl: ${verdict.permission}`);
     }
-    else if (verdict.tree == null || treeIsEmpty(verdict.tree)) {
+    else if (verdict.tree == null ||
+        (treeIsEmpty(verdict.tree) && !verdict.tree.coveringAclPath)) {
         steps.push("acl: no record (membership-distributed)");
     }
     else if (aclDenied(verdict.tree)) {
@@ -687,6 +701,7 @@ async function completeTarget(input, deps, located) {
         ...(requestSentAt ? { requestSentAt } : {}),
         ...(alreadyAskedAt ? { alreadyAskedAt } : {}),
         ...(requestNote ? { requestNote } : {}),
+        ...(lockedBy ? { lockedBy } : {}),
     }, finishCtx);
     return result;
 }
@@ -834,6 +849,8 @@ function jsonPayload(result) {
         payload.requestSentAt = result.requestSentAt;
     if (result.alreadyAskedAt)
         payload.alreadyAskedAt = result.alreadyAskedAt;
+    if (result.lockedBy)
+        payload.lockedBy = result.lockedBy;
     return payload;
 }
 function emit(input, result, log) {

package/dist/commands/acl-lock.d.ts

@@ -0,0 +1,41 @@
+/**
+ * Empty-row lock detection for ACL tree responses (feedback dd287b55).
+ *
+ * The server resolves a path against its most-specific matching FILE_ACL row
+ * (`coveringAclPath` on the ACL tree response). Enforcement (files-presign,
+ * files-list, content) runs resolveEffectivePermission in hq-pro-core
+ * src/tenant-contracts/acl-permission.ts with `unionGrants: true`: grants on
+ * every matching row are unioned, except that an EMPTY, NON-OPEN winning row
+ * fences the path and grants nothing (only the row's creator and the
+ * owner/admin role bypass keep access). An OPEN empty winning row is not a
+ * fence: it floors every member at read and broader grants still apply.
+ */
+export interface AclLockTree {
+    prefix: string;
+    direct: unknown[];
+    inherited: Array<{
+        sourcePrefix: string;
+    }>;
+    directRow: {
+        open: boolean;
+    } | null;
+    coveringAclPath?: string | null;
+}
+export interface AclLock {
+    /** Path of the empty most-specific row. */
+    path: string;
+    /**
+     * True when the row's `open` flag is unknown. The tree reports `open` only
+     * for the exact prefix row (directRow), not for ancestor rows. Such a row is
+     * a lock if it is not open; if it is open, broader grants still apply.
+     */
+    readUnknown: boolean;
+}
+/**
+ * The empty, non-open row that fences `tree.prefix`, or null when the
+ * most-specific row grants something, is open, or no row covers the path.
+ */
+export declare function aclLockedBy(tree: AclLockTree | null | undefined): AclLock | null;
+/** One-line description of the lock for human output. */
+export declare function describeAclLock(lock: AclLock, display: string): string;
+//# sourceMappingURL=acl-lock.d.ts.map

package/dist/commands/acl-lock.js

@@ -0,0 +1,28 @@
+/**
+ * The empty, non-open row that fences `tree.prefix`, or null when the
+ * most-specific row grants something, is open, or no row covers the path.
+ */
+export function aclLockedBy(tree) {
+    const covering = tree?.coveringAclPath;
+    if (!tree || typeof covering !== "string" || covering === "")
+        return null;
+    if (covering === tree.prefix) {
+        if (!tree.directRow || tree.directRow.open === true)
+            return null;
+        if (!Array.isArray(tree.direct) || tree.direct.length > 0)
+            return null;
+        return { path: covering, readUnknown: false };
+    }
+    const inherited = Array.isArray(tree.inherited) ? tree.inherited : [];
+    if (inherited.some((entry) => entry.sourcePrefix === covering))
+        return null;
+    return { path: covering, readUnknown: true };
+}
+/** One-line description of the lock for human output. */
+export function describeAclLock(lock, display) {
+    if (lock.readUnknown) {
+        return `Locked by ${display} unless that row is open: it has no grants, so grants on broader prefixes apply only if it is open.`;
+    }
+    return `Locked by ${display}: that ACL row has no grants and is not open, so grants on broader prefixes do not apply. Only the row's creator and the owner/admin role bypass have access.`;
+}
+//# sourceMappingURL=acl-lock.js.map

