@vibe-commit/capture 0.1.0

package/dist/copy/strings.d.ts

@@ -0,0 +1,1328 @@
+/**
+ * The copy catalogue — CR-090 precondition (1).
+ *
+ * EVERY user-facing string in this package lives here. Command bodies contain
+ * NO inline string literals. This is not a style preference: the claims gate can
+ * only check copy it can find, and a literal inside a command body is invisible
+ * to it. The capture client is greenfield exactly once, so this constraint is
+ * free now and a refactor later.
+ *
+ * Commit headers are NOT here — they come from `grades.ts`, which is the single
+ * renderer that takes the grade. Adding a header string to this file would
+ * create the second path that the structural adjacency rule exists to forbid.
+ *
+ * @provenance vibecommit-mcp src/scrubber/index.ts — [REDACTED:<kind>] marker shape, borrowed
+ * @provenance vibecommit-web app/app/commits/page.tsx — route existence, verified
+ * @provenance vibecommit-schema capture_turns column list — MEASURED ABSENCE, cited (CR-086)
+ */
+import { EXIT } from "../exit.js";
+/** `--help` copy. The `why` line is verbatim-approved (D61 §PS6) — do not reword. */
+export declare const HELP: {
+    readonly usage: "vibecommit <command> [options]";
+    readonly tagline: "Record Claude Code sessions against the commits they produced.";
+    readonly commands: {
+        readonly connect: "Connect this repo and capture the current session.";
+        readonly status: "Show whether capture is on for this repo and when it last succeeded.";
+        readonly off: "Stop capturing for this repo.";
+        readonly why: "Show the conversation turns recorded against the commit that last changed this line.";
+        readonly report: "Summarise capture coverage over a time window.";
+    };
+    readonly docsUrl: "https://vibecommit.ai/docs/what-we-upload";
+};
+/**
+ * The ENTRY POINT's own chrome and its two usage failures — `CR-090d`.
+ *
+ * These five strings were inline literals in `src/index.ts` (`:74`, `:76`, `:87`,
+ * `:146`, `:163`) — user-facing, and invisible to the claims gate for six waves
+ * because the gate can only check copy it can find.
+ *
+ * ## Why a separate object rather than three more fields on `HELP`
+ *
+ * `HELP` is the help SCREEN's content — the tagline, the usage line, the per-verb
+ * descriptions, the docs URL — and the claims corpus tags the whole object with
+ * one surface, `help`. Only three of these five render there. `unknownCommand` is
+ * the usage-error path, so folding it into `HELP` would tag a §13.6 error
+ * message as help copy and check it against the wrong surface.
+ *
+ * ⚠ `notImplemented` LIVED HERE AND IS GONE, REMOVED BY `CR-108`. It was what
+ * `why` and `report` printed while unbuilt, and `report` was its last caller —
+ * **every verb in `VERBS` is now implemented**, so the string had no route to a
+ * screen. Copy that cannot be reached is copy no gate can check, and leaving it
+ * would have invited the next reader to wire a sixth verb to it silently. The surface map is only as
+ * honest as the objects it keys on, so the entry point gets its own.
+ *
+ * ⚠ The three labels are LABELS, not sentences: `renderHelp()` composes each with
+ * a single space and the result must stay byte-identical at 80 columns
+ * (`DESIGN.md` §13.4, `test/help.golden.txt`). A trailing space moved in here
+ * would be invisible in review and would move the golden file.
+ */
+export declare const USAGE: {
+    readonly usageLabel: "Usage:";
+    readonly commandsLabel: "Commands:";
+    readonly docsLabel: "Docs:";
+    /** The unknown-verb line. Help follows it, so this says only what went wrong. */
+    readonly unknownCommand: (verb: string) => string;
+};
+/** `vibecommit status` (CR-021). */
+export declare const STATUS: {
+    readonly onForRepo: "Capture is on for this repository.";
+    readonly offForRepo: "Capture is off for this repository.";
+    readonly neverSent: "No session has been recorded yet.";
+    /**
+     * The §13.5 gutter keys. LOWERCASE because style guide §10.3 draws them that
+     * way, and §10.3 is the ruling (D65) — `lastSuccessLabel` and
+     * `dashboardLabel` were title-case and referenced by nothing, so `CR-021`
+     * changed them to match the screen rather than changing the screen.
+     */
+    readonly repoLabel: "repo";
+    readonly lastSuccessLabel: "last sent";
+    readonly dashboardLabel: "dashboard";
+    /** `<slug> (git toplevel <path>)` — §10.3's repo row. */
+    readonly repoToplevel: (slug: string, path: string) => string;
+    /** `4 minutes ago · seq 41`. No turn count — see the module note in status.ts. */
+    readonly lastSuccessValue: (age: string, seq: number) => string;
+    readonly fixCommandLabel: "To reconnect, run";
+    /** §10.3's two trailing actions, rendered as an aligned pair. */
+    readonly turnOffLabel: "Turn capture off for this repo";
+    readonly revokeLabel: "Revoke this machine's credential";
+};
+/**
+ * `vibecommit connect` (CR-025 owns the live-capture ending).
+ *
+ * ⚠ THE DISCLOSURE PARAGRAPHS ARE NOW HERE — `CR-111d` landed them, transcribed
+ * from style guide §10.2 rather than paraphrased. They replaced three
+ * placeholder one-liners. D64 falsified the trust argument the earlier draft
+ * leaned on: this repo is PRIVATE with MIT intact, so "read the source" is false
+ * and BLOCKED by the register. What survives is `Vibe-Commit/claude-plugin`,
+ * which vendors the exact binary — and "inspect the build" is WEAKER than "read
+ * the source" and may not be dressed up as it (D65 §DR7).
+ *
+ * The MECHANISM copy sits beside them and belongs to other rows: the prompt, the
+ * two answers, the refusals, `CR-025`'s ending and `CR-110`'s fifth beat.
+ *
+ * Also locked and enforced by the mechanism, not by these strings: default `N`,
+ * non-TTY refuses with exit 2, and no reassurance adjectives (*secure, safe,
+ * protected, private, encrypted*) anywhere on the screen (D65 §DR7).
+ */
+export declare const CONNECT: {
+    /**
+     * ⚠ NOT PARAPHRASED. §10.2's rule 4 — *every noun names something actually
+     * uploaded, in the USER's vocabulary* — is the one rule no gate can check, so
+     * the nouns are transcribed rather than reworded: *"the output of commands it
+     * ran"*, never *"Bash tool results"*.
+     */
+    readonly consentHeading: "VibeCommit uploads your Claude Code transcripts for this repo.";
+    /**
+     * ⚠ "private-repo paths" IS THE APPROVED WORDING, and it is the reason
+     * `private` is deliberately NOT registered in `claims.ts`: a substring gate on
+     * it would fire on this very sentence on day one, and the register's own
+     * §Lintable-unit section says a gate dies at its third false positive. So
+     * `private`-as-reassurance is a HUMAN review item here. This use is
+     * descriptive — it names what the paths ARE — and is the opposite of a
+     * reassurance.
+     */
+    readonly consentDetail: "That means the full text of the session: your prompts, the agent's replies, the arguments to every tool call, the file contents inside Edit records, and the output of commands it ran. File paths include private-repo paths.";
+    /**
+     * ⚠ THE NUMBER AND ITS QUALIFIER ARE ONE UNIT.
+     *
+     * **12 is `CR-042`'s counted figure** (merged, `6d8ec68`), taken rather than
+     * recounted: the patterns live in `vibecommit-mcp/src/scrubber/patterns.ts`,
+     * which is closed source and another chain's repo. `CR-042` exists precisely
+     * because the draft said 10 — a number is a claim, and this one is counted
+     * from code.
+     *
+     * The qualifier is as load-bearing as the number. Without *"it is a pattern
+     * list, not a general secret detector"* and *"a secret it has no pattern for
+     * is uploaded"*, the count reads as PROTECTION — which is the reassurance D65
+     * §DR7 bans, arriving as arithmetic instead of as an adjective.
+     */
+    readonly consentScrubber: "A scrubber removes 12 known secret formats (AWS keys, GitHub tokens, and similar). It is a pattern list, not a general secret detector: a secret it has no pattern for is uploaded. Command output is not path-filtered.";
+    /**
+     * ⛔ **THE SECOND DATA CLASS, AND THE DISCLOSURE DID NOT MENTION IT AT ALL —
+     * `T15`, `D190`.**
+     *
+     * The three paragraphs above enumerate TRANSCRIPT CONTENT. They were the whole
+     * disclosure, and commit SHAs have gone on the wire since `CR-170` without a
+     * word here. `D190` adds two more headers, one of which is a genuinely new
+     * class, so the copy is extended rather than the send being scoped — scoping
+     * the send would gut the feature.
+     *
+     * ## ⛔ WHAT IS HERE IS MEASURED FROM `buildIngestHeaders`, NOT FROM THE PLAN
+     *
+     * | said here | header | since |
+     * |---|---|---|
+     * | the commit ID | `x-commits` | `CR-170` |
+     * | the branch name | `x-head-branch` | `CR-170` |
+     * | the session it was linked to | `x-session-id` | pre-`CR-170` |
+     * | how that link was made | `x-commit-attributions` | `D190`, NEW |
+     * | the replaced commit's ID | `x-rewrites` | `D190`, NEW |
+     *
+     * ⛔ **AND WHAT IS DELIBERATELY NOT HERE, BECAUSE IT DOES NOT LEAVE THE
+     * MACHINE.** `post_commit.ts` gathers the changed-file list and the committer
+     * date because they are free at that moment, and `capSpool` returns only
+     * `{shas, attributions, count}`. **Describing them as uploaded would be a FALSE
+     * DISCLOSURE, which is as much a claims defect as a missing one** — and it is
+     * the easier mistake, because over-disclosing feels safe.
