@indigoai-us/hq-cli 5.312.2-beta.0 → 5.314.0

package/dist/lib/work-context/config.d.ts

@@ -1,25 +1,14 @@
 /**
  * Device-local default company preference (~/.hq/work-context/config.json).
  * Preference only — never authority. activeCompany is never treated as default.
+ * Default-company mode ships dark until migrationCapability (US-017A).
  */
-import * as fs from "node:fs";
-import { type WindowsAclCheckOptions } from "./windows-acl.js";
-declare const DEVICE_CONFIG_SCHEMA_VERSION: 1;
+import { WORK_CONTEXT_CONTRACT_VERSION } from "./contract.js";
+export declare const DEVICE_CONFIG_SCHEMA_VERSION: 1;
 export interface DeviceDefaultCompany {
     slug: string;
     uid?: string;
     enabled: boolean;
-    /** Whether this device chose the value or safely inferred its only membership. */
-    source?: "auto_single" | "chosen" | "disabled";
-}
-export interface DefaultCompanyMembership {
-    slug: string;
-    uid: string;
-}
-/** Cached active memberships. This avoids a network lookup for each hook. */
-export interface DefaultCompanyMembershipSnapshot {
-    checkedAt: string;
-    memberships: DefaultCompanyMembership[];
 }
 /** Last probe of GET /v1/work-mesh/capabilities across memberships (US-017B). */
 export interface MigrationCapabilitySnapshot {
@@ -43,21 +32,15 @@ export interface RepoCompanyMapping {
     uid?: string;
     updatedAt: string;
 }
-type RepoCompanyMap = Record<string, RepoCompanyMapping>;
+export type RepoCompanyMap = Record<string, RepoCompanyMapping>;
 export interface WorkContextDeviceConfig {
     schemaVersion: typeof DEVICE_CONFIG_SCHEMA_VERSION;
     /** Explicit device default. Never copied from activeCompany. */
     defaultCompany?: DeviceDefaultCompany | null;
-    /** Marks a null default written by the automatic-activation implementation. */
-    defaultCompanyAutomaticEligible?: true;
     /** Last-known migration capability across memberships (doctor reports this). */
     migrationCapability?: MigrationCapabilitySnapshot | null;
     /** Per-repo company map (gap 4). Remembers each repo's filed-under company. */
     repoCompanyMap?: RepoCompanyMap | null;
-    /** Membership cache used to activate an unconfigured device default. */
-    defaultCompanyMemberships?: DefaultCompanyMembershipSnapshot | null;
-    /** Historical held-session repair stays opt-in because a default is weak evidence. */
-    repairHeldWithDefault?: boolean;
     updatedAt: string;
 }
 /** true / { uid } = member; false = not a member. */
@@ -76,34 +59,11 @@ export interface DeviceConfigDeps {
     validateMembership?: (slug: string) => Promise<MembershipValidationResult> | MembershipValidationResult;
     now?: () => Date;
 }
-/** Acquire an interprocess config lock; exported for direct lock regression tests. */
-export declare function acquireDeviceConfigLock(root: string, options?: {
-    timeoutMs?: number;
-    staleMs?: number;
-}): () => void;
-/** Injection points for assertSafeConfigPath (tests only). */
-export interface SafeConfigPathIo {
-    platform?: NodeJS.Platform;
-    existsSync?: (p: string) => boolean;
-    lstatSync?: (p: string) => Pick<fs.Stats, "mode" | "isSymbolicLink">;
-    windowsAcl?: WindowsAclCheckOptions;
-}
-/**
- * Refuse a config path that is a symlink (every platform) or writable by
- * anyone other than the owner.
- *
- * - POSIX (darwin/linux/...): `mode & 0o022` must be clear. Unchanged.
- * - win32: NTFS has no POSIX mode bits; Node reports 0666 for every regular
- *   file, so the mode test would reject every config (US-018). We read the
- *   real DACL instead (see windows-acl.ts). Unreadable DACL → documented
- *   reduced-guarantee path: one diagnostic line, no throw.