package/dist/commands/agent-enroll.d.ts

@@ -60,6 +60,8 @@ export declare function mapEnrollFailure(status: number, body: {
     attemptsRemaining?: unknown;
     upgradeUrl?: unknown;
     pricingPlan?: unknown;
+    usagePause?: unknown;
+    billingState?: unknown;
 }, headers?: {
     retryAfter?: string | null;
 }): EnrollError;

package/dist/commands/agent-enroll.js

@@ -21,7 +21,7 @@ import * as path from "node:path";
 import { CLI_VERSION } from "../cli-version.js";
 import { DEFAULT_VAULT_API_URL, personTokenCacheFile, } from "../utils/cognito-session.js";
 import { HQ_CLIENT_NAME } from "../utils/vault-api.js";
-import { isUsageOnly, pricingPlanFromBody, usageOnlyCardRequiredLines, } from "../lib/billing/usage-only.js";
+import { isUsageOnly, pricingPlanFromBody, usageOnlyCardRequiredLines, usagePauseFromBody, } from "../lib/billing/usage-only.js";
 import { queueCliLimitNoticeEngagement, queueCliLimitNoticeExposure, } from "../utils/cli-telemetry.js";
 import { networkTransportErrorCode } from "../utils/network-transport-error.js";
 import { canOfferTeamUpgrade, formatUpgradeRefusal, isPlanGateError, offerUpgradeLink, planGateErrorFromPayload, } from "../utils/plan-gate-error.js";
@@ -139,6 +139,11 @@ export function mapEnrollFailure(status, body, headers) {
         return new EnrollError(`This agent was revoked; its enrollment code no longer works. An admin must ` +
             `create a new external agent or rotate this one.${suffix}`, status, code);
     }
+    // US-024: a usage pause is the server's own answer: its message and link.
+    const usagePause = status === 402 ? usagePauseFromBody(body) : null;
+    if (usagePause) {
+        return new EnrollError(usagePause.message, status, code, usagePause.actionUrl);
+    }
     if ((status === 402 || code === "billing_required") &&
         isUsageOnly(pricingPlanFromBody(body))) {
         // Usage pricing (US-012): no paid plan to upgrade to. A company admin adds
@@ -146,8 +151,8 @@ export function mapEnrollFailure(status, body, headers) {
         return new EnrollError(usageOnlyCardRequiredLines("An external agent").join(" ") + suffix, status, code);
     }
     if (status === 402 || code === "billing_required") {
-        return new EnrollError(`External agents are available on paid HQ plans only. A company admin must ` +
-            `upgrade the plan (\`hq billing\` or the console billing page) before enrolling.${suffix}`, status, code, typeof body.upgradeUrl === "string" ? body.upgradeUrl : undefined);
+        return new EnrollError(`External agents need billing set up for this company. A company admin can ` +
+            `add a card with \`hq billing checkout\` or on the console Billing page, then enroll again.${suffix}`, status, code, typeof body.upgradeUrl === "string" ? body.upgradeUrl : undefined);
     }
     if (status === 429 || code === "rate_limited") {
         const retryAfter = headers?.retryAfter?.trim();
@@ -425,7 +430,7 @@ export function registerAgentEnrollCommand(agent) {
                     }
                     catch (openErr) {
                         const message = openErr instanceof Error ? openErr.message : String(openErr);
-                        console.error(chalk.dim(`Could not open the upgrade link automatically: ${message}`));
+                        console.error(chalk.dim(`Could not open the billing link automatically: ${message}`));
                     }
                 }
             }