+     *
+     * ⚠ **`SpoolEntry.branch` and `delta.head.branch` are NOT the same noun.** The
+     * per-commit one stays local; the repo's CURRENT branch goes out on every
+     * delta as `x-head-branch` (`post.ts:228`, `entry.ts:612`). The branch name is
+     * named here on the strength of the second, never the first.
+     *
+     * ## ⛔ THE REWRITE SENTENCE IS THE ONE THIS STRING EXISTS FOR
+     *
+     * `x-rewrites` carries LOCAL, UNPUSHED REWRITE HISTORY — `ancestor:successor`
+     * pairs whose ancestor is unreachable from every branch and gone after
+     * `gc --prune=now`. Telling a user "we upload your transcripts" does not cover
+     * "we upload a record of the commits you rewrote before pushing". **Someone who
+     * squashes to bury a false start is entitled to know that the false start's ID
+     * left the machine.**
+     *
+     * ⚠ *"may never have left this machine"*, not *"was never pushed"*: you can
+     * amend a commit that WAS pushed and force-push it, so the stronger sentence is
+     * false in a real case.
+     *
+     * ## ⛔ NO NEGATIVE LIST, AND THAT IS A DECISION
+     *
+     * An earlier draft closed with *"commit messages, authors, dates and the
+     * changed-file list are not uploaded."* True today (`post.ts:166-174`), and
+     * CUT: `D190 §6` says this wire has **no compiler, no schema and no shared
+     * type**, so a negative claim in shipping copy goes false the first time anyone
+     * adds a header — silently, with no gate able to see it. Positive claims only.
+     *
+     * ⚠ Opens *"Not only the transcript"* because `consentHeading` still says
+     * *"uploads your Claude Code transcripts"*, which is now narrower than the
+     * truth. Repairing the scope where a skimmer meets it; the heading itself is a
+     * bigger copy change than this task was scoped for.
+     */
+    readonly consentCommits: "Not only the transcript. Commits you make while a session is recording are uploaded too: the commit ID, the branch name, the session it was linked to, and how that link was made. If you amend or rebase, the ID of the commit you replaced goes with them — that commit may never have left this machine, and git will eventually delete it from here.";
+    /** §10.2's first labelled link. Points at `HELP.docsUrl` — one definition. */
+    readonly consentDocsLabel: "Read the full list:";
+    /**
+     * ⚠ THE REPLACEMENT FOR THE OPEN-SOURCE CLAIM, and the ceiling on what it may
+     * say. D64 created this repo PRIVATE with MIT intact, so *"read the source"*
+     * is FALSE — the register's own signed-receipts failure mode, copy describing
+     * a mechanism that does not exist. What survives is `claude-plugin`, which D20
+     * keeps public non-negotiably and which vendors the exact binary that runs.
+     *
+     * **"Inspect the build" is WEAKER than "read the source" and may not be
+     * dressed up as it** (D65 §DR7). This line offers the artefact and claims
+     * nothing about readable source. All four phrasings are registered BLOCKED on
+     * the `connect` surface, so the gate refuses the smuggled version too.
+     */
+    readonly consentBundleLabel: "The binary that runs is here:";
+    readonly consentPrompt: "Continue?";
+    readonly declined: "Not connected. Nothing was uploaded.";
+    readonly capturing: "Recording this session…";
+    readonly doneHeading: "Connected.";
+    readonly doneUrlLabel: "View this session";
+    /** The `[y/N]` suffix. The capital is the default and the default is NO. */
+    readonly consentAnswers: "[y/N]";
+    /** Non-TTY refusal — DESIGN.md §13.7 exit 2, D65 §DR7. */
+    readonly nonInteractiveWhat: "Consent needs an interactive terminal.";
+    readonly nonInteractiveWhy: "Standard input is not a terminal, so the consent prompt cannot be answered. Nothing was read and nothing was uploaded.";
+    readonly nonInteractiveFix: "Run this in a terminal:";
+    readonly alreadyConnected: "Capture is already on for this repository.";
+    /**
+     * The browser sign-in beat (PKCE loopback → minted ingest credential) is the
+     * oauth lane's, not this task's. Until it lands, the supported path is the one
+     * `VIBECOMMIT_TOKEN` exists for. This copy states a mechanism, not a promise.
+     */
+    readonly credentialNeededWhat: "This machine has no ingest credential.";
+    readonly credentialNeededWhy: "Consent is recorded for this repository, but nothing can be uploaded without a credential for this machine.";
+    readonly credentialNeededFix: "Set one, then run connect again:";
+    readonly credentialNeededCommand: "export VIBECOMMIT_TOKEN=…";
+    /** `Capture is on for <repo>. Nothing else to do.` */
+    readonly doneForRepo: (repo: string) => string;
+    readonly stopLabel: "To stop";
+    /**
+     * No transcript to record. ONE state — `CR-112` (W8) owns the five-absence
+     * grammar as a set, and a sixth phrasing invented here is what that task
+     * exists to prevent.
+     */
+    readonly noTranscriptWhat: "No Claude Code session was found for this repository.";
+    readonly noTranscriptWhy: "Consent is recorded, but connect had nothing to record: no transcript exists yet for this project. Capture starts on its own the next time Claude Code runs here.";
+    readonly noTranscriptFix: "Nothing to fix. Start a session, then check:";
+    /**
+     * ⚠ `warn`, NEVER `bad`, and **EXIT 0, never 1**. That 403 means *later*, not
+     * *failed*: the offset holds and the backlog uploads in order on approval. A
+     * red exit tells a correctly-installed user they broke something, which moves
+     * the confusion report's T+9:00 give-up to T+0:45. `held` and `armed` are the
+     * two words doing the work — both mean *ready, not running*.
+     *
+     * `capture_policy` defaults to `approval_required`, so a member of a
+     * multi-member org sees this every time; solo orgs auto-approve inside the
+     * insert and never meet it.
+     */
+    readonly pendingWhat: "Your org needs to approve capture first.";
+    /**
+     * ⚠ NAMES THE REPO, NOT THE ORG — and that is a deviation from the style
+     * guide's drawn example, made deliberately. §10.2 renders *"acohan/repo
+     * belongs to the `vibecommit` org"*, and the client cannot produce that name:
+     * the 403 body discloses nothing (no org id, no owner list, by design), and
+     * `resolveRepoSlug` yields the GIT owner, which is a different thing from the
+     * VibeCommit org that holds the capture policy. Inventing one would be a
+     * confident lie; the link resolves it, which is what the link is for.
+     */
+    readonly pendingWhy: (repo: string) => string;
+    /**
+     * ⚠ THE SHARED CLAUSE, and it renders on EVERY branch. D81: `owners_notified`
+     * `null` = NOT DETERMINABLE, `0` = determinable and nobody was told, `> 0` =
+     * N notified — and **`> 0` ADDS to this sentence rather than replacing it**.
+     * One shared clause is why the two branches cannot drift apart later; a pair
+     * of independent paragraphs is how the false version gets reintroduced.
+     *
+     * It is also TRUE, and checked rather than inherited: the server upserts a
+     * `capture_requests` row BEFORE it emits the 403.
+     */
+    readonly pendingRecorded: "Your request is recorded.";
+    /**
+     * ⚠ THE ONLY BRANCH THAT MAY CLAIM A NOTIFICATION, and it is reachable only
+     * when the server says `> 0`. Today it never does — the field is hardcoded
+     * `null` until `CR-036`, which is provisioning-blocked — so this sentence is
+     * built and unreachable ON PURPOSE. **Never render it on the null branch.**
+     * D81: a hardcoded *"we notified the owners"* installs the most damaging
+     * possible mental model at the moment of highest trust — *the owner knows, so
+     * I just wait* — so the pending state would suppress its own workaround. A
+     * user told nothing at least asks in Slack.
+     *
+     * The branch is PERMANENT, not a stopgap: addresses bounce, domains land on
+     * suppression lists, and a sole owner's address can be dead. `CR-036` landing
+     * does not delete the other branch; it only makes this one reachable.
+     */
+    readonly pendingNotified: (owners: number) => string;
+    /** True by construction: 403 is `later`, so the offset holds and bytes stay on disk. */
+    readonly pendingBuffered: "Nothing is lost while you wait — turns are buffered on this machine and upload in order once an owner approves.";
+    readonly pendingTrackLabel: "Track it:";
+    /** `armed` = ready, not running. The install is correct; capture is waiting. */
+    readonly pendingArmed: (repo: string) => string;
+};
+/**
+ * The PATH clash — `CR-025`, and `DESIGN.md` §13.6's worked example is the spec.
+ *
+ * D55 accepted a residual bin collision as unlikely; the register corrects that
+ * to *closer to certain*, because the squatting package (`vibecommit@1.0.6`) is
+ * itself a commit CLI, so the overlap population is exactly developers who
+ * install commit tooling. **This detects the collision D55 accepted. It does not
+ * reopen the naming decision** — the bin name stays.
+ *
+ * ⚠ The plugin path in the fix line depends on `CR-027e` (renames the plugin
+ * directory to `vibecommit`) and `CR-028` (creates `bin/` at all), both W6, both
+ * in `claude-plugin`, both another builder's. Written as §13.6 draws it rather
+ * than softened to dodge the dependency.
+ */
+/**
+ * The `post-commit` install report — `CR-170`, D154.
+ *
+ * ⛔ **EVERY OUTCOME SAYS SOMETHING, INCLUDING THE GOOD ONE.** Three of this
+ * path's failure modes are silent no-ops (D98's class): `core.hooksPath` makes
+ * `.git/hooks` dead, an existing hook must not be clobbered, and neither is
+ * visible without a line of output. A user who is told nothing cannot tell a
+ * working install from one that observes no commits for the life of the clone.
