@indigoai-us/hq-cli 5.119.8 → 5.119.10

package/dist/commands/skill.js

@@ -3,6 +3,11 @@
  *
  * `hq skill create <slug>` registers a canonical company skill, stamps its
  * immutable UID, surfaces its generated runtime wrapper, and syncs it.
+ * `hq skill register <slug>` reserves that UID from a proposal-lane source and
+ * writes server-stamped bytes only to `--stamped-output` — never under
+ * `companies/<company>/skills/`, and never as a discovery wrapper or sync.
+ * `hq skill promote <slug>` copies independently-cleared stamped bytes into the
+ * canonical tree only after the expected SHA-256 and registered skill_uid match.
  * `hq skill propose <uid|path> --message "…"` posts a whole-skill comment to
  * the same improvement thread shown in HQ Console. It never uploads a modified
  * SKILL.md and cannot overwrite live content. `hq skill delete <target>` removes
@@ -11,6 +16,7 @@
  */
 import * as fs from "node:fs";
 import * as path from "node:path";
+import { createHash, timingSafeEqual } from "node:crypto";
 import chalk from "chalk";
 import yaml from "js-yaml";
 import { share } from "@indigoai-us/hq-cloud";
@@ -25,6 +31,7 @@ export const SKILL_UID_PATTERN = /^skl_[A-Za-z0-9]+$/;
 export const SKILL_SLUG_PATTERN = /^[a-z0-9][a-z0-9-]*$/;
 const COMPANY_SLUG_PATTERN = /^[a-z0-9][a-z0-9-]*$/;
 const FRONTMATTER_RE = /^---\r?\n([\s\S]*?)\r?\n---(?:\r?\n|$)/;
+const SHA256_HEX_PATTERN = /^[0-9a-f]{64}$/;
 async function defaultSyncFile(input) {
     const result = await share({
         paths: [input.filePath],
@@ -185,11 +192,19 @@ export function writeSkillFileAtomically(filePath, content) {
         : 0o644;
     const tempPath = path.join(dir, `.SKILL.md.${process.pid}.${Date.now()}.tmp`);
     try {
-        fs.writeFileSync(tempPath, content, {
-            encoding: "utf8",
-            flag: "wx",
-            mode: existingMode,
-        });
+        if (typeof content === "string") {
+            fs.writeFileSync(tempPath, content, {
+                encoding: "utf8",
+                flag: "wx",
+                mode: existingMode,
+            });
+        }
+        else {
+            fs.writeFileSync(tempPath, content, {
+                flag: "wx",
+                mode: existingMode,
+            });
+        }
         fs.renameSync(tempPath, filePath);
     }
     finally {
@@ -197,6 +212,69 @@ export function writeSkillFileAtomically(filePath, content) {
             fs.rmSync(tempPath, { force: true });
     }
 }
+export function sha256Hex(data) {
+    return createHash("sha256").update(data).digest("hex");
+}
+export function skillVaultPath(skillSlug) {
+    return `skills/${skillSlug}/SKILL.md`;
+}
+export function isInsideCompanySkillsTree(hqRoot, candidatePath) {
+    const companiesRoot = path.resolve(hqRoot, "companies");
+    const resolved = path.resolve(candidatePath);
+    const rel = path.relative(companiesRoot, resolved);
+    if (rel === "" || rel.startsWith("..") || path.isAbsolute(rel))
+        return false;
+    const parts = rel.split(path.sep);
+    return parts.length >= 2 && parts[1] === "skills";
+}
+export function resolveSkillMarkdownPath(target, cwd) {
+    let filePath = path.resolve(cwd, target);
+    if (fs.existsSync(filePath) && fs.statSync(filePath).isDirectory()) {
+        filePath = path.join(filePath, "SKILL.md");
+    }
+    return filePath;
+}
+export function assertStagedOutputPath(hqRoot, outputPath) {
+    const resolved = path.resolve(outputPath);
+    if (isInsideCompanySkillsTree(hqRoot, resolved)) {
+        throw localSkillError(`Stamped output '${resolved}' is inside companies/<company>/skills/. Pass a proposal-lane path outside the canonical skill tree.`);
+    }
+    return resolved;
+}
+export function assertSha256HexMatch(actualHex, expectedHex) {
+    const want = expectedHex.trim().toLowerCase();
+    if (!SHA256_HEX_PATTERN.test(want)) {
+        throw localSkillError("--expected-sha256 must be a 64-character hex SHA-256 digest.");
+    }
+    const got = actualHex.trim().toLowerCase();
+    if (!SHA256_HEX_PATTERN.test(got)) {
+        throw localSkillError(`Stamped file SHA-256 ${got} does not match --expected-sha256. Canonical skill was not written.`);