package/dist/commands/agent-kit.js

@@ -17,6 +17,7 @@
  * output in ~/.hq-agent/logs/kit.log). Logs: ~/.hq-agent/logs/<service>.log. Skills:
  * ~/.hq-agent/skills/<name>/SKILL.md.
  */
+import { createWakeSecretResolver } from "../lib/agent-kit/wake-secrets.js";
 import chalk from "chalk";
 import * as fs from "node:fs";
 import * as os from "node:os";
@@ -37,7 +38,7 @@ import { serviceLogPath } from "../lib/agent-kit/paths.js";
 import { runResidentCommandWithPackageLease } from "../utils/resident-package-preload.js";
 import { spawn } from "node:child_process";
 import { pendingInbox } from "../lib/agent-kit/inbox-state.js";
-import { buildWakeNotice, clearWakeConfig, currentWakeState, DEFAULT_WAKE_RETRY_MS, describeWake, fireWake, readWakeConfig, validateWakeUrl, writeWakeConfig, } from "../lib/agent-kit/wake.js";
+import { parseHeaderSecrets, buildWakeNotice, clearWakeConfig, currentWakeState, DEFAULT_WAKE_RETRY_MS, describeWake, fireWake, readWakeConfig, validateWakeUrl, writeWakeConfig, } from "../lib/agent-kit/wake.js";
 import { runSyncLoop } from "../lib/agent-kit/run/sync.js";
 import { resolveHqBinary, resolveNodeBinary, } from "../lib/mesh/live/daemon/install.js";
 import { installServices, servicesStatus, uninstallServices, } from "../lib/service-manager/index.js";
@@ -380,6 +381,7 @@ export function registerAgentKitCommand(agent) {
         .description("POST a notice to a webhook URL (e.g. a Grok Bot routine webhook) when mail is pending. Prefer --stdin so the URL stays out of shell history")
         .option("--stdin", "Read the URL from stdin")
         .option("--retry-minutes <n>", "Re-wake while items stay pending (default 10, minimum 1)")
+        .option("--header-secret <Header=SECRET>", "Send a header using a stored company secret (repeatable; value resolved at wake time)", (value, previous) => [...previous, value], [])
         .action(async (url, opts) => {
         try {
             const paths = agentKitPaths(os.homedir(), process.env);
@@ -393,7 +395,8 @@ export function registerAgentKitCommand(agent) {
             }
             if (!raw)
                 throw new Error("Provide the URL as an argument or with --stdin");
-            const config = { kind: "url", url: validateWakeUrl(raw), retryMs: retryMsFrom(opts.retryMinutes) };
+            const headerSecrets = parseHeaderSecrets(opts.headerSecret);
+            const config = { kind: "url", url: validateWakeUrl(raw), retryMs: retryMsFrom(opts.retryMinutes), ...(Object.keys(headerSecrets).length ? { headerSecrets } : {}) };
             writeWakeConfig(paths, config);
             console.log(chalk.green(`Wake set: ${describeWake(config)}`));
             console.log("Test it: hq agent kit wake test");
@@ -450,15 +453,14 @@ export function registerAgentKitCommand(agent) {
         .description("Fire the wake once now with the current pending count")
         .action(async () => {
         try {
-            const paths = agentKitPaths(os.homedir(), process.env);
-            const creds = requireExternalCreds(paths);
-            ensureKitDirs(paths);
+            const runtime = buildKitRuntime("inbox");
+            const { paths, creds } = runtime;
             const config = readWakeConfig(paths);
             if (!config)
                 throw new Error("No wake configured. Run hq agent kit wake set-url --stdin (or set-command).");
             const log = createKitLogger(paths, "wake", { echo: false });
             const ids = pendingInbox(paths).map((e) => e.id);
-            const result = await fireWake(config, buildWakeNotice(creds.entityUid, "test", ids, new Date()), { paths, agentUid: creds.entityUid, log });
+            const result = await fireWake(config, buildWakeNotice(creds.entityUid, "test", ids, new Date()), { paths, agentUid: creds.entityUid, log, resolveHeaderSecrets: createWakeSecretResolver(creds.companySlug, runtime.getToken, creds.apiBaseUrl) });
             console.log(result.ok ? chalk.green(result.detail) : chalk.red(result.detail));
             if (!result.ok)
                 process.exit(1);