+ *
+ * ⚠ **AND IT SAYS "THIS CLONE", EVERY TIME.** Per-clone installation is the real
+ * cost of this design and the one thing a user will be surprised by later, so it
+ * is stated at the moment they can act on it rather than buried in documentation.
+ */
+export declare const COMMIT_HOOK: {
+    readonly installed: (repo: string) => string;
+    readonly chained: (repo: string) => string;
+    readonly already: "Commit capture was already on for this clone.";
+    readonly perClone: "Run `vibecommit connect` in each clone you want commits recorded for — git hooks are per-clone, not per-account.";
+    readonly hooksPathWhat: "Commit capture could NOT be installed for this clone.";
+    readonly hooksPathWhy: (configured: string) => string;
+    readonly hooksPathFixLabel: "Fix, either one:";
+    readonly hooksPathFixUnset: "git config --unset core.hooksPath";
+    readonly hooksPathFixManual: "or add `vibecommit post-commit` to your existing post-commit hook";
+    readonly failedWhat: "Commit capture could NOT be installed for this clone.";
+    readonly failedWhy: (why: string) => string;
+};
+export declare const PATH_CLASH: {
+    readonly foreignWhat: "Another program owns the `vibecommit` command.";
+    readonly foreignWhy: (resolved: string) => string;
+    readonly absentWhat: "The `vibecommit` command is not on your PATH.";
+    readonly absentWhy: "Hook capture is unaffected — the plugin runs the binary by path — but typing `vibecommit status`, `why` or `report` will not find it.";
+    readonly fixLabel: "Fix, either one:";
+    /**
+     * FOREIGN only. The uninstall half is wrong for the absent case — telling
+     * someone to uninstall a package they demonstrably do not have is the kind of
+     * fix line that teaches users to stop reading fix lines. Found by running it.
+     */
+    readonly fixReplace: "npm uninstall -g vibecommit && npm i -g @vibe-commit/capture";
+    /** ABSENT: there is nothing to remove, only something to add. */
+    readonly fixInstall: "npm i -g @vibe-commit/capture";
+    readonly fixDirectLabel: "or invoke ours directly:";
+    /**
+     * `node …/bin/index.js`, not `…/bin/vibecommit`, and the difference is not
+     * cosmetic: `claude-plugin`'s `bin/` contains `index.js` and no file named
+     * `vibecommit`, and `index.js` carries a shebang but is NOT executable — so
+     * the shorter form fails twice over. `hooks.json` invokes it exactly this
+     * way, which is the shape that demonstrably works.
+     *
+     * This line asked for something impossible until DESIGN.md §13.6 was
+     * corrected — the same defect as the absent case above telling users to
+     * uninstall a package they do not have. **A fix line must be runnable, and
+     * the way you know is that you ran it.**
+     */
+    readonly fixDirect: "node ~/.claude/plugins/vibecommit/bin/index.js connect";
+};
+/**
+ * Browser sign-in — `CR-084d`, the beat `connect.ts:175-176` deferred to "the
+ * oauth lane" and this task is that lane.
+ *
+ * ⚠ Two rules these strings are written to, both from the claims register:
+ *
+ *   1. **No reassurance adjective anywhere** (D65 §DR7 registers *secure, safe,
+ *      protected, encrypted* on the `connect` surface, which is where every
+ *      string below renders). A sign-in screen is exactly where the temptation
+ *      is strongest, and "we'll securely sign you in" says nothing a user can
+ *      check.
+ *   2. **The `what` line never has "you" as its subject** and never carries a
+ *      bare HTTP status (DESIGN.md §13.6). "Sign-in did not finish", not "you
+ *      failed to sign in"; the CAUSE goes in the `why` line, in a noun the user
+ *      recognises.
+ *
+ * `browserDone` and `browserRefused` are the only strings in this package a
+ * BROWSER renders rather than a terminal, which is why they carry no §13.5
+ * gutter and no §13.2 glyph: there is no terminal to degrade to. They are still
+ * copy, so they still live here and are still scanned by the claims gate.
+ */
+export declare const SIGNIN: {
+    /** Printed before the browser opens, so the user knows what just happened. */
+    readonly opening: "Opening your browser to sign in…";
+    /**
+     * The headless fallback. NOT an error: a machine with no browser is an
+     * ordinary place to run this, and the URL is a complete substitute.
+     */
+    readonly manualLabel: "Open this URL to finish signing in:";
+    readonly waiting: "Waiting for the browser…";
+    readonly done: "Signed in.";
+    /** What the browser tab shows. One line each — nothing is styled. */
+    readonly browserDone: "Signed in. You can close this tab and return to your terminal.";
+    readonly browserRefused: "This request did not match the sign-in waiting in your terminal.";
+    readonly noServerWhat: "VibeCommit could not find the sign-in service.";
+    /** `unreachable` — nothing answered. Says what was tried, not what is wrong. */
+    readonly noServerUnreachableWhy: "The server did not answer the request that says where to sign in. It may be down, or this machine may have no route to it.";
+    /** Any `malformed` fault. One sentence, because the user's move is the same. */
+    readonly noServerMalformedWhy: "The server answered, but the document that says where to sign in is not one this version can use.";
+    /**
+     * The override was refused before anything was sent. Names the variable and
+     * the rule, because this one is entirely in the user's hands to fix.
+     */
+    readonly noServerRefusedWhy: "VIBECOMMIT_MCP_URL is set to an address this client will not send a sign-in to. Only https, or http on the loopback, is allowed.";
+    readonly noServerFix: "Check the service, then run:";
+    readonly deniedWhat: "Sign-in was declined.";
+    readonly deniedWhy: "The sign-in screen returned without granting access. Nothing was changed on this machine.";
+    readonly deniedFix: "To try again, run:";
+    readonly timeoutWhat: "Sign-in did not finish in time.";
+    readonly timeoutWhy: "The browser did not come back before the deadline. Nothing was changed on this machine.";
+    readonly timeoutFix: "To try again, run:";
+    readonly rejectedWhat: "The sign-in service refused this client.";
+    /**
+     * ⚠ `unauthorized_client` is the expected answer TODAY: this CLI's client id
+     * is not in the server's registered set (see `src/oauth/token.ts`). The copy
+     * names the state without promising when it changes — a date here would be a
+     * claim the register would have to carry.
+     */
+    readonly rejectedWhy: "The service did not accept this client's sign-in request.";
+    readonly rejectedFix: "Report this, with the command you ran:";
+    readonly unreachableWhat: "VibeCommit could not reach the sign-in service.";
+    readonly unreachableWhy: "The request did not complete. Nothing was changed on this machine.";
+    readonly unreachableFix: "Check the connection, then run:";
+    readonly malformedWhat: "The sign-in service returned an unexpected answer.";
+    readonly malformedWhy: "The response was not in the form this version can use. No session was stored.";
+    readonly malformedFix: "Report this, with the command you ran:";
+    /** A session already exists, so sign-in is a no-op. */
+    readonly alreadySignedIn: "Already signed in on this machine.";
+    /**
+     * ⚠ THE COPY THIS OBJECT DEFERRED BY TASK NUMBER, now written by the first
+     * renderer. `why` is that renderer; `report` (`CR-108`, W10) is the second and
+     * inherits these rather than inventing a second phrasing.
+     *
+     * ⚠ AND THIS EXPORT NOW RENDERS ON TWO SURFACES. `SURFACES` in
+     * `test/copy-claims.test.ts` gained `why` beside `connect` for exactly these
+     * four strings — a surface map that still said `connect` alone would be
+     * checking them against the wrong blocked set.
+     *
+     * `expired` — the refresh grant was REFUSED. The session is over; only a new
+     * sign-in fixes it. Distinct from `busy`, which is a wait.
+     */
+    readonly expiredWhat: "This machine's sign-in has ended.";
+    readonly expiredWhy: "The stored sign-in could not be renewed, so nothing could be read. It may have been revoked, or it may simply have run out.";
+    readonly expiredFix: "Sign in again, then run the command again:";
+    /**
+     * `busy` — another process holds the refresh lock and did not release it in
+     * time. NOT a failure of the session: the fix is to run it again, and saying
+     * "sign in again" here would send a user to re-authenticate over a lock.
+     *
+     * ⚠ The `what` line's subject is the state, never "you" (DESIGN.md §13.6).
+     */
+    readonly busyWhat: "Another VibeCommit command is renewing this machine's sign-in.";
+    readonly busyWhy: "Only one process may renew a sign-in at a time, and the one holding it did not finish. Nothing was read and the stored sign-in is unchanged.";
+    readonly busyFix: "Run it again in a moment:";
+};
+/** `vibecommit off`. */
+export declare const OFF: {
+    readonly done: "Capture is off for this repository.";
+    readonly alreadyOff: "Capture was already off for this repository.";
+    readonly note: "Sessions already recorded are unaffected.";
+};
+/**
+ * `vibecommit why` — `CR-086`, W9.
+ *
+ * The screen is drawn in style guide §10.4 (layout), §10.5 (sub-agent
+ * attribution) and §10.6-A/B (the two absences this verb owns), and the copy is
+ * NORMATIVELY §R3's decision table in `docs/designs/claims-audit-why.md`. §10.4
+ * is explicit that §R3 governs and that it must not be paraphrased here, so the
+ * per-grade sentences live in `grades.ts` behind the one header renderer and
+ * this object holds only what §R3 tables SEPARATELY from the grade.