- */
-export declare function assertSafeConfigPath(configPath: string, io?: SafeConfigPathIo): void;
 export declare function readDeviceConfig(deps: Pick<DeviceConfigDeps, "root">): WorkContextDeviceConfig;
 export declare function getDefaultCompany(deps: Pick<DeviceConfigDeps, "root">): DeviceDefaultCompany | null;
-/** A clear is a durable opt-out, not an invitation for automatic reactivation. */
-export declare function isDefaultCompanyDisabled(deps: Pick<DeviceConfigDeps, "root">): boolean;
-export declare function setDefaultCompany(slug: string, deps: DeviceConfigDeps): Promise<WorkContextDeviceConfig>;
+export declare function setDefaultCompany(slug: string, deps: DeviceConfigDeps & {
+    allowWithoutMigration?: boolean;
+}): Promise<WorkContextDeviceConfig>;
 export declare function clearDefaultCompany(deps: DeviceConfigDeps): WorkContextDeviceConfig;
 /**
  * Read the persisted company mapping for a repo identity key (gap 4).
@@ -120,15 +80,8 @@ export declare function setRepoCompany(key: string, mapping: {
 }, deps: Pick<DeviceConfigDeps, "root" | "now">): WorkContextDeviceConfig;
 /** Persist the last memberships-wide migration capability probe (US-017B). */
 export declare function recordMigrationCapabilitySnapshot(snapshot: MigrationCapabilitySnapshot, deps: Pick<DeviceConfigDeps, "root" | "now">): WorkContextDeviceConfig;
-export declare function recordDefaultCompanyMemberships(snapshot: DefaultCompanyMembershipSnapshot, deps: Pick<DeviceConfigDeps, "root" | "now">): WorkContextDeviceConfig;
-/** Drop cached membership evidence immediately after an authoritative denial. */
-export declare function invalidateDefaultCompanyMemberships(deps: Pick<DeviceConfigDeps, "root" | "now">): WorkContextDeviceConfig;
-/** Persist a default only after the complete active-membership list verified it. */
-export declare function setAutoDefaultCompany(membership: DefaultCompanyMembership, deps: Pick<DeviceConfigDeps, "root" | "now"> & {
-    expectedUpdatedAt?: string;
-    /** Test seam: runs after the guarded read while the config lock is held. */
-    afterCompareAndSwap?: () => void;
-}): WorkContextDeviceConfig;
-export declare function setRepairHeldWithDefault(enabled: boolean, deps: Pick<DeviceConfigDeps, "root" | "now">): WorkContextDeviceConfig;
-export {};
+/** Convenience: build deps from HOME / injectable root. */
+export declare function deviceConfigDepsFromHome(home?: string, extras?: Partial<DeviceConfigDeps>): DeviceConfigDeps;
+/** Re-export for callers that stamp contractVersion on related state. */
+export { WORK_CONTEXT_CONTRACT_VERSION };
 //# sourceMappingURL=config.d.ts.map

package/dist/lib/work-context/config.js

@@ -1,122 +1,21 @@
 /**
  * Device-local default company preference (~/.hq/work-context/config.json).
  * Preference only — never authority. activeCompany is never treated as default.
+ * Default-company mode ships dark until migrationCapability (US-017A).