package/dist/commands/agents.js

@@ -131,12 +131,6 @@ export function agentCreatePlanLimitFromPayload(status, body) {
             : {}),
     };
 }
-function formatServerPrice(amountMinor, currency) {
-    return new Intl.NumberFormat("en-US", {
-        style: "currency",
-        currency,
-    }).format(amountMinor / 100);
-}
 async function offerAgentCheckout(url) {
     const rl = readline.createInterface({ input: process.stdin, output: process.stderr });
     try {
@@ -146,7 +140,7 @@ async function offerAgentCheckout(url) {
         });
     }
     catch {
-        console.error("Could not open the upgrade page automatically. Use the URL above.");
+        console.error("Could not open the billing page automatically. Use the URL above.");
         return false;
     }
     finally {
@@ -156,7 +150,7 @@ async function offerAgentCheckout(url) {
 /** Print a server-priced plan block without minting or rewriting its URL. */
 export async function surfaceAgentCreatePlanLimit(planLimit, opts = {}) {
     if (isUsageOnly(opts.pricingPlan)) {
-        // Usage pricing (US-012): no Workforce plan to buy. The company adds a
+        // Usage pricing (US-012): no flat plan to buy. The company adds a
         // card and each agent box bills by size from the usage card.
         const card = opts.usageCard ?? BUNDLED_USAGE_CARD;
         for (const line of usageOnlyCardRequiredLines("An agent box", card)) {
@@ -166,13 +160,13 @@ export async function surfaceAgentCreatePlanLimit(planLimit, opts = {}) {
         queueCliLimitNoticeExposure("agents", "refusal", opts.companyUid);
         return;
     }
-    const price = `${formatServerPrice(planLimit.amountMinor, planLimit.currency)}/month`;
-    const reason = `HQ Workforce plan required to create an agent (${price}).`;
+    // The server's price was the flat plan's, which is closed: name no plan or price.
+    const reason = "Agents are not included on this company's current billing.";
     const argv = opts.json ? [...process.argv, "--json"] : process.argv;
     const interactive = canOfferTeamUpgrade(argv);
     if (!planLimit.checkoutUrl) {
         console.error(reason);
-        console.error("Ask a company owner to upgrade before creating an agent.");
+        console.error("Ask a company owner to check the company's Billing page before creating an agent.");
         queueCliLimitNoticeExposure("agents", "refusal", opts.companyUid);
         return;
     }

package/dist/commands/billing-sponsor.d.ts

@@ -2,9 +2,9 @@
  * `hq billing sponsor` — the individual-pull half of plan sponsorship, from the
  * terminal ("ask a company to sponsor me", hq-pro #3609).
  *
- * A person who is over a personal limit has exactly three ways out: pay $50
- * themselves, reduce what they store, or ask a company to cover the $50 plan
- * line. This command is the third one, plus the admin side that answers it.
+ * A person who is over a personal limit has exactly three ways out: pay for
+ * the personal plan themselves, reduce what they store, or ask a company to
+ * cover it. This command is the third one, plus the admin side that answers it.
  *
  *   hq billing sponsor request <company>   — ask that company to cover my plan
  *   hq billing sponsor list                — the queue (admins), or my own
@@ -36,7 +36,7 @@ export declare const PLAN_RESOURCE: "plan";
 /** What a person is told when hq-pro's plan-sponsorship switch is off. */
 export declare const FEATURE_OFF_MESSAGE = "Asking a company to sponsor your plan isn't available yet.";
 /** What v1 sponsorship covers, stated wherever a person confirms or reads it. */
-export declare const COVERAGE_SENTENCE = "Your company pays your $50 plan. Storage above your plan's allowance is still yours.";
+export declare const COVERAGE_SENTENCE = "Your company pays your personal plan. Storage above your plan's allowance is still yours.";
 /** What a person is told while an approval waits on the sponsor's card. */
 export declare const HELD_FOR_CARD_SENTENCE = "Your company said yes and is adding a card. Your limits still apply until then.";
 /** One request row as hq-pro persists and returns it. */