+ *
+ * ## ⚠ THE HOLE THIS SURFACE SHIPS WITH, HELD OPEN AND NAMED — `CR-129`
+ *
+ * §R3's sub-agent attribution table has three rows and **two of them read data
+ * nothing produces**. Measured at `vibecommit-schema` `2c77400`,
+ * `vibecommit-mcp` `eeda878` and here at `4dcf47d`, every tracked blob read as
+ * utf8 (never `grep` — `src/redact.ts` carries literal NUL bytes and `grep -I`
+ * skips it silently):
+ *
+ *   - `capture_turns.subagent_count` — **0 hits in all three repos** at those
+ *     SHAs. `TODOS[74]` assumed the column; nothing had added it.
+ *     ⚠ **UPDATED BY `CR-129d` (W10): THE COLUMN NOW EXISTS AND STILL HAS NO
+ *     PRODUCER.** `CR-129a` added it at `vibecommit-schema` `f3022c5` —
+ *     `integer`, nullable, no default. Nothing writes it (mcp's
+ *     `insertCaptureTurns` is a seven-key literal) and nothing emits it
+ *     (`blame_commit` selects `position, turn_hash`), so the marker still
+ *     cannot render from real data. The measurement above is kept because it
+ *     is dated and was true; **this note is the correction, not a rewrite.**
+ *     ⚠ A six-column tally stood here and is gone — it was an exact
+ *     transcription of the original `create table` that three later
+ *     migrations emptied, including one renaming `workspace_id` to `org_id`.
+ *     D101: write the predicate, never the count.
+ *   - `commit_file_attribution` EXISTS (`CR-070`,
+ *     `20260814000000_cr070_commit_graph.sql:278`) and **has no writer**:
+ *     `CR-072` shipped the edge only and said so
+ *     (`vibecommit-mcp/src/conversation/edge_derivation.ts:56-64`). That table
+ *     is where `agent_id` lives.
+ *
+ * So `agent_id` is a column on a table nothing writes, and `subagent_count` is
+ * not a column at all. `TODOS[74]` says of that minimum: *"E1 cannot ship
+ * without it… silence about a delegated edit is an overclaim about who wrote
+ * the code."* Both halves are true, and the resolution is neither to omit the
+ * requirement nor to fake it: **the absence renders, in the absence grammar,
+ * naming what it is and what would change it.**
+ *
+ * ⚠ `agent_id` NULL is SEMANTIC — the schema comment says *"NULL = the main
+ * thread. The empty string is refused because '' would render as an unnamed
+ * sub-agent — a plausible wrong answer rather than an error."* **`null` and
+ * ABSENT are therefore different facts**: `null` means we know it was the main
+ * thread; absent means we know nothing. An unmarked turn rendered from an
+ * absent field is the overclaim, so `why.ts` requires the field to be PRESENT
+ * before it renders a turn unmarked, and marks every turn otherwise.
+ *
+ * ## What is deliberately NOT here
+ *
+ * No grade word. §13.3: *"Grade words appear in `--json` only. Prose never
+ * prints a bare grade"* — the two-tier structural summary plus the per-edge
+ * evidence sentence render instead, and the evidence sentence is `grades.ts`'s.
+ *
+ * No `⛓` / `◇` glyphs. §10.5 draws them for the WEB surface; `DESIGN.md` §13.2's
+ * `GLYPH` table has exactly three entries (`ok` / `warn` / `bad`) and neither is
+ * in it. The CLI's binding requirement is §R3's prose evidence line, which
+ * renders. Inventing a fourth glyph is a report to the orchestrator, not an edit
+ * to `term.ts`.
+ *
+ * No colour on the attribution marker or on the grade (D65 §DR3, §DR4).
+ * `agent_id` is an ACTOR IDENTITY, the same class as a branch name, and a
+ * green/yellow/red grade ramp asserts a ranking §R3 forbids.
+ */
+export declare const WHY: {
+    /**
+     * ⚠ THIS is where D61 §PS6's file scope lives, and the reason it moved here.
+     * `commit_file_attribution` has no line ranges, so every sentence that
+     * INTRODUCES TURNS is file-scoped — and §PS6 requires the file scope to render
+     * on the same screen as the line number, which it does: the identity line
+     * above carries the line, this sentence carries the file.
+     *
+     * ⚠ §R3 bans a causal vocabulary on this sentence at all grades — *produced,
+     * caused, wrote this line, because, the reason, responsible for, explains, led
+     * to*. "Touched" is the approved verb and it is the weakest true one.
+     */
+    readonly turnsIntro: (file: string) => string;
+    /**
+     * §R3's `match_kind` table, the `probable` row — `CR-138d` / `CR-109d`.
+     *
+     * ⚠ **THE ONLY DIFFERENCE BETWEEN THE TWO VARIANTS, AND IT MUST STAY VISIBLE.**
+     * §R3: `exact` renders the squash copy *unqualified* — the pair came from a
+     * recorded successor row — while `probable` renders it **plus a stated
+     * basis**. Rendering them identically is the folding D67 forbids: *"the
+     * disclosure would become the thing that hides the distinction."*
+     *
+     * ⚠ D105 makes this permanent rather than cosmetic: `match_kind` is in
+     * `commit_sha_successors`' primary key and `reject_history_mutation` raises
+     * on every UPDATE including `service_role`, **so a wrong row cannot be
+     * corrected.** A guess labelled as a guess is the only honest rendering.
+     *
+     * ⚠ `witnessed` is §R3's own word and the choice is deliberate. The obvious
+     * phrasing would have reached for the `observed` family, which is BLOCKED on
+     * this surface because it names a mechanism that exists in no repo (D113 §1)
+     * — a blocked claim arriving through a synonym nobody was checking. This
+     * comment names the trap without spelling the phrase, so a source-text scan
+     * does not fire on the note explaining the avoidance.
+     */
+    readonly squashProbableBasis: "These two commits were matched by patch id rather than by a recorded successor row, so the pairing is read off the commits themselves and is not something capture witnessed.";
+    /**
+     * ⚠ WHY THE TWO SHAS ON THE SQUASH SCREEN ARE DIFFERENT LENGTHS.
+     *
+     * Two builders — this one and `CR-101`'s on the web surface — read the
+     * asymmetry as a bug, and **the ruling was to explain it rather than remove
+     * it** (D120 §1 as revised). Web keeps parity by carrying the full value in
+     * the DOM; a terminal line has nowhere to put it, so the line says why.
+     *
+     * ⚠ **THE SENTENCE DOES NOT TELL THE READER TO RUN `git show` ON IT**, and
+     * that restraint is measured rather than cautious: cloned over the git
+     * transport after a squash-merge with branch delete, the original object is
+     * ABSENT and `git show` fails on the full sha as surely as on a short one.
+     * What the full value keeps is that it stays a complete identifier somebody
+     * else can look up. Promising a local command that fails in exactly the case
+     * this state exists for would be the plausible-wrong-answer class in copy.
+     */
+    readonly squashShaLengths: "The recorded commit is written out in full because a squashed commit is often missing from a working copy, and a shortened id cannot be looked up once the commit is gone.";
+    /** §10.4's turn row: `turn 12  [Edit]  session.ts`. */
+    readonly turnLabel: "turn";
+    /** §10.4: excerpts are `muted` and `>`-prefixed — verbatim, never a summary. */
+    readonly excerptPrefix: ">";
+    /** Row 1 — `agent_id IS NOT NULL`. An identity, rendered plain (D65 §DR3). */
+    readonly subAgentMarker: (agentId: string) => string;
+    /**
+     * Row 2 — `capture_turns.subagent_count > 0`.
+     *
+     * ⚠ **NO PRODUCER EXISTS FOR THIS AND THE COLUMN IS NOT IN ANY SCHEMA.** It is
+     * implemented against a validated OPTIONAL payload field so that the day the
+     * column exists the row renders, and it is exercised in the suite against a
+     * synthetic payload — but nothing on the wire can populate it today, and this
+     * comment is the only honest place to say so. It is NOT rendered from a zero
+     * and NOT rendered from an absent field.
+     */
+    readonly subAgentCountMarker: (count: number) => string;
+    /**
+     * The marker for a turn whose actor we cannot name — `CR-129`'s hole, on the
+     * turn itself rather than only in a footnote. §10.5: *"the turn header and the
+     * file-attribution table ALWAYS name the actor… hiding an actor"* is the thing
+     * that makes a claim. When we cannot name one, we say that, per turn.
+     */
+    readonly actorUnrecordedMarker: "· actor not recorded";
+    /**
+     * The `CR-129` note, in the absence grammar — absence, cause, remedy.
+     *
+     * ⚠ NOT an `ABSENCE` state and it may not become one. Those five are
+     * whole-screen empty states that all exit 4; this is a caveat on a screen that
+     * HAS content, and `test/copy-absence.test.ts` asserts the set is exactly
+     * five. Same ruling the `ABSENCE` docblock already makes for the
+     * shallow-clone refusal: not every absence sentence is an absence STATE.
+     */
+    readonly attributionWhat: "Sub-agent attribution is not recorded for these turns.";
+    /**
+     * ⚠ "on this screen", not "below" — caught by rendering it. The note sits
+     * AFTER the turn list, so a positional word was pointing the wrong way. A
+     * sentence that describes its own layout breaks silently when the layout
+     * moves; one that names the screen does not.
+     */
+    readonly attributionWhy: "The per-turn attribution this marker reads has no writer yet, so no turn on this screen can be shown as main-thread work or as delegated work.";
+    /**
+     * ⚠ THE SECOND SENTENCE IS THE LOAD-BEARING ONE. Without it, an unmarked turn
+     * reads as a finding that the main thread wrote it — which is the inversion
+     * the register permanently BLOCKS, arriving through silence instead of through
+     * a sentence.
+     */
+    readonly attributionNotAFinding: "An unmarked turn here is a missing record, not a finding about who wrote the code.";
+    readonly attributionFix: "Nothing to fix on this machine. The marker renders once attribution is recorded.";
+    /**
+     * §R3, verbatim. ⚠ **The selection rule is ORDINAL AND STATED** — *"in turn
+     * order"*, never *"most relevant"*, which is a ranking, which is server-side
+     * analysis and reverses D48–D51.