  */
 import * as fs from "node:fs";
 import * as path from "node:path";
 import { atomicWriteJson, ensureOwnerDir, resolveRealTarget } from "./atomic.js";
-import { DefaultCompanyUnavailableError, UnsafeConfigPathError, WorkContextError, } from "./errors.js";
-import { workContextConfigPath } from "./paths.js";
-import { assertWindowsOwnerOnlyAcl } from "./windows-acl.js";
-const DEVICE_CONFIG_SCHEMA_VERSION = 1;
-const CONFIG_LOCK_TIMEOUT_MS = 5_000;
-const CONFIG_LOCK_RETRY_MS = 10;
-function waitForConfigLock(ms) {
-    Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
-}
-function readConfigLockRecord(lockPath) {
-    try {
-        const stat = fs.statSync(lockPath);
-        const raw = JSON.parse(fs.readFileSync(lockPath, "utf8"));
-        const pid = typeof raw.pid === "number" && Number.isInteger(raw.pid) ? raw.pid : 0;
-        const createdAt = typeof raw.createdAt === "string" ? raw.createdAt : "";
-        const token = typeof raw.token === "string" && raw.token ? raw.token : undefined;
-        const parsedAt = Date.parse(createdAt);
-        return {
-            record: pid > 0 && createdAt ? { pid, createdAt, token } : null,
-            ageMs: Date.now() - (Number.isFinite(parsedAt) ? parsedAt : stat.mtimeMs),
-        };
-    }
-    catch {
-        return { record: null, ageMs: Number.POSITIVE_INFINITY };
-    }
-}
-function isProcessAlive(pid) {
-    try {
-        process.kill(pid, 0);
-        return true;
-    }
-    catch {
-        return false;
-    }
-}
-function reclaimStaleConfigLock(lockPath) {
-    const claim = `${lockPath}.reclaim.${process.pid}.${Date.now()}.${Math.random().toString(16).slice(2)}`;
-    try {
-        fs.renameSync(lockPath, claim);
-    }
-    catch (err) {
-        if (err.code === "ENOENT")
-            return false;
-        throw err;
-    }
-    try {
-        return true;
-    }
-    finally {
-        try {
-            fs.unlinkSync(claim);
-        }
-        catch { /* private claim cannot block writers */ }
-    }
-}
-/** Acquire an interprocess config lock; exported for direct lock regression tests. */
-export function acquireDeviceConfigLock(root, options = {}) {
-    ensureOwnerDir(root);
-    const configPath = resolveRealTarget(workContextConfigPath(root));
-    assertSafeConfigPath(configPath);
-    const lockPath = `${configPath}.lock`;
-    const deadline = Date.now() + (options.timeoutMs ?? CONFIG_LOCK_TIMEOUT_MS);
-    const token = `${process.pid}.${Date.now()}.${Math.random().toString(16).slice(2)}`;
-    let fd;
-    while (fd === undefined) {
-        try {
-            fd = fs.openSync(lockPath, "wx", 0o600);
-            fs.writeSync(fd, JSON.stringify({ pid: process.pid, createdAt: new Date().toISOString(), token }));
-        }
-        catch (err) {
-            if (err.code !== "EEXIST")
-                throw err;
-            const { record, ageMs } = readConfigLockRecord(lockPath);
-            // Age alone is not authority to steal a lock: a live writer may simply
-            // be slow. Only a missing/malformed or dead owner can be reclaimed.
-            if (!record || !isProcessAlive(record.pid)) {
-                reclaimStaleConfigLock(lockPath);
-                continue;
-            }
-            if (Date.now() >= deadline) {
-                throw new WorkContextError("ConfigLockTimeout", "Timed out waiting for the work-context config lock");
-            }
-            waitForConfigLock(CONFIG_LOCK_RETRY_MS);
-        }
-    }
-    return () => {
-        fs.closeSync(fd);
-        try {
-            const current = readConfigLockRecord(lockPath).record;
-            if (current?.token === token)
-                fs.unlinkSync(lockPath);
-        }
-        catch { /* stale reclaimer already retired or replaced this lock */ }
-    };
-}
-function withDeviceConfigLock(root, fn) {
-    const release = acquireDeviceConfigLock(root);
-    try {
-        return fn();
-    }
-    finally {
-        release();
-    }
-}
+import { DefaultCompanyLockedError, DefaultCompanyUnavailableError, UnsafeConfigPathError, WorkContextError, } from "./errors.js";
+import { workContextConfigPath, workContextRoot } from "./paths.js";
+import { WORK_CONTEXT_CONTRACT_VERSION } from "./contract.js";
+export const DEVICE_CONFIG_SCHEMA_VERSION = 1;
 function emptyConfig(now) {
     return {
         schemaVersion: DEVICE_CONFIG_SCHEMA_VERSION,
         defaultCompany: null,
         migrationCapability: null,
         repoCompanyMap: null,
-        defaultCompanyMemberships: null,
-        repairHeldWithDefault: false,
         updatedAt: now().toISOString(),
     };
 }
@@ -146,40 +45,20 @@ function sanitizeRepoCompanyMap(raw) {
     }
     return Object.keys(out).length > 0 ? out : null;
 }
-/**
- * Refuse a config path that is a symlink (every platform) or writable by
- * anyone other than the owner.