+    }
+    if (!timingSafeEqual(Buffer.from(got, "hex"), Buffer.from(want, "hex"))) {
+        throw localSkillError(`Stamped file SHA-256 ${got} does not match --expected-sha256. Canonical skill was not written.`);
+    }
+}
+export function assertRegisteredSkillResponse(registered) {
+    if (typeof registered.skillUid !== "string" ||
+        !SKILL_UID_PATTERN.test(registered.skillUid) ||
+        typeof registered.content !== "string" ||
+        parseSkillUid(registered.content) !== registered.skillUid) {
+        throw new Error("The server returned an invalid skill registration response; the local file was not changed.");
+    }
+    return { skillUid: registered.skillUid, content: registered.content };
+}
+function skillRecordPath(record) {
+    for (const value of [record?.vaultPath, record?.sourcePath, record?.path]) {
+        if (typeof value === "string" && value.length > 0)
+            return value;
+    }
+    return undefined;
+}
+export function normalizeLiveSkillVaultPath(rawPath) {
+    const normalized = rawPath.replace(/\\/g, "/").replace(/^\/+/, "").replace(/\/+$/, "");
+    const match = normalized.match(/(?:^|\/)skills\/([a-z0-9][a-z0-9-]*)(?:\/SKILL\.md)?$/);
+    return match ? skillVaultPath(match[1]) : normalized;
+}
 export function mapSkillError(status, body) {
     const server = (typeof body.error === "string" && body.error) ||
         (typeof body.message === "string" && body.message) ||
@@ -360,7 +438,7 @@ export function registerSkillCommand(program, deps = {}) {
     const resolveCompanyUid = deps.resolveCompanyUid ?? getCompanyUid;
     const skill = program
         .command("skill")
-        .description("Create company skills and discuss improvements")
+        .description("Create, stage, promote, and discuss company skills")
         .option("--company <slug>", "Company slug (defaults to the active company)")
         .option("--hq-root <path>", "Local HQ root", hqRoot);
     skill
@@ -420,7 +498,7 @@ export function registerSkillCommand(program, deps = {}) {
             path: `/v1/files/skills/company/${encodeURIComponent(companySlug)}/register`,
             method: "POST",
             body: {
-                path: `skills/${slug}/SKILL.md`,
+                path: skillVaultPath(slug),
                 content: localContent,
             },
         });
@@ -430,13 +508,8 @@ export function registerSkillCommand(program, deps = {}) {
                 machineIdentity: isMachineIdentity(),
             });
         }
-        const registered = (await response.json());
-        if (typeof registered.skillUid !== "string" ||
-            !SKILL_UID_PATTERN.test(registered.skillUid) ||
-            typeof registered.content !== "string" ||
-            parseSkillUid(registered.content) !== registered.skillUid) {
-            throw new Error("The server returned an invalid skill registration response; the local file was not changed.");
-        }
+        const payload = (await response.json());
+        const registered = assertRegisteredSkillResponse(payload);
         writeSkillFileAtomically(filePath, registered.content);
         let discoveryStatus = null;
         try {
@@ -506,11 +579,173 @@ export function registerSkillCommand(program, deps = {}) {
         console.log(chalk.green(`Skill ready: ${registered.skillUid}`));
         console.log(`  File:     ${filePath}`);
         console.log(`  Discovery: ${discoveryStatus === 0 ? "ready" : "needs attention"}`);
-        console.log(registered.accessPolicy === "open"
+        console.log(payload.accessPolicy === "open"
             ? `  Access:   Open — every active ${companySlug} member can edit`
             : "  Access:   preserved existing policy");
         console.log(`  Sync:     ${opts.sync === false ? "not requested" : "complete"}`);
     });
+    skill
+        .command("register <slug>")
+        .description("Register a company skill to a proposal-lane stamped file without writing the canonical tree")
+        .requiredOption("--source <path>", "Caller-authored SKILL.md (or its directory) to send to the server validator")