+     *
+     * ⚠ **Every number here comes from the PAYLOAD.** D60 §D1a: *"the client may
+     * render; it may not analyze."* Windowing an already-ordered list for display
+     * is rendering; DERIVING the numbers is not, so `why.ts` never counts the
+     * array it was handed.
+     */
+    readonly truncation: (from: string, to: string, total: string) => string;
+    /** §R3's L2: files in the commit whose `turn_hash` is NULL are COUNTED, never dropped. */
+    readonly filesWithoutTurn: (count: string) => string;
+    /** The one-file form. `1 more files` is the tell that a count was never read. */
+    readonly fileWithoutTurn: "1 more file in this commit has no linked turn.";
+    readonly usageWhat: "This command needs a file and a line number.";
+    readonly usageWhy: "`why` answers for one line, so it cannot run without one. Nothing was read and nothing was sent.";
+    readonly usageFix: "Name the file and the line:";
+    /**
+     * `--json` — the REFUSAL COPY THAT STOOD HERE IS GONE, and its removal is the
+     * deliverable rather than a tidy-up (`CR-149`, D122 §2).
+     *
+     * It read *"`why` cannot produce JSON yet"*, and its docblock argued the
+     * refusal was *"the honest minimum rather than a gap"*. That was honest as a
+     * STOPGAP and false as a claim about design intent: **§13.3 REQUIRES `--json`
+     * on the read verbs**, so the flag was an UNBUILT FEATURE wearing the shape of
+     * a designed position — which is the harder defect to see, because a refusal
+     * reads as a decision. `src/json.ts` is the document; `status`, `why` and
+     * `report` all emit one.
+     *
+     * Nothing replaces these three constants. A verb that CAN answer the flag has
+     * no refusal to word.
+     */
+    /**
+     * The shallow-clone REFUSAL (D67's posture, D98's hazard class).
+     *
+     * ⚠ A REFUSAL IS NOT AN ABSENCE. `git blame` on a shallow clone attributes to
+     * the graft boundary and returns a plausible WRONG commit — a call that fails
+     * announces itself; a call that returns a plausible answer is absorbed by the
+     * caller. Shallow clones live in CI containers, which is exactly where nobody
+     * is watching. The `ABSENCE` docblock already rules on this for `report`: it
+     * is not a sixth state and one may not be written there.
+     */
+    readonly shallowWhat: "This is a shallow clone, so `git blame` cannot be trusted here.";
+    readonly shallowWhy: "A shallow clone stops at its graft boundary and attributes every older line to the oldest commit it holds. That answer looks ordinary and is wrong, so it is refused rather than shown.";
+    readonly shallowFix: "Fetch the full history, then run this again:";
+    readonly shallowFixCommand: "git fetch --unshallow";
+    /** `git blame` itself failed — no such file, no such line, or git said no. */
+    readonly blameWhat: "`git blame` could not attribute that line.";
+    readonly blameWhy: "git did not return a commit for it. The path may not be tracked in this repository, or the file may have fewer lines than the one named.";
+    readonly blameFix: "Check the path and the line, then run this again:";
+    /**
+     * ⚠ A READ-LANE FAILURE MUST PRINT AND EXIT NON-ZERO. The whole reason the
+     * exit contract was split is that the hook rule — exit 0, stdout empty — would
+     * have made this verb fail SILENTLY on a 5xx. `src/exit.ts` says so at the top.
+     *
+     * ⚠ And never a bare HTTP status (§13.6). The status is what we know; it is
+     * not what the user can act on.
+     */
+    readonly unreachableWhat: "VibeCommit could not reach the record service.";
+    readonly unreachableWhy: "The request did not complete, so no answer was read. The service may be down, or this machine may have no route to it.";
+    readonly serverErrorWhat: "The record service could not answer that.";
+    readonly serverErrorWhy: "The request reached the service and it returned a failure instead of a record. Nothing on this machine was changed.";
+    readonly malformedWhat: "The record service returned an answer this version cannot read.";
+    readonly malformedWhy: "The response was not in the form this version expects, so none of it was rendered rather than part of it being guessed at.";
+    readonly readFix: "Try again, and report it if it continues:";
+    /**
+     * ⛔ VERSION SKEW — DISTINCT FROM `malformed`, AND THE DISTINCTION IS THE
+     * WHOLE POINT (`U1`, 2026-08-30).
+     *
+     * `parseBlameCommitPayload` is a STRICT ALLOWLIST on `state`: a value it does
+     * not know returns null, and null rendered as "malformed". So the day the
+     * server added a state, every client older than that day told the user its
+     * ANSWER WAS BROKEN — when the answer was fine and the CLIENT was old.
+     * `edge_unreadable` is the first such addition and it would have been the
+     * first casualty.
+     *
+     * ⚠ THE ROOT CAUSE, NOT THE SYMPTOM. Without this, every future state the
+     * server adds needs a lockstep client release FOREVER, and the coupling is
+     * invisible until a user hits it — worse here than in most protocols, because
+     * the vendored bundle in `claude-plugin/bin/` lags this source (10 commits at
+     * the time of writing) so "old client" is the NORMAL case, not the edge one.
+     *
+     * ## Why this is not a sixth ABSENCE state
+     *
+     * It is not an absence. Nothing is missing from the record — the server
+     * answered, and this build cannot render what it said. Same reason the
+     * shallow-clone refusal is not one: a REFUSAL and a SKEW are both about this
+     * client's limits, and `ABSENCE` is about the record's contents.
+     *
+     * ⚠ It still follows CR-112's grammar (absence · cause · remedy), because
+     * that grammar is what makes a dead end actionable, and here — unlike most of
+     * `ABSENCE` — the remedy is real: upgrading genuinely fixes it.
+     *
+     * ⚠ THE COPY MAY NOT NAME THE STATE IT COULD NOT READ. The whole premise is
+     * that this build does not know what that value means; printing it would
+     * invite the reader to interpret a token this client cannot interpret either.
+     */
+    readonly skewWhat: "The record service sent an answer this version is too old to show.";
+    readonly skewWhy: "The service described this commit in a way this build does not recognise. The record itself is fine — this copy of the client cannot render it, so it showed nothing rather than guessing at part of it.";
+    readonly skewFix: "Reinstall the VibeCommit plugin to pick up the current client, then run this again:";
+    /** The bearer is dead after one refresh and one retry. Exit 3, not 1. */
+    readonly signedOutWhat: "This machine is not signed in to VibeCommit.";
+    readonly signedOutWhy: "Reading a record needs a signed-in user, and no usable sign-in was found on this machine.";
+    readonly signedOutFix: "Sign in, then run the command again:";
+};
+/**
+ * `vibecommit report` (CR-108).
+ *
+ * NOTE: this surface ships NO durability copy until the E2 metric is defined
+ * (D61 §PS6, and the claims-register `Durable / survives / durability` row).
+ *
+ * ⚠ THE TWO EMPTY-WINDOW STATES MOVED. They were `emptyNoCommits` and
+ * `emptyNoCapture` here, and they were the absence clause and NOTHING ELSE — no
+ * cause, no remedy. `CR-112` re-homed both into `ABSENCE` below, where they
+ * carry the full grammar and sit beside the three `why` states they have to
+ * agree with. Do not reintroduce a short form here: two half-states in one
+ * module and five whole ones in another is the drift `CR-112` exists to stop.
+ */
+export declare const REPORT: {
+    readonly coverageLabel: "Commits with a recorded session";
+    readonly gradeMixLabel: "Evidence";
+    /**
+     * ⚠ **THE DEFINITION IS PART OF THE NUMBER, NOT A PREFACE.** D67 cleared
+     * §PS6's durability block on stated terms, and the first is that the
+     * definition, the percentage and the grade mix render together — *"without
+     * them, `observed` correlation-in-time is laundered into a KPI."* A build
+     * that ships the number alone does not lift the block.
+     *
+     * ⚠ **THE REF IS IN THE SENTENCE, ALWAYS** — *"a bare percentage is
+     * meaningless because the number is ref-relative."* `commit_coverage` makes
+     * `ref` a REQUIRED payload field for exactly this reason.
+     */
+    readonly definition: (ref: string) => string;
+    readonly rate: (reachable: string, held: string, ref: string, percent: string) => string;
+    /** §10.3 draws `Of those:` and then the per-grade split. */
+    readonly gradeMixIntro: "Of those:";
+    /**
+     * ⚠ **THE GRADE WORDS THEMSELVES MAY NOT REACH THE SCREEN**, so the mix is
+     * rendered through these labels — DESIGN.md §13.3 (grade words in `--json`
+     * only), D65 §DR4 (no grade word on screen), and `test/why.test.ts` already
+     * enforces it for the other read verb.
+     *
+     * ⚠ §10.3's DRAWING VIOLATES THAT RULE and this deliberately departs from it:
+     * it draws *"41 observed during a session"*, which prints the bare grade
+     * word. D113 §1 makes it worse than a style slip — `observed` is BLOCKED
+     * because it names **a mechanism that exists in no repo**, and its listed
+     * phrasings include *seen during the session* and *watched*, which are the
+     * two shortenings anyone would reach for next. The `observed` label below
+     * mirrors `grades.ts`'s own approved sentence, *"This commit appeared while
+     * the session was running"*, which says the same fact and claims no witness.
+     * The §10.3 fix is owed in `code/` and is not this package's to write.