- *
- * - POSIX (darwin/linux/...): `mode & 0o022` must be clear. Unchanged.
- * - win32: NTFS has no POSIX mode bits; Node reports 0666 for every regular
- *   file, so the mode test would reject every config (US-018). We read the
- *   real DACL instead (see windows-acl.ts). Unreadable DACL → documented
- *   reduced-guarantee path: one diagnostic line, no throw.
- */
-export function assertSafeConfigPath(configPath, io = {}) {
-    const platform = io.platform ?? process.platform;
-    const existsSync = io.existsSync ?? fs.existsSync;
-    const lstatSync = io.lstatSync ?? fs.lstatSync;
+function assertSafeConfigPath(configPath) {
     const dir = path.dirname(configPath);
     try {
-        if (existsSync(dir)) {
-            const lst = lstatSync(dir);
+        if (fs.existsSync(dir)) {
+            const lst = fs.lstatSync(dir);
             if (lst.isSymbolicLink()) {
                 throw new UnsafeConfigPathError(`Config directory is a symlink: ${dir}`);
             }
-            if (platform === "win32") {
-                assertWindowsOwnerOnlyAcl(dir, "directory", io.windowsAcl);
-            }
         }
-        if (existsSync(configPath)) {
-            const lst = lstatSync(configPath);
+        if (fs.existsSync(configPath)) {
+            const lst = fs.lstatSync(configPath);
             if (lst.isSymbolicLink()) {
                 throw new UnsafeConfigPathError(`Config file is a symlink: ${configPath}`);
             }
-            if (platform === "win32") {
-                assertWindowsOwnerOnlyAcl(configPath, "file", io.windowsAcl);
-                return;
-            }
             const mode = lst.mode & 0o777;
             // Warn-level only for world-writable; refuse group/other write bits on read for safety.
             if (mode & 0o022) {
@@ -204,22 +83,11 @@ export function readDeviceConfig(deps) {
             throw new WorkContextError("ConfigCorruptionError", `Unsupported config schemaVersion ${String(raw.schemaVersion)}`);
         }
         // Never treat a stray activeCompany field as the default.
-        // Older `clear` commands persisted `defaultCompany: null`. A config file
-        // is durable user history, so preserving a null as "unconfigured" would
-        // re-enable automatic selection after an upgrade. Treat every persisted
-        // legacy null as the explicit opt-out tombstone instead.
-        const legacyNullDefault = Object.prototype.hasOwnProperty.call(raw, "defaultCompany") &&
-            raw.defaultCompany === null &&
-            raw.defaultCompanyAutomaticEligible !== true;
         const cleaned = {
             schemaVersion: DEVICE_CONFIG_SCHEMA_VERSION,
-            defaultCompany: legacyNullDefault
-                ? { slug: "", enabled: false, source: "disabled" }
-                : raw.defaultCompany ?? null,
+            defaultCompany: raw.defaultCompany ?? null,
             migrationCapability: raw.migrationCapability ?? null,
             repoCompanyMap: sanitizeRepoCompanyMap(raw.repoCompanyMap),
-            defaultCompanyMemberships: sanitizeMembershipSnapshot(raw.defaultCompanyMemberships),
-            repairHeldWithDefault: raw.repairHeldWithDefault === true,
             updatedAt: typeof raw.updatedAt === "string" ? raw.updatedAt : new Date(0).toISOString(),
         };
         return cleaned;
@@ -234,12 +102,7 @@ function writeDeviceConfig(deps, config) {
     ensureOwnerDir(deps.root);
     const configPath = resolveRealTarget(workContextConfigPath(deps.root));
     assertSafeConfigPath(configPath);
-    // New blank configuration is intentionally distinct from the legacy null
-    // that the previous `clear` command wrote. Preserve that distinction on
-    // disk so a membership-cache write cannot turn into a durable opt-out.