package/dist/commands/billing-sponsor.js

@@ -2,9 +2,9 @@
  * `hq billing sponsor` — the individual-pull half of plan sponsorship, from the
  * terminal ("ask a company to sponsor me", hq-pro #3609).
  *
- * A person who is over a personal limit has exactly three ways out: pay $50
- * themselves, reduce what they store, or ask a company to cover the $50 plan
- * line. This command is the third one, plus the admin side that answers it.
+ * A person who is over a personal limit has exactly three ways out: pay for
+ * the personal plan themselves, reduce what they store, or ask a company to
+ * cover it. This command is the third one, plus the admin side that answers it.
  *
  *   hq billing sponsor request <company>   — ask that company to cover my plan
  *   hq billing sponsor list                — the queue (admins), or my own
@@ -41,7 +41,7 @@ export const PLAN_RESOURCE = "plan";
 /** What a person is told when hq-pro's plan-sponsorship switch is off. */
 export const FEATURE_OFF_MESSAGE = "Asking a company to sponsor your plan isn't available yet.";
 /** What v1 sponsorship covers, stated wherever a person confirms or reads it. */
-export const COVERAGE_SENTENCE = "Your company pays your $50 plan. Storage above your plan's allowance is still yours.";
+export const COVERAGE_SENTENCE = "Your company pays your personal plan. Storage above your plan's allowance is still yours.";
 /** What a person is told while an approval waits on the sponsor's card. */
 export const HELD_FOR_CARD_SENTENCE = "Your company said yes and is adding a card. Your limits still apply until then.";
 /**
@@ -85,7 +85,7 @@ export function messageForError(status, body) {
     if (status === 401)
         return "Your sign-in has expired. Run `hq login` and try again.";
     if (status === 403 && code === "SPONSOR_PLAN_REQUIRED") {
-        return "That company's plan can't cover an individual plan. Only HQ Workforce and Enterprise companies can.";
+        return "That company can't cover a personal plan on its current billing. Ask an owner of that company to check its Billing page.";
     }
     if (status === 403) {
         return "You're not allowed to do that. Only an owner or admin of the company can answer a sponsorship request.";
@@ -209,7 +209,7 @@ export function registerBillingSponsorCommands(billing) {
                 process.stdout.write(JSON.stringify(data.request, null, 2) + "\n");
                 return;
             }
-            console.log(`Asked ${company} to cover your $50 HQ plan.`);
+            console.log(`Asked ${company} to cover your personal HQ plan.`);
             console.log(COVERAGE_SENTENCE);
             console.log(`An owner or admin there answers next. Check with \`hq billing sponsor list\`.`);
         }
@@ -276,11 +276,11 @@ export function registerBillingSponsorCommands(billing) {
                 }
                 const where = named ?? "that company";
                 if (!state.active) {
-                    console.log(`No company is covering your $50 HQ plan right now.`);
+                    console.log(`No company is covering your personal HQ plan right now.`);
                     console.log(`If you asked ${where}, they haven't answered yet — an owner or admin there answers next.`);
                     return;
                 }
-                console.log(`Your $50 HQ plan: ${statusLabel(state.status ?? "active")}`);
+                console.log(`Your personal HQ plan: ${statusLabel(state.status ?? "active")}`);
                 if (state.requestId)
                     console.log(`  ${chalk.bold(state.requestId)}`);
                 console.log(COVERAGE_SENTENCE);
@@ -328,7 +328,7 @@ export function registerBillingSponsorCommands(billing) {
             }
             console.log((await companyIsUsageOnly(result.companyUid))
                 ? "Approved. Their personal plan is now on the company bill."
-                : "Approved. Their $50 plan is now on the company bill.");
+                : "Approved. Their personal plan is now on the company bill.");
         }
         catch (err) {
             fail(err);
@@ -370,7 +370,7 @@ export function registerBillingSponsorCommands(billing) {
             }
             console.log((await companyIsUsageOnly(result.companyUid))
                 ? "Ended. Their personal plan goes back to them from the next bill."
-                : "Ended. Their $50 plan goes back to them from the next bill.");
+                : "Ended. Their personal plan goes back to them from the next bill.");
         }
         catch (err) {
             fail(err);
@@ -396,7 +396,7 @@ export function registerBillingSponsorCommands(billing) {
                 console.log(usageOnlySponsorLines()[2]);
                 return;
             }
-            console.log("Withdrawn. You can pay the $50 yourself, reduce what you store, or ask another company.");
+            console.log("Withdrawn. You can pay for your plan yourself, reduce what you store, or ask another company.");
         }
         catch (err) {
             fail(err);