+     */
+    readonly gradeDerivedLabel: "recorded in the transcript";
+    readonly gradeObservedLabel: "appeared while the session ran";
+    readonly gradeDeclaredLabel: "reported by the agent";
+    /** `<n> <label>`, joined by the renderer. Singular and plural read alike. */
+    readonly gradeCount: (count: string, label: string) => string;
+    /**
+     * ⚠ **THE SEPARATE LABELLED LINE, IN OUR WORDS** — D67: *"only exact
+     * `commit_sha_successors` rows count toward the numerator; patch-id matches
+     * render as a SEPARATE LABELLED 'probable' LINE and are never folded into the
+     * rate."*
+     *
+     * ⚠ **AND IT IS NOT THE SERVER'S SENTENCE.** `vibecommit-mcp`
+     * `src/read/coverage.ts` emits `probable_line.label` — a user-facing string
+     * minted in another repository, on this payload. D112 §3 ruled on exactly
+     * that shape: **the wire carries the fact, the client owns the words.** That
+     * ruling was measured in `src/read/blame.ts` and the class is NOT closed one
+     * file over, so this renders here and the wire's label is never printed.
+     */
+    readonly probable: (count: string) => string;
+    readonly probableOne: "1 more matched by patch id, reported separately and not counted above.";
+    /**
+     * ⚠ **A SEPARATE PHRASING FROM `WHY.shallowWhat`, AND THE REASON IS THAT IT
+     * IS A DIFFERENT FACT.** `why`'s says *"`git blame` cannot be trusted here"*,
+     * which is true of blame and says nothing about reachability. On a shallow
+     * clone the commits that would answer *"is this sha still reachable"* may
+     * simply not be present, so the rate would be wrong rather than missing. The
+     * REMEDY is genuinely the same fact, so `shallowFix` and `shallowFixCommand`
+     * are SHARED rather than re-worded — that is the duplication to avoid.
+     */
+    readonly shallowWhat: "This is a shallow clone, so coverage cannot be computed here.";
+    readonly shallowWhy: "Coverage asks which recorded commits are still reachable, and a shallow clone does not hold the history that answers it. The number would be wrong rather than missing.";
+    /**
+     * ⚠ FAILS CLOSED. If git cannot answer reachability for a commit we hold, the
+     * rate would be computed over a set we do not actually know — so it refuses.
+     * Counting an unanswerable probe as unreachable would DEFLATE the number
+     * silently, which is D98's class: no obviously-broken shape.
+     */
+    readonly unknownReachabilityWhat: "Coverage could not be computed for every recorded commit.";
+    readonly unknownReachabilityWhy: "Git could not say whether some recorded commits are still reachable from this ref. A share computed over the rest would be a smaller number presented as a complete one.";
+    readonly unknownReachabilityFix: "Fetch the full history, then run this again:";
+    readonly refWhat: "This command needs a ref it can name.";
+    readonly refWhy: "Coverage is relative to a ref, so the answer is meaningless without one, and HEAD is detached here. Nothing was read and nothing was sent.";
+    readonly refFix: "Name the ref:";
+    /**
+     * The window, as the two empty states name it.
+     *
+     * ⚠ **THE WINDOW BOUNDS THE LOCAL HALF ONLY.** `commit_coverage` accepts no
+     * `since`, so the server's totals are repository-wide and the RATE claims no
+     * window — see `report.ts`. This string appears only on the two empty states,
+     * which are answered from the clone.
+     */
+    readonly window: (since: string) => string;
+    readonly usageWhat: "This command needs a start date.";
+    readonly usageWhy: "The window bounds which commits are counted, so the answer is not defined without one. Nothing was read and nothing was sent.";
+    readonly usageFix: "Name the date the window starts:";
+    readonly sinceWhat: "That start date could not be read.";
+    readonly sinceWhy: "The window must be a calendar date, written as YYYY-MM-DD. A date git cannot read would silently widen the window.";
+    readonly sinceFix: "Write the date as YYYY-MM-DD:";
+};
+/**
+ * THE FIVE ABSENCE STATES, AS ONE SET — `CR-112`, D65.
+ *
+ * Five screens, owned by four different tasks, written by different builders at
+ * different times: cold start and no-edge (`CR-086`, W9), the two `report` empty
+ * windows (`CR-108`, W10), and squash-resolved (`CR-109`). D65 put them in one
+ * row so they are ONE set with ONE grammar rather than four people's four ways
+ * of saying nothing was found.
+ *
+ * ## The grammar, and it is the three fields
+ *
+ * **State the absence (`what`), state the cause (`why`), state what would change
+ * it (`fix`). NEVER "nothing found".** The fields ARE the grammar — they are
+ * `renderErrorBlock`'s shape (`src/term.ts`) and `DESIGN.md` §13.6's *what, why,
+ * fix — fix last, always, because the last thing on screen is what gets copied*.
+ * **A state with a blank `why` is a state that says "nothing found" with extra
+ * steps**, which is why `test/copy-absence.test.ts` asserts every field of every
+ * state explicitly and scans all of them for the empty-result vocabulary.
+ *
+ * That test is the mechanism. This docblock is not: `CR-090d` is one wave old
+ * and its whole lesson is that `strings.ts` DECLARED "no inline literals" while
+ * five sat in `src/index.ts` for six waves, because a docblock is not a gate.
+ *
+ * ## `exit` rides WITH the copy, deliberately
+ *
+ * `EXIT.empty` (4) already exists and its docblock already carries the reason:
+ * collapsing an empty window into `1` teaches a wrapper that absence of a record
+ * means the tool broke — one `||` away from the permanently BLOCKED claim that
+ * absence of an edge means no agent was involved. This task adds no exit code;
+ * it makes five screens use the one that exists. Binding it to the state is the
+ * only way that survives four builders across three waves — a builder who
+ * renders the state gets the code with it, instead of reading a sentence that
+ * asks them to remember.
+ *
+ * ## ⚠ AN EMPTY WINDOW RENDERS NO NUMBER — D67 RESOLVED FOR THIS CASE
+ *
+ * D67 cleared the §PS6 durability block *on its stated terms*: the metric, the
+ * coverage percentage and the grade mix render **TOGETHER**, per grade, never
+ * blended, ref named inline. **On an empty window there is no metric, so
+ * "together or not at all" resolves to NOT AT ALL.** Neither `report` state
+ * carries a percentage, a grade mix, or any durability vocabulary:
+ *
+ *   - **State 3's denominator is zero.** A percentage over an empty denominator
+ *     is not a small number, it is NOT A NUMBER — and `0%` there would be a
+ *     coverage claim manufactured from no data. That is D98's plausible-wrong-
+ *     answer class exactly: a call that fails announces itself, a call that
+ *     returns a plausible answer is absorbed by the caller, and `0%` has no
+ *     obviously-broken shape.
+ *   - **State 4's numerator is zero over a real denominator**, so `0%` is
+ *     arithmetically defensible — and there is still no grade mix to render
+ *     beside it, because a grade mix over zero edges is empty. D67's rule is
+ *     that the three render together or the block does not lift. They cannot.
+ *     So state 4 renders no number either.
+ *
+ * Consequently `claims.ts`'s `durable` / `durability` / `survives` rows stay
+ * BLOCKED on the `report` surface and that is correct, not an oversight.
+ *
+ * ## ⚠ A CONTRACT ON THE CALLER (`CR-108`, W10): ESTABLISH THE CLONE IS COMPLETE
+ *
+ * **The caller MUST establish that the clone is complete before selecting either
+ * `report` empty state.** D67: on a shallow clone the metric REFUSES to render,
+ * and that refusal is load-bearing rather than defensive — it is what keeps the
+ * number from being quietly wrong in CI containers, which is where shallow
+ * clones live. The refusal fires BEFORE either empty state is reachable, and it
+ * has to: on a shallow clone *"no commits in this window"* is a claim the clone
+ * cannot support, because the window may simply predate the graft boundary.
+ *
+ * State 3's sentence is therefore written UNQUALIFIED, as if the clone were
+ * complete — because the refusal guarantees it is. `test/copy-absence.test.ts`
+ * pins both halves: that this contract is stated here, and that no state hedges
+ * about clones.
+ *
+ * ⚠ **A shallow-clone refusal is a REFUSAL, not an absence. It is NOT a state
+ * here and one may not be written for it.** Inventing a phrasing for something
+ * that is not an empty RESULT is the thing this set exists to prevent.
+ *
+ * ⚠⚠ THIS PARAGRAPH SAID "NOT A SIXTH STATE" AND THE SET IS NOW SIX. The
+ * sentence was right about its subject and wrong as a general rule, so it is
+ * narrowed rather than deleted — the bar is not "five forever", it is that a
+ * state here must be an EMPTY RESULT the server actually reports, not a local
+ * refusal and not a rephrasing of one that exists. `edgeUnreadable` (`U1`,
+ * 2026-08-30) clears that bar: mcp emits `edge_unreadable` as a distinct wire
+ * state, and no other entry can render it without asserting something false.
+ * A shallow-clone refusal still fails the bar, for the reason above.
+ */
+/**
+ * The six states. A name per state, so the set can be asserted exactly.
+ *
+ * ⚠ Adding one means updating `EXPECTED_STATES` in `test/copy-absence.test.ts`
+ * in the same commit, which is deliberate: that cell exists so a state cannot
+ * appear without a reviewer reading the argument for it.
+ */
+export type AbsenceStateName = "coldStart" | "noEdge" | "edgeUnreadable" | "reportNoCommits" | "reportNoSessions" | "squashResolved";
+/**
+ * A field is a plain string, or a template when the grammar needs a value
+ * interpolated — the cause clause is window- and ref-relative, so two states
+ * cannot be plain strings without dropping the very thing that makes them a
+ * cause. **That is the GRAMMAR's requirement (state the cause), not D67's metric
+ * rule**: a named ref here is not a smuggled durability claim, and a later
+ * reader should not mistake it for one.