+        .requiredOption("--stamped-output <path>", "Write the complete server-stamped bytes here, outside companies/<company>/skills/")
+        .option("--no-canonical-write", "Refuse to write companies/<company>/skills/ (always the register behavior)")
+        .option("--no-surface", "Do not create a discovery wrapper (always the register behavior)")
+        .option("--no-sync", "Do not upload the skill file (always the register behavior)")
+        .action(async (slug, opts) => {
+        if (!SKILL_SLUG_PATTERN.test(slug)) {
+            throw localSkillError("Skill slug must start with a lowercase letter or number and contain only lowercase letters, numbers, and hyphens.");
+        }
+        const parentOpts = skill.opts();
+        const resolvedRoot = path.resolve(parentOpts.hqRoot ?? hqRoot);
+        const companySlug = resolveCompanySlug(parentOpts.company, resolvedRoot);
+        canonicalCompanySkillPath(resolvedRoot, companySlug, slug);
+        const sourcePath = resolveSkillMarkdownPath(opts.source, cwd());
+        if (!fs.existsSync(sourcePath) || !fs.statSync(sourcePath).isFile()) {
+            throw localSkillError(`No SKILL.md found at '${opts.source}'. Pass --source <file> or a directory that contains SKILL.md.`);
+        }
+        const stampedOutputPath = assertStagedOutputPath(resolvedRoot, path.resolve(cwd(), opts.stampedOutput));
+        const localContent = fs.readFileSync(sourcePath, "utf8");
+        const sourceHash = sha256Hex(localContent);
+        const token = await ensureToken();
+        const response = await apiFetch({
+            token,
+            path: `/v1/files/skills/company/${encodeURIComponent(companySlug)}/register`,
+            method: "POST",
+            body: {
+                path: skillVaultPath(slug),
+                content: localContent,
+            },
+        });
+        if (!response.ok) {
+            const body = (await response.json().catch(() => ({})));
+            throw skillApiError(response.status, body, {
+                machineIdentity: isMachineIdentity(),
+            });
+        }
+        const registered = assertRegisteredSkillResponse((await response.json()));
+        writeSkillFileAtomically(stampedOutputPath, registered.content);
+        const stampedHash = sha256Hex(registered.content);
+        console.log(chalk.green(`Skill registered (staged): ${registered.skillUid}`));
+        console.log(`  Source:          ${sourcePath}`);
+        console.log(`  Source SHA-256:  ${sourceHash}`);
+        console.log(`  Stamped output:  ${stampedOutputPath}`);
+        console.log(`  Stamped SHA-256: ${stampedHash}`);
+        console.log("  Canonical write: not requested");
+        console.log("  Discovery:       not requested");
+        console.log("  Sync:            not requested");
+    });
+    skill
+        .command("promote <slug>")
+        .description("Copy independently-cleared stamped bytes into the canonical skill path after SHA-256 and skill_uid checks")
+        .requiredOption("--from <path>", "Independently-cleared stamped SKILL.md (or its directory)")
+        .requiredOption("--expected-sha256 <hex>", "SHA-256 of the exact stamped file bytes that were cleared")
+        .option("--reviewed-update", "Replace an existing canonical SKILL.md whose bytes differ from the stamped file")
+        .option("--no-sync", "Promote locally without uploading the canonical file")
+        .action(async (slug, opts) => {
+        if (!SKILL_SLUG_PATTERN.test(slug)) {
+            throw localSkillError("Skill slug must start with a lowercase letter or number and contain only lowercase letters, numbers, and hyphens.");
+        }
+        const parentOpts = skill.opts();
+        const resolvedRoot = path.resolve(parentOpts.hqRoot ?? hqRoot);
+        const companySlug = resolveCompanySlug(parentOpts.company, resolvedRoot);
+        const canonicalPath = canonicalCompanySkillPath(resolvedRoot, companySlug, slug);
+        const fromPath = resolveSkillMarkdownPath(opts.from, cwd());
+        if (!fs.existsSync(fromPath) || !fs.statSync(fromPath).isFile()) {