-    atomicWriteJson(configPath, config.defaultCompany === null
-        ? { ...config, defaultCompanyAutomaticEligible: true }
-        : config);
+    atomicWriteJson(configPath, config);
 }
 export function getDefaultCompany(deps) {
     const cfg = readDeviceConfig(deps);
@@ -248,16 +111,14 @@ export function getDefaultCompany(deps) {
         return null;
     return d;
 }
-/** A clear is a durable opt-out, not an invitation for automatic reactivation. */
-export function isDefaultCompanyDisabled(deps) {
-    const configured = readDeviceConfig(deps).defaultCompany;
-    return configured?.source === "disabled";
-}
 export async function setDefaultCompany(slug, deps) {
     const trimmed = slug.trim();
     if (!trimmed || !/^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(trimmed)) {
         throw new WorkContextError("InvalidCompanySlug", `Invalid company slug: ${slug}`);
     }
+    if (!deps.migrationCapability && !deps.allowWithoutMigration) {
+        throw new DefaultCompanyLockedError();
+    }
     if (!deps.validateMembership) {
         throw new DefaultCompanyUnavailableError(`Cannot verify membership for company "${trimmed}" (no membership validator)`);
     }
@@ -278,44 +139,35 @@ export async function setDefaultCompany(slug, deps) {
         resolvedUid = result.uid.trim() || undefined;
     }
     const now = deps.now ?? (() => new Date());
-    return withDeviceConfigLock(deps.root, () => {
-        const prior = readDeviceConfig(deps);
-        const defaultCompany = {
-            slug: trimmed,
-            enabled: true,
-            source: "chosen",
-        };
-        if (resolvedUid)
-            defaultCompany.uid = resolvedUid;
-        const next = {
-            schemaVersion: DEVICE_CONFIG_SCHEMA_VERSION,
-            defaultCompany,
-            migrationCapability: prior.migrationCapability ?? null,
-            repoCompanyMap: prior.repoCompanyMap ?? null,
-            defaultCompanyMemberships: prior.defaultCompanyMemberships ?? null,
-            repairHeldWithDefault: prior.repairHeldWithDefault === true,
-            updatedAt: now().toISOString(),
-        };
-        writeDeviceConfig(deps, next);
-        return next;
-    });
+    const prior = readDeviceConfig(deps);
+    const defaultCompany = {
+        slug: trimmed,
+        enabled: true,
+    };
+    if (resolvedUid)
+        defaultCompany.uid = resolvedUid;
+    const next = {
+        schemaVersion: DEVICE_CONFIG_SCHEMA_VERSION,
+        defaultCompany,
+        migrationCapability: prior.migrationCapability ?? null,
+        repoCompanyMap: prior.repoCompanyMap ?? null,
+        updatedAt: now().toISOString(),
+    };
+    writeDeviceConfig(deps, next);
+    return next;
 }
 export function clearDefaultCompany(deps) {
     const now = deps.now ?? (() => new Date());
-    return withDeviceConfigLock(deps.root, () => {
-        const prior = readDeviceConfig(deps);
-        const next = {
-            schemaVersion: DEVICE_CONFIG_SCHEMA_VERSION,
-            defaultCompany: { slug: "", enabled: false, source: "disabled" },
-            migrationCapability: prior.migrationCapability ?? null,
-            repoCompanyMap: prior.repoCompanyMap ?? null,
-            defaultCompanyMemberships: prior.defaultCompanyMemberships ?? null,
-            repairHeldWithDefault: prior.repairHeldWithDefault === true,
-            updatedAt: now().toISOString(),
-        };
-        writeDeviceConfig(deps, next);
-        return next;
-    });
+    const prior = readDeviceConfig(deps);
+    const next = {
+        schemaVersion: DEVICE_CONFIG_SCHEMA_VERSION,
+        defaultCompany: null,
+        migrationCapability: prior.migrationCapability ?? null,
+        repoCompanyMap: prior.repoCompanyMap ?? null,
+        updatedAt: now().toISOString(),
+    };
+    writeDeviceConfig(deps, next);
+    return next;
 }
 /**
  * Read the persisted company mapping for a repo identity key (gap 4).