+ */
+export type AbsenceField = string | ((...args: string[]) => string);
+export interface AbsenceState {
+    /** The absence. What is not there. */
+    readonly what: AbsenceField;
+    /** The cause. Why it is not there. Never blank. */
+    readonly why: AbsenceField;
+    /** What would change it. "Nothing to fix" is a legitimate answer; blank is not. */
+    readonly fix: AbsenceField;
+    /** Always `EXIT.empty`. Absence is not failure — see the note above. */
+    readonly exit: typeof EXIT.empty;
+}
+export declare const ABSENCE: {
+    /**
+     * 1 — COLD START. Owner: `CR-086` (W9), and `CR-086` CORRECTED ITS SCOPE.
+     *
+     * ## ⚠ It said MACHINE; the state it names is a REPOSITORY
+     *
+     * The shipped text was *"No sessions have been recorded on this MACHINE
+     * yet"*, and neither half of that survived measurement. `why`'s answer is
+     * repository-scoped — the payload that selects this state answers for one
+     * repo — and a developer with capture running in three repos and none here
+     * would have been told capture had never run at all. Nothing in the client
+     * holds a machine-wide "never captured" fact either: `state.ts` keys sends by
+     * project.
+     *
+     * ## Why it does not render §10.6-A's two extra facts, and that is deliberate
+     *
+     * §10.6-A and §R3 draw *"That commit predates capture on this repo (first
+     * capture 2026-08-08). … 14 commits captured since."* **Both numbers are
+     * facts this client does not hold.** `state.ts` records `lastSendForRepo` —
+     * the LAST send, never a FIRST-capture date — and the commit count is
+     * `commit_coverage`'s, a server figure behind `CR-085`. D81's order applies:
+     * make the claim honest before building the mechanism.
+     *
+     * So the state says the thing that IMPLIES §10.6-A's headline without
+     * asserting either number: **if no session was ever recorded for this
+     * repository, then every commit in it predates capture** — including this
+     * one. That is §10.6-A's meaning, carried by a fact the payload can state.
+     * The date and the count are registered as owed (see the PR) rather than
+     * approximated, because a first-capture date guessed from a last-send record
+     * is D98's plausible-wrong-answer class exactly.
+     *
+     * ⚠ NO SIXTH STATE WAS ADDED, and none may be: `test/copy-absence.test.ts`
+     * asserts the EXACT set of five.
+     */
+    readonly coldStart: {
+        readonly what: "No session has been recorded for this repository yet.";
+        readonly why: "Capture has not sent anything for this repository, so no commit in it has a conversation record — including this one.";
+        readonly fix: "Connect this repository, then work as usual:";
+        readonly exit: 4;
+    };
+    /**
+     * 2 — NO-EDGE EMPTY. Capture is working; the commit `git blame` returned has
+     * no edge. Owner: `CR-086` (W9).
+     *
+     * ⚠ The `why` states a DEFINITION, not a diagnosis. "This commit was made
+     * without an agent" is the permanently BLOCKED claim (see `exit.ts`), and a
+     * sentence guessing at the cause of one absent record is one edit away from
+     * it. What is safe is what makes a record exist at all.
+     */
+    readonly noEdge: {
+        readonly what: "No recorded session is linked to this commit.";
+        readonly why: "A commit is linked to a session only when capture was running for the session that produced it. This is a missing record, not a finding about the commit.";
+        readonly fix: "Nothing to fix. A record cannot be added to a commit after the fact.";
+        readonly exit: 4;
+    };
+    /**
+     * 3 — `report` EMPTY WINDOW A: NO COMMITS. Owner: `CR-108` (W10).
+     *
+     * Names the WINDOW and the REF, because the answer is relative to both: there
+     * may be commits on another branch, or outside these dates, and a sentence
+     * that named neither would read as a claim about the repository.
+     *
+     * Written unqualified — see the clone contract above.
+     */
+    readonly reportNoCommits: {
+        readonly what: (ref: string, window: string) => string;
+        readonly why: (ref: string) => string;
+        readonly fix: "Widen the window, or name a different ref, and run this again.";
+        readonly exit: 4;
+    };
+    /**
+     * 4 — `report` EMPTY WINDOW B: COMMITS, NO SESSIONS. Owner: `CR-108` (W10).
+     *
+     * ⚠ 3 and 4 are DIFFERENT FACTS and collapsing them reads as a coverage claim
+     * we cannot make. The counted commits are the whole difference: this window
+     * has them and has no session for them, which is not the same as having
+     * nothing in it.
+     */
+    readonly reportNoSessions: {
+        readonly what: (count: string, window: string) => string;
+        readonly why: "A commit has a recorded session only when capture was running for the session that produced it. The window bounds this answer.";
+        readonly fix: "Work with capture on, then run this again over a window that includes those commits.";
+        readonly exit: 4;
+    };
+    /**
+     * 5 — SQUASH-RESOLVED. `git blame` returns the squashed SHA on `main` while
+     * every edge we hold binds a pre-squash original. Owner: `CR-109`.
+     *
+     * ⚠ D65 §DR5: if the blamed SHA is not a SHA we hold an edge for, the header
+     * MAY NOT claim the transcript recorded it. **Both SHAs render** — a
+     * single-SHA sentence here is exactly the overclaim this state exists to
+     * prevent. This is GitHub's DEFAULT merge button, so it is the common path.
+     */
+    readonly squashResolved: {
+        readonly what: (blamed: string, recorded: string) => string;
+        readonly why: (blamed: string) => string;
+        readonly fix: "Nothing to fix. Read the session as the record of the original commit.";
+        readonly exit: 4;
+    };
+    /**
+     * 6 — EDGE UNREADABLE. ⛔ THE SET IS NOW SIX, AND THIS IS THE FIRST ADDITION.
+     * Owner: `U1`. ⛔ **FOUNDER-RATIFIED, 2026-08-31 — `D203`.** Not an
+     * implementer's judgement call: three independent tripwires forbade a sixth
+     * state, they all fired, and the decision to clear them was put to the
+     * founder and ruled rather than argued past. `D203` carries the reasoning and
+     * the cost that was spent (reversibility — a field promotes to a state later,
+     * a shipped state does not un-ship).
+     *
+     * ⚠ The tripwires are CLOSURE TRIPWIRES, not a cap, and they did exactly what
+     * they exist for: this state could not enter the set without a reviewer being
+     * made to read the argument for it.
+     *
+     * ## ⚠ THIS IS THE ONE ABSENCE STATE THAT IS NOT AN ABSENCE OF RECORD
+     *
+     * The other five say some version of "we hold nothing here". This one says
+     * the OPPOSITE: **we hold a link for this commit and could not render the
+     * conversation behind it.** Reading it as "no session" inverts it.
+     *
+     * It exists because mcp used to return `no_edge` for this case, which
+     * reported "this repository is captured and this commit has no linked
+     * session" about a commit we demonstrably hold a link for — a false negative
+     * on the only question `why` asks. `blame.ts` now emits `edge_unreadable`
+     * and this is its rendering.
+     *
+     * ⚠ IT IS THE DIRECT-EDGE TWIN OF `squashResolved`, which already carries
+     * exactly this shape one hop later (a mapping we resolved whose evidence will
+     * not render). Same fact, different route to it. That symmetry is the reason
+     * this is a sixth state rather than a caveat note: `attributionNote`'s shape
+     * is a caveat on a screen WITH content, and this screen has none.
+     *
+     * ## ⚠ THE `fix` MAY NOT PROMISE A REPAIR
+     *
+     * CR-112 requires the remedy to say what would CHANGE the state, and here the
+     * honest answer is often "nothing the reader can do": if the turn content was
+     * erased, or was never uploaded, the evidence is gone and the link stays.
+     * Saying "re-run capture" would be a plausible-wrong-answer (D98) — it
+     * repairs neither case. So the line states the two conditions and stops.
+     *
+     * ⚠ NOT "corrupt", "lost", or "missing data" — all three are diagnoses of a
+     * cause this client did not measure. What we know is that the server held a
+     * link and returned no readable turns; the reason is the server's and is not
+     * on the wire.
+     */
+    readonly edgeUnreadable: {
+        readonly what: "A recorded session is linked to this commit, but its conversation could not be read.";
+        readonly why: "The link between this commit and a session is on record. The turns behind that link came back without readable content, so there is a record here and no conversation to show for it. This is a gap in what can be displayed, not a missing link.";
+        readonly fix: "Nothing to fix from here. Turn content can be unreadable because it was erased on request or was never uploaded, and neither is repaired by re-running capture.";
+        readonly exit: 4;
+    };
+};
+/** Failure-class copy (CR-018). Three classes: later / never / fatal. */
+export declare const ERRORS: {
+    readonly notConnected: "This repository is not connected. Run `vibecommit connect`.";
+    readonly networkLater: "Could not reach VibeCommit. This session will be recorded on the next turn.";
+    readonly authFatal: "VibeCommit could not authenticate. Run `vibecommit connect` to reconnect.";
+    readonly payloadNever: "This session was too large to record and has been skipped.";
+    readonly notAGitRepo: "Not a git repository.";
+};
+/**
+ * The interactive top-level catch (CR-022).
+ *
+ * **The hook half of the contract does not apply here** (D61 round 3 §D8). A hook
+ * swallows everything and exits 0 because a non-zero hook derails the developer's
+ * live turn; an interactive verb that did the same would report success for work
+ * it did not do. So an unexpected exception gets §13.6's shape — what, why, fix —
+ * and exit 1.
+ *
+ * ⚠ The `why` line says only what we actually know. "Nothing was uploaded" would
+ * be a claim, not a fact: an exception can land after a send, and copy that
+ * guesses in the reassuring direction is the failure the claims register exists
+ * to stop.