+            throw localSkillError(`No stamped SKILL.md found at '${opts.from}'. Pass --from <file> or a directory that contains SKILL.md.`);
+        }
+        const stampedBytes = fs.readFileSync(fromPath);
+        assertSha256HexMatch(sha256Hex(stampedBytes), opts.expectedSha256);
+        const stampedContent = stampedBytes.toString("utf8");
+        const skillUid = parseSkillUid(stampedContent);
+        if (!skillUid) {
+            throw localSkillError(`The stamped SKILL.md at '${fromPath}' has no registered skill_uid. Canonical skill was not written.`);
+        }
+        const token = await ensureToken();
+        const companyUid = await resolveCompanyUid(token, companySlug);
+        const detail = await apiFetch({
+            token,
+            path: `/v1/skills/${encodeURIComponent(companyUid)}/${encodeURIComponent(skillUid)}`,
+            method: "GET",
+        });
+        if (!detail.ok) {
+            const body = (await detail.json().catch(() => ({})));
+            throw skillApiError(detail.status, body, {
+                machineIdentity: isMachineIdentity(),
+            });
+        }
+        const { skill: record } = (await detail.json());
+        if (typeof record?.skillUid === "string" &&
+            record.skillUid !== skillUid) {
+            throw localSkillError(`Stamped skill_uid ${skillUid} does not match the server registration. Canonical skill was not written.`);
+        }
+        const recordPath = skillRecordPath(record);
+        if (recordPath &&
+            normalizeLiveSkillVaultPath(recordPath) !== skillVaultPath(slug)) {
+            throw localSkillError(`Stamped skill_uid ${skillUid} is registered at '${recordPath}', not '${skillVaultPath(slug)}'. Canonical skill was not written.`);
+        }
+        if (fs.existsSync(canonicalPath) && !fs.statSync(canonicalPath).isFile()) {
+            throw localSkillError(`Expected a SKILL.md file at '${canonicalPath}'.`);
+        }
+        const existing = fs.existsSync(canonicalPath)
+            ? fs.readFileSync(canonicalPath)
+            : null;
+        if (existing && !existing.equals(stampedBytes)) {
+            if (opts.reviewedUpdate !== true) {
+                throw localSkillError(`Canonical skill '${canonicalPath}' already exists and differs from the stamped file. Re-run with --reviewed-update after that exact change is cleared.`);
+            }
+        }
+        if (!existing || !existing.equals(stampedBytes)) {
+            writeSkillFileAtomically(canonicalPath, stampedBytes);
+        }
+        const legacyPrefix = readCompanyPrefix(resolvedRoot, companySlug);
+        let discoveryStatus = null;
+        try {
+            discoveryStatus = surfaceSkillFn({
+                hqRoot: resolvedRoot,
+                companySlug,
+                skillSlug: slug,
+                ...(legacyPrefix ? { legacyPrefix } : {}),
+            }).status;
+        }
+        catch (err) {
+            console.warn(chalk.yellow(`⚠ Skill promoted, but local discovery failed: ${err instanceof Error ? err.message : String(err)}`));
+        }
+        if (discoveryStatus !== null && discoveryStatus !== 0) {
+            console.warn(chalk.yellow(`⚠ Skill promoted, but local discovery exited ${discoveryStatus}. Run 'hq skill --company ${companySlug} create ${slug} --surface-only' to retry without another registration request.`));
+        }
+        if (opts.sync !== false) {
+            let syncResult;
+            try {
+                syncResult = await syncFile({
+                    filePath: canonicalPath,
+                    companySlug,
+                    hqRoot: resolvedRoot,
+                    token,
+                });
+            }
+            catch (err) {
+                console.warn(chalk.yellow(`⚠ Skill ${skillUid} is stamped locally at '${canonicalPath}', but sync failed.`));
+                if (err && typeof err === "object") {
+                    const diagnostics = vaultAccessDeniedDiagnostics(err, {
+                        companySlug,
+                        objectKey: skillVaultPath(slug),
+                    });
+                    if (diagnostics)
+                        stampVaultAccessDenied(err, diagnostics);