@@ -345,154 +197,51 @@ export function setRepoCompany(key, mapping, deps) {
         throw new WorkContextError("InvalidCompanySlug", `Invalid company slug: ${mapping.slug}`);
     }
     const now = deps.now ?? (() => new Date());
-    return withDeviceConfigLock(deps.root, () => {
-        const prior = readDeviceConfig({ root: deps.root });
-        const entry = { slug, updatedAt: now().toISOString() };
-        const uid = mapping.uid?.trim();
-        if (uid)
-            entry.uid = uid;
-        const nextMap = { ...(prior.repoCompanyMap ?? {}), [trimmed]: entry };
-        const next = {
-            schemaVersion: DEVICE_CONFIG_SCHEMA_VERSION,
-            defaultCompany: prior.defaultCompany ?? null,
-            migrationCapability: prior.migrationCapability ?? null,
-            repoCompanyMap: nextMap,
-            defaultCompanyMemberships: prior.defaultCompanyMemberships ?? null,
-            repairHeldWithDefault: prior.repairHeldWithDefault === true,
-            updatedAt: now().toISOString(),
-        };
-        writeDeviceConfig({ root: deps.root }, next);
-        return next;
-    });
+    const prior = readDeviceConfig({ root: deps.root });
+    const entry = { slug, updatedAt: now().toISOString() };
+    const uid = mapping.uid?.trim();
+    if (uid)
+        entry.uid = uid;
+    const nextMap = { ...(prior.repoCompanyMap ?? {}), [trimmed]: entry };
+    const next = {
+        schemaVersion: DEVICE_CONFIG_SCHEMA_VERSION,
+        defaultCompany: prior.defaultCompany ?? null,
+        migrationCapability: prior.migrationCapability ?? null,
+        repoCompanyMap: nextMap,
+        updatedAt: now().toISOString(),
+    };
+    writeDeviceConfig({ root: deps.root }, next);
+    return next;
 }
 /** Persist the last memberships-wide migration capability probe (US-017B). */
 export function recordMigrationCapabilitySnapshot(snapshot, deps) {
-    return withDeviceConfigLock(deps.root, () => {
-        const prior = readDeviceConfig(deps);
-        const now = deps.now ?? (() => new Date());
-        const next = {
-            schemaVersion: DEVICE_CONFIG_SCHEMA_VERSION,
-            defaultCompany: prior.defaultCompany ?? null,
-            migrationCapability: {
-                unlocked: snapshot.unlocked,
-                offline: snapshot.offline,
-                checkedAt: snapshot.checkedAt,
-                companies: snapshot.companies.map((c) => ({
-                    companyUid: c.companyUid,
-                    migration: c.migration,
-                })),
-            },
-            repoCompanyMap: prior.repoCompanyMap ?? null,
-            defaultCompanyMemberships: prior.defaultCompanyMemberships ?? null,
-            repairHeldWithDefault: prior.repairHeldWithDefault === true,
-            updatedAt: now().toISOString(),
-        };
-        writeDeviceConfig({ root: deps.root }, next);
-        return next;
-    });
-}
-function sanitizeMembershipSnapshot(raw) {
-    if (!raw || typeof raw !== "object" || Array.isArray(raw))
-        return null;
-    const value = raw;
-    if (typeof value.checkedAt !== "string" || !Array.isArray(value.memberships))
-        return null;
-    const memberships = value.memberships.flatMap((entry) => {
-        if (!entry || typeof entry !== "object" || Array.isArray(entry))
-            return [];
-        const member = entry;
-        const slug = typeof member.slug === "string" ? member.slug.trim() : "";
-        const uid = typeof member.uid === "string" ? member.uid.trim() : "";
-        return slug && uid ? [{ slug, uid }] : [];
-    });
-    return { checkedAt: value.checkedAt, memberships };
-}
-export function recordDefaultCompanyMemberships(snapshot, deps) {
-    return withDeviceConfigLock(deps.root, () => {
-        const prior = readDeviceConfig(deps);