package/dist/commands/billing-usage.d.ts

@@ -12,18 +12,18 @@
  *
  * Tenant boundary: the company comes from the caller's own active memberships
  * (`/membership/me`); a slug outside them is refused before any read. The
- * usage-limits routes are member-gated on the server as well. With no cloud
+ * company statement is owner-gated on the server as well. With no cloud
  * company (or `--personal`) it reads the caller's personal scope.
  *
- * Usage numbers come through `readMonthUsage` (src/lib/billing/usage-cost.ts),
- * the single seam to switch to the US-005 daily rollup once it has a read route.
+ * Usage numbers come through `readMonthUsage` (src/lib/billing/usage-cost.ts)
+ * from the usage statement, `GET /v1/billing/usage` (hq-pro US-006). Only a
+ * server without that route (404) falls back to the usage-limits readings.
  *
  * Only an account on usage pricing gets costs. The plan comes from the
- * server: `pricingPlan` / `usageOnly` on the usage-limits body (hq-pro #5042,
- * computed with `isOnUsagePricing`). Only when that body does not say, the
- * billing summary the command already reads for the trial. A flat-plan account (for example a Workforce
- * company that subscribed before the 2026-10-16 cutover) and an account the
- * server says nothing about get readings only, with no rate, cost or
+ * server's shared plan status (`billingState`, hq-pro #5088) on the billing
+ * summary, with the legacy `pricingPlan` / `usageOnly` fields for a server
+ * that does not send it. An account on an earlier flat plan and an account
+ * the server says nothing about get readings only, with no rate, cost or
  * projected bill.
  */
 import type { Command } from "commander";
@@ -34,8 +34,19 @@ export interface MembershipRef {
     slug: string;
     role?: string;
 }
+/** One `GET /v1/billing/usage` answer: the HTTP status and the decoded body. */
+export interface UsageStatementResponse {
+    status: number;
+    body: unknown | null;
+}
 export interface BillingUsageDeps {
     listCompanies(): Promise<MembershipRef[]>;
+    /**
+     * `GET /v1/billing/usage` for the scope (US-015). Absent, or a 404 from a
+     * server without the route, falls back to {@link fetchUsageLimits}.
+     */
+    fetchUsageStatement?: (scope: UsageScope) => Promise<UsageStatementResponse>;
+    /** Legacy readings for a server without the statement route. */
     fetchUsageLimits: ReadMonthUsageDeps["fetchUsageLimits"];
     readStorageSplit?: (company: MembershipRef, opts: {
         fresh: boolean;
@@ -77,6 +88,9 @@ export declare function pricingPlanFromSummary(body: unknown): PricingPlan | nul
  * only when usage-limits does not say.
  */
 export declare function resolveOnUsagePricing(limitsPlan: PricingPlan | null, summaryPlan: PricingPlan | null): boolean | null;
+/** Thrown when the company statement is refused to a caller who is not its owner. */
+export declare class UsageStatementForbiddenError extends Error {
+}
 export declare function runBillingUsage(opts: BillingUsageOptions, deps: BillingUsageDeps): Promise<BillingUsageReport>;
 /**
  * `hq billing usage --card`: the card from GET /v1/pricing, or the bundled