+                }
+                throw err;
+            }
+            if (syncResult.aborted) {
+                throw localSkillError(`Skill ${skillUid} is stamped locally at '${canonicalPath}', but sync aborted because the remote file conflicts.`);
+            }
+        }
+        console.log(chalk.green(`Skill promoted: ${skillUid}`));
+        console.log(`  File:     ${canonicalPath}`);
+        console.log(`  SHA-256:  ${sha256Hex(stampedBytes)}`);
+        console.log(`  Discovery: ${discoveryStatus === 0 ? "ready" : "needs attention"}`);
+        console.log(`  Sync:     ${opts.sync === false ? "not requested" : "complete"}`);
+    });
     skill
         .command("propose <target>")
         .description("Post a comment-only improvement for a skill")

package/dist/commands/whoami.d.ts

@@ -21,9 +21,9 @@ export interface WhoamiDisplayIdentity {
  */
 export declare function resolveWhoamiIdentity(identity: WhoamiTokenIdentity): WhoamiDisplayIdentity;
 /**
- * Human rendering of the plan state: the full WORKSPACE LOCKED block when the
- * workspace is locked, the one-line `Plan: Starter — …` orientation when it is
- * Starter and healthy, and nothing at all otherwise.
+ * Human rendering of the plan state: the full over-limit block when the
+ * workspace is over its Starter limits, the one-line `Plan: Starter — …`
+ * orientation when it is Starter and healthy, and nothing at all otherwise.
  */
 export declare function renderWhoamiPlanBlock(status: PlanLockStatus): string | null;
 export declare function registerWhoamiCommand(program: Command): void;

package/dist/commands/whoami.js

@@ -5,7 +5,7 @@ import chalk from 'chalk';
 import { loadCachedTokens, isExpiring, loadMachineCreds, } from '@indigoai-us/hq-cloud';
 import { peekIdToken as decodeIdToken } from "../utils/id-token.js";
 import { ensureCognitoToken, loadMachineCachedTokens, resolveCognitoTokenSource, } from "../utils/cognito-session.js";
-import { colorizePlanLockNotice, fetchPlanLockStatus, renderPlanLine, renderPlanLockNotice, } from "../lib/billing/plan-lock.js";
+import { colorizePlanLimitNotice, fetchPlanLockStatus, renderPlanLine, renderPlanLimitNotice, } from "../lib/billing/plan-lock.js";
 /**
  * Resolves the person represented by an ID token without pairing a delegated
  * email with the token subject of the delegating machine.
@@ -69,13 +69,13 @@ async function readPlanLock(company) {
     }
 }
 /**
- * Human rendering of the plan state: the full WORKSPACE LOCKED block when the
- * workspace is locked, the one-line `Plan: Starter — …` orientation when it is
- * Starter and healthy, and nothing at all otherwise.
+ * Human rendering of the plan state: the full over-limit block when the
+ * workspace is over its Starter limits, the one-line `Plan: Starter — …`
+ * orientation when it is Starter and healthy, and nothing at all otherwise.
  */
 export function renderWhoamiPlanBlock(status) {
     if (status.lock.locked) {
-        return colorizePlanLockNotice(renderPlanLockNotice(status));
+        return colorizePlanLimitNotice(renderPlanLimitNotice(status));
     }
     return renderPlanLine(status);
 }

package/dist/lib/agent-kit/inbox-state.d.ts

@@ -21,15 +21,35 @@ export declare function markInboxDone(paths: Pick<AgentKitPaths, "inboxDir">, id
 /** Every mirrored entry, oldest first, de-duplicated by id (last write wins). */
 export declare function readMirroredInbox(paths: Pick<AgentKitPaths, "inboxDir">): MirroredInboxEntry[];
 export declare function pendingInbox(paths: Pick<AgentKitPaths, "inboxDir">): MirroredInboxEntry[];
-/** Compact view for bots: who, when, which channel, and the text. */
+/** One file reference carried on an inbox item (US-007 chat attachments). */
+export interface InboxAttachment {
+    vaultPath: string;
+    name?: string;
+    contentType?: string;
+    sizeBytes?: number;
+    companyUid?: string;
+}
+/**
+ * The file references on an inbox entry, plural `attachments[]` first and the
+ * legacy singular `attachment` as a fallback. Entries without a `vaultPath` are
+ * dropped: a reference the bot cannot fetch is worse than none. Pure.