-        const now = deps.now ?? (() => new Date());
-        const next = {
-            schemaVersion: DEVICE_CONFIG_SCHEMA_VERSION,
-            defaultCompany: prior.defaultCompany ?? null,
-            migrationCapability: prior.migrationCapability ?? null,
-            repoCompanyMap: prior.repoCompanyMap ?? null,
-            defaultCompanyMemberships: {
-                checkedAt: snapshot.checkedAt,
-                memberships: snapshot.memberships.map((membership) => ({ ...membership })),
-            },
-            repairHeldWithDefault: prior.repairHeldWithDefault === true,
-            updatedAt: now().toISOString(),
-        };
-        writeDeviceConfig({ root: deps.root }, next);
-        return next;
-    });
-}
-/** Drop cached membership evidence immediately after an authoritative denial. */
-export function invalidateDefaultCompanyMemberships(deps) {
-    return withDeviceConfigLock(deps.root, () => {
-        const prior = readDeviceConfig(deps);
-        const now = deps.now ?? (() => new Date());
-        const next = {
-            schemaVersion: DEVICE_CONFIG_SCHEMA_VERSION,
-            defaultCompany: prior.defaultCompany ?? null,
-            migrationCapability: prior.migrationCapability ?? null,
-            repoCompanyMap: prior.repoCompanyMap ?? null,
-            defaultCompanyMemberships: null,
-            repairHeldWithDefault: prior.repairHeldWithDefault === true,
-            updatedAt: now().toISOString(),
-        };
-        writeDeviceConfig({ root: deps.root }, next);
-        return next;
-    });
-}
-/** Persist a default only after the complete active-membership list verified it. */
-export function setAutoDefaultCompany(membership, deps) {
-    return withDeviceConfigLock(deps.root, () => {
-        const prior = readDeviceConfig(deps);
-        // Activation may have fetched memberships while another process cleared or
-        // changed this preference. Do not let that stale discovery overwrite the
-        // newer durable choice.
-        if (prior.defaultCompany?.source === "disabled" ||
-            prior.defaultCompany?.enabled ||
-            (deps.expectedUpdatedAt !== undefined &&
-                prior.updatedAt !== deps.expectedUpdatedAt)) {
-            return prior;
-        }
-        deps.afterCompareAndSwap?.();
-        const now = deps.now ?? (() => new Date());
-        const next = {
-            schemaVersion: DEVICE_CONFIG_SCHEMA_VERSION,
-            defaultCompany: {
-                slug: membership.slug,
-                uid: membership.uid,
-                enabled: true,
-                source: "auto_single",
-            },
-            migrationCapability: prior.migrationCapability ?? null,
-            repoCompanyMap: prior.repoCompanyMap ?? null,
-            defaultCompanyMemberships: prior.defaultCompanyMemberships ?? null,
-            repairHeldWithDefault: prior.repairHeldWithDefault === true,
-            updatedAt: now().toISOString(),
-        };
-        writeDeviceConfig({ root: deps.root }, next);
-        return next;
-    });
+    const prior = readDeviceConfig(deps);
+    const now = deps.now ?? (() => new Date());
+    const next = {
+        schemaVersion: DEVICE_CONFIG_SCHEMA_VERSION,
+        defaultCompany: prior.defaultCompany ?? null,
+        migrationCapability: {
+            unlocked: snapshot.unlocked,
+            offline: snapshot.offline,
+            checkedAt: snapshot.checkedAt,
+            companies: snapshot.companies.map((c) => ({
+                companyUid: c.companyUid,
+                migration: c.migration,
+            })),
+        },
+        repoCompanyMap: prior.repoCompanyMap ?? null,
+        updatedAt: now().toISOString(),
+    };
+    writeDeviceConfig({ root: deps.root }, next);