+ */
+export declare function inboxEntryAttachments(e: MirroredInboxEntry): InboxAttachment[];
+/**
+ * Compact view for bots: who, when, which channel, the text, and any attached
+ * files. The attachments belong here because this summary IS the message as far
+ * as a bot is concerned — omitting them made an agent answer "no image came
+ * through" for a DM that carried a screenshot.
+ */
 export declare function summarizeInboxEntry(e: MirroredInboxEntry, done: boolean): {
+    done: boolean;
+    attachments?: InboxAttachment[] | undefined;
     id: string;
     channel: string | undefined;
     from: string;
     fromUid: string | undefined;
     at: string | undefined;
     text: string | undefined;
-    done: boolean;
 };
 /**
  * The agent's inbox as the bot should see it: the kit's local mirror merged

package/dist/lib/agent-kit/inbox-state.js

@@ -65,7 +65,44 @@ export function pendingInbox(paths) {
     const done = readDoneIds(paths);
     return readMirroredInbox(paths).filter((e) => !done.has(e.id));
 }
-/** Compact view for bots: who, when, which channel, and the text. */
+/**
+ * The file references on an inbox entry, plural `attachments[]` first and the
+ * legacy singular `attachment` as a fallback. Entries without a `vaultPath` are
+ * dropped: a reference the bot cannot fetch is worse than none. Pure.
+ */
+export function inboxEntryAttachments(e) {
+    const raw = Array.isArray(e.attachments)
+        ? e.attachments
+        : e.attachment
+            ? [e.attachment]
+            : [];
+    const out = [];
+    for (const entry of raw) {
+        if (!entry || typeof entry !== "object")
+            continue;
+        const rec = entry;
+        const vaultPath = typeof rec.vaultPath === "string" ? rec.vaultPath.trim() : "";
+        if (!vaultPath)
+            continue;
+        const str = (k) => typeof rec[k] === "string" && rec[k].trim()
+            ? rec[k].trim()
+            : undefined;
+        out.push({
+            vaultPath,
+            ...(str("name") ? { name: str("name") } : {}),
+            ...(str("contentType") ? { contentType: str("contentType") } : {}),
+            ...(typeof rec.sizeBytes === "number" ? { sizeBytes: rec.sizeBytes } : {}),
+            ...(str("companyUid") ? { companyUid: str("companyUid") } : {}),
+        });
+    }
+    return out;
+}
+/**
+ * Compact view for bots: who, when, which channel, the text, and any attached
+ * files. The attachments belong here because this summary IS the message as far
+ * as a bot is concerned — omitting them made an agent answer "no image came
+ * through" for a DM that carried a screenshot.
+ */
 export function summarizeInboxEntry(e, done) {
     const pick = (...keys) => {
         for (const k of keys)
@@ -73,6 +110,7 @@ export function summarizeInboxEntry(e, done) {
                 return e[k];
         return undefined;
     };
+    const attachments = inboxEntryAttachments(e);
     return {
         id: e.id,
         channel: pick("channel"),
@@ -80,6 +118,7 @@ export function summarizeInboxEntry(e, done) {
         fromUid: pick("fromPersonUid"),
         at: pick("receivedAt", "createdAt", "mirroredAt"),
         text: pick("text", "body"),
+        ...(attachments.length ? { attachments } : {}),
         done,
     };
 }

package/dist/lib/billing/plan-lock.d.ts

@@ -1,14 +1,19 @@
 /**
- * `plan-lock` (starter-plan-hard-limits / US-011) — the CLI-side read + render
- * of the workspace plan lock.
+ * `plan-lock` (starter-plan-hard-limits / US-011, rewritten for US-036) — the
+ * CLI-side read + render of a workspace's Starter plan-limit state.
  *
- * Starter (free) workspaces are capped on four locking dimensions — members,
- * integrations, secrets and agents (owner decision 7, 2026-09-17; deployments
- * and storage nag but never lock). Going over locks the workspace immediately: it becomes read-only until the owner
- * trims back under the caps or upgrades to HQ Workforce. The lock decision is
- * NOT made here — hq-pro's `src/billing/plan-lock.ts` is the single source of
- * truth and ships the answer on `GET /membership/me` as a per-company
- * `planLock` object. This module only reads that field and renders it.
+ * Starter (free) workspaces are capped on members, integrations, secrets and
+ * agents (deployments and storage nag but never arm a stop). Going over does
+ * NOT stop the workspace working (US-033 owner decision 12): everything that
+ * exists keeps working, and the only two things that pause are adding new
+ * files to the vault and adding new secrets (owner decision 13). Every string
+ * this module renders is a nag, never a claim that HQ has stopped. The state
+ * is NOT decided here — hq-pro is the single source of truth and ships the
+ * answer on `GET /membership/me` as a per-company `planLock` object. This
+ * module only reads that field and renders it.
+ *
+ * Copy rule (US-036): no string a customer reads may contain "locked" or
+ * "read-only". `plan-lock.test.ts` scans every rendered string for both.
  *
  * Member counts are decoration, never a second opinion: the count comes from
  * `GET /v1/billing/usage-limits` on a best-effort basis and its absence only
@@ -18,7 +23,7 @@
  */
 /**
  * Mirror of hq-pro's `PlanLockReason`. Owner decision 7 (2026-09-17) fixes the
- * locking set at these four: `deployments` and `storageBytes` are nag-only and
+ * nagging set at these four: `deployments` and `storageBytes` are nag-only and
  * never appear here. An unrecognised reason is dropped by `parsePlanLock`, so a
  * server that adds a fifth dimension renders as the generic line rather than as
  * a false claim about members.
@@ -106,29 +111,39 @@ export declare function selectMemberUsage(body: unknown): PlanLockMembers | null
 export declare function fetchPlanLockStatus(token: string, companyRef: string, opts?: {
     timeoutMs?: number;
 }): Promise<PlanLockStatus | null>;
-/** Why the workspace locked, one clause per reason. */
+/** Why the workspace is over, one clause per reason. */
 export declare function reasonLabel(reason: PlanLockReason): string;
 /**
- * The full WORKSPACE LOCKED block: why it locked, where the workspace stands
+ * The one sentence every over-limit surface says about the two hard stops
+ * (US-033 §3.3). Written once so the CLI, the console and the emails cannot
+ * drift into three different promises.
+ */
+export declare const HARD_STOP_SENTENCE: string;
+/**
+ * The full over-limit block: why the workspace is over, where it stands
  * against the cap, and the ways out. Plain text — colour is applied by the
  * caller so scripts capturing stdout get a clean block.
  *
- * Every line is derived from `lock.reasons`. A workspace locked on secrets is
+ * Every line is derived from `lock.reasons`. A workspace over on secrets is
  * never told it has too many members, and an empty reason list (a server
  * dimension this CLI does not know) renders a generic line rather than a claim
  * about a dimension nobody measured.
  */
-export declare function renderPlanLockNotice(status: PlanLockStatus): string;
+export declare function renderPlanLimitNotice(status: PlanLockStatus): string;
 /**
- * The one-line form injected on every turn while the workspace stays locked.
+ * The one-line form injected on every turn while the workspace stays over.
  * Kept to a single line on purpose — it repeats each turn.
  */
-export declare function renderPlanLockLine(status: PlanLockStatus): string;
+export declare function renderPlanLimitLine(status: PlanLockStatus): string;
 /**
  * The `Plan: …` orientation line. Starter only: a paid or enterprise
  * workspace — and an UNKNOWN plan — gets no line at all.
  */
 export declare function renderPlanLine(status: PlanLockStatus): string | null;
-/** Colourised block for interactive output. */
-export declare function colorizePlanLockNotice(notice: string): string;
+/**
+ * Colourised block for interactive output. Yellow, not red: this is a nag, and
+ * an error colour would read as "HQ has stopped working", which is the exact
+ * impression US-033 removes.
+ */
+export declare function colorizePlanLimitNotice(notice: string): string;
 //# sourceMappingURL=plan-lock.d.ts.map