+    return next;
 }
-export function setRepairHeldWithDefault(enabled, deps) {
-    return withDeviceConfigLock(deps.root, () => {
-        const prior = readDeviceConfig(deps);
-        const now = deps.now ?? (() => new Date());
-        const next = {
-            schemaVersion: DEVICE_CONFIG_SCHEMA_VERSION,
-            defaultCompany: prior.defaultCompany ?? null,
-            migrationCapability: prior.migrationCapability ?? null,
-            repoCompanyMap: prior.repoCompanyMap ?? null,
-            defaultCompanyMemberships: prior.defaultCompanyMemberships ?? null,
-            repairHeldWithDefault: enabled,
-            updatedAt: now().toISOString(),
-        };
-        writeDeviceConfig({ root: deps.root }, next);
-        return next;
-    });
+/** Convenience: build deps from HOME / injectable root. */
+export function deviceConfigDepsFromHome(home, extras = {}) {
+    return {
+        root: extras.root ?? workContextRoot(home),
+        ...extras,
+    };
 }
+/** Re-export for callers that stamp contractVersion on related state. */
+export { WORK_CONTEXT_CONTRACT_VERSION };
 //# sourceMappingURL=config.js.map

package/dist/lib/work-context/contract.d.ts

@@ -54,21 +54,11 @@ export interface ContextResult {
     lifecycle: LifecycleState;
     sessionId: string;
     companyUid?: string;
-    /** Resolved company slug; paired with companyUid for local hook consumers. */
-    companySlug?: string;
     projectId?: string;
     taskId?: string;
     bindingEpisodeId?: string;
     clientOperationId: string;
     errorCode?: string;
-    /** Why a project was chosen, or why the session is asking. Local consumers only. */
-    projectBindReason?: string;
-    /** Ranked alternatives when classification is needs_project. */
-    projectCandidates?: Array<{
-        projectId: string;
-        title?: string;
-        score?: number;
-    }>;
 }
 export type NormalizeTaskIdResult = {
     ok: true;

package/dist/lib/work-context/index.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Work Context reconciliation package (consumable by hq-cli).
+ * Contract (US-001) + reconcile / outbox / device default (US-007A)
+ * + organize / project resolution (US-007B)
+ * + cross-company correct / migrate (US-017B).
+ */
+export * from "./contract.js";
+export * from "./errors.js";
+export * from "./paths.js";
+export * from "./atomic.js";
+export * from "./config.js";
+export * from "./state.js";
+export * from "./outbox.js";
+export * from "./company.js";
+export * from "./project.js";
+export { decisionFromCandidates, digestOrganizePayload, formatOrganizeList, prepareOrganizeDecision, settleOrganizeAskWithoutBind, stableDecisionId, stableOrganizeOperationId, submitOrganizeDecision, } from "./organize.js";
+export type { CandidatesResponse, FetchCandidatesFn, OrganizeCandidate, OrganizeListResult, OrganizeReceipt, OrganizeSubmitDecision, OrganizeSubmitResult, PostOrganizeFn, } from "./organize.js";
+export { digestMigratePayload, formatMigrateConfirmation, stableMigrateOperationId, submitSessionMigration, } from "./migrate.js";
+export type { MigrateDestination, MigrateReceipt, MigrateSubmitResult, PostMigrateFn, } from "./migrate.js";
+export { deriveRemoteOwnerSlug, deriveRepoIdentityKey, findWorkTreeRoot, matchCompanySlugForRepo, normalizeRemoteOwnerName, } from "./repo-remote.js";
+export { matchMembershipAnswer, promptRepoCompany, } from "./repo-prompt.js";
+export type { RepoPromptCompany, RepoPromptDeps, RepoPromptOutcome, RepoPromptSkipReason, } from "./repo-prompt.js";
+export { loadObservationFromFile, markUntracked, parseObservationJson, reconcileObservation, } from "./reconcile.js";
+export type { ReconcileDeps, ReconcileObservation, ReconcileOutcome, } from "./reconcile.js";
+//# sourceMappingURL=index.d.ts.map