+ */
+export declare const INTERNAL: {
+    readonly unexpectedWhat: "VibeCommit stopped on an unexpected error.";
+    readonly unexpectedWhy: "The command did not finish.";
+    readonly unexpectedFix: "Run it again with the error detail shown:";
+    readonly unexpectedDebugCommand: "VIBECOMMIT_DEBUG=1 vibecommit <command>";
+};
+/**
+ * Credential-loading failures (CR-016).
+ *
+ * §13.6's shape — what, why, fix, fix last. **The `what` line never has "you" as
+ * its subject** and never carries a bare HTTP status. None of these strings
+ * contains any part of a credential, and none can: the plaintext only leaves
+ * `IngestCredential` through `expose()`, which no copy path calls.
+ */
+export declare const CREDENTIAL: {
+    readonly wrongClassWhat: "The credential set for this machine is not an ingest credential.";
+    readonly wrongClassEnvWhy: "VIBECOMMIT_TOKEN is set, but its value is not a VibeCommit ingest credential. It was not sent anywhere.";
+    readonly wrongClassFileWhy: "The credential on disk is not a VibeCommit ingest credential. It was not sent anywhere.";
+    readonly wrongClassFix: "Mint a fresh one:";
+    readonly insecureFileWhat: "The credential file is readable by other accounts on this machine.";
+    readonly insecureFileWhyLabel: "file";
+    readonly insecureFileModeLabel: "mode";
+    readonly insecureFileWhy: "It was not read. A credential file must be readable only by its owner.";
+    readonly insecureFileFix: "Restore the mode, then reconnect:";
+    readonly unreadableWhat: "The credential file could not be read.";
+    readonly unreadableWhy: "It exists but does not contain a credential in the expected form.";
+    readonly unreadableFix: "Replace it by reconnecting:";
+};
+/**
+ * The Node floor (D57 plan §DX11). `NODE_FLOOR_TEXT` and the running version are
+ * interpolated by the caller so there is still exactly one copy of the sentence.
+ */
+export declare const RUNTIME: {
+    readonly floorWhat: "VibeCommit needs a newer Node.";
+    readonly floorWhyPrefix: "This package requires Node";
+    readonly floorWhyMiddle: "or newer. It is running on Node";
+    readonly floorFix: "Upgrade Node, then run:";
+};
+/**
+ * The `systemMessage` channel — style guide §10.1, three states, once per
+ * session (D57 plan §DX3).
+ *
+ * ⚠ Four rules that are easy to break and expensive to notice:
+ *   1. ONE LINE each. Two lines in an agent transcript reads as tool noise and
+ *      gets tuned out, which returns us to the failure DX3 exists to fix.
+ *   2. NO SGR ESCAPES, ever. This is a JSON string field rendered by Claude
+ *      Code's own UI; embedded escapes are undefined behaviour (DESIGN.md §13.9).
+ *   3. All three are FAILURE states. The positive fourth state (`capture
+ *      confirmed`) is `CR-023`, and it is a two-clause amendment — it inverts
+ *      "stdout empty on the happy path". Do not add it here as if it were a
+ *      shape-preserving addition.
+ *   4. No URL longer than the line.
+ */
+export declare const SYSTEM_MESSAGE: {
+    readonly notConnected: "VibeCommit is installed but not connected. Run `vibecommit connect` to start capturing.";
+    readonly credentialRevoked: "VibeCommit capture stopped: this machine's credential was revoked. Run `vibecommit connect`.";
+    /** Templated on both versions — style guide §10.1 state 3. */
+    readonly unsupportedRuntime: (floor: string, running: string) => string;
+    /**
+     * State 4 — style guide §10.1, and the ONLY positive one. `CR-023d`.
+     *
+     * Templated on the URL rather than inlining it, for the same reason
+     * `unsupportedRuntime` is templated: `URLS` is declared below this object, so
+     * a direct reference would read it in its temporal dead zone.
+     *
+     * ⚠ The style guide's example ends `.../app/commits/a8f2c91`, which is
+     * ILLUSTRATIVE and not constructible here. A hook cannot know which commit a
+     * session will resolve to — that mapping happens server-side and
+     * asynchronously, long after this process has exited — so the generic
+     * dashboard URL is substituted. See the PR.
+     *
+     * Claims-register: "captured" is not a blocked phrase, and it is a weaker
+     * claim than the register's own boundary line ("the record is append-only for
+     * users and its hash chain detects post-write tampering").
+     */
+    readonly captureConfirmed: (dashboardUrl: string) => string;
+};
+/**
+ * The out-of-tree redaction marker — `CR-024d`, D57 §OV8d.
+ *
+ * User-visible: it lands in the record a customer reads back, so it clears
+ * `docs/claims-register.md`. It says WHAT HAPPENED and nothing about how safe
+ * anything is — no *secure / safe / protected / private / encrypted* — and it
+ * claims no completeness, because OV8d's redaction is explicitly PARTIAL
+ * (`capture-refactor-three-buyers.md`:387) and "complete / all / every" is a
+ * blocked claim unless the count and the selection rule render inline.
+ *
+ * The byte count IS the count rendering inline, and "outside this repository"
+ * is the selection rule. Both are literally true of the span replaced.
+ *
+ * Shape borrowed from the server scrubber's `[REDACTED:<kind>]` — read for its
+ * shape only, never imported: this package is MIT and `vibecommit-mcp` is
+ * closed, so lifting code across would be a licensing violation (D60 §D1a).
+ */
+export declare const REDACTION: {
+    /** Padded to the exact byte length of what it replaces — see `redact.ts`. */
+    readonly head: (bytes: number) => string;
+    /** Fill between head and tail. ASCII, one byte per column. */
+    readonly fill: ".";
+    readonly tail: "]";
+    /** For spans too short for the counted form. */
+    readonly short: "[OUT-OF-TREE]";
+};
+/** Commands the copy points at. One definition, so a rename cannot half-land. */
+export declare const COMMANDS: {
+    readonly connect: "vibecommit connect";
+    /** `CR-084d`. A FLAG, not a verb — `--help`'s verb list and its golden file do not move. */
+    readonly signIn: "vibecommit connect --sign-in";
+    readonly status: "vibecommit status";
+    /**
+     * `CR-108`. The ARGUMENT SHAPE, shown once so the usage error and the retry
+     * fix line cannot drift apart — the same convention `why` uses.
+     */
+    readonly report: "vibecommit report --since 2026-07-08";
+    /** The ref form, for the detached-HEAD refusal. */
+    readonly reportRef: "vibecommit report --since 2026-07-08 --ref main";
+    readonly off: "vibecommit off";
+    /**
+     * `CR-086`. The ARGUMENT SHAPE, shown once so the usage error and the retry
+     * fix line cannot drift apart. There is no argument parser in this package —
+     * `connect` reads `argv.includes("--sign-in")` and that is the whole
+     * convention — so `file:line` is the smallest shape that satisfies the
+     * verbatim-approved `--help` sentence, and it is the form editors and `grep`
+     * already print.
+     */
+    readonly why: "vibecommit why src/auth/session.ts:47";
+    readonly chmodCredentials: "chmod 600 ~/.vibecommit/credentials.json";
+    /**
+     * ⛔ THE INSTALL COMMAND, TRANSCRIBED FROM `claude-plugin/README.md:12` — and
+     * it is deliberately NOT an invented update verb (`U1`, 2026-08-30).
+     *
+     * The skew remedy wants "get a newer client". There is **no documented update
+     * command anywhere in this product**: grepped `claude-plugin/README.md`, its
+     * manifests, and this package — the README documents `marketplace add` and
+     * `install`, and nothing else. Printing `/plugin update vibecommit` because it
+     * reads plausibly is D98's class exactly: a command-shaped string that may not
+     * exist, handed to a user who is already stuck.
+     *
+     * So the fix line names the install command that IS documented, and
+     * `WHY.skewFix` is worded as REINSTALL rather than update, which is true of
+     * this string. ⚠ If a real update verb is ever documented, change both
+     * together — the wording and the command are one unit.
+     */
+    readonly pluginInstall: "/plugin install vibecommit@vibecommit-capture";
+};
+/**
+ * Every URL the CLI prints. Here rather than inline for the same reason as the
+ * rest: a link is user-visible copy, the claims gate can only check what it can
+ * find, and `CR-114` is moving `/app`'s information architecture underneath us.
+ */
+export declare const URLS: {
+    readonly dashboard: "https://vibecommit.ai/app";
+    readonly settings: "https://vibecommit.ai/app/settings";
+    /**
+     * The captures INDEX — `CR-025`. Style guide §10.2 draws
+     * `/app/commits/<a-sha>`, and that route DOES NOT EXIST: `CR-114` (W3) created
+     * `app/app/commits/page.tsx`, a flat index, with no `[sha]` segment and no
+     * rewrite, so a per-commit URL 404s. Verified against `vibecommit-web`
+     * `origin/main` rather than assumed.
+     *
+     * Printing a URL that 404s at the moment of highest trust is the specific
+     * failure this ending exists to avoid. `CR-101` (W10) adds the detail page;
+     * deepening this constant is that task's, not a later guess.
+     */
+    readonly commits: "https://vibecommit.ai/app/commits";
+    /**
+     * Where an org member goes to see their pending capture request — `CR-110`.
+     *
+     * ⚠ VERIFIED BY FILE, NOT BY PROBE. Every `/app/*` path on that site returns
+     * an identical 307 whether or not the route exists, so a 307 is NEVER evidence
+     * a route is real. This one was confirmed by reading
+     * `vibecommit-web/app/app/settings/capture-access/page.tsx` on `origin/main`,
+     * with `app/api/capture-access/{policy,decide}/route.ts` beside it (`CR-035c`).
+     *
+     * Deeper than the style guide's drawn `/app`, deliberately: the beat's whole
+     * job is to be actionable, and the generic dashboard does not show the request.
+     */
+    readonly captureAccess: "https://vibecommit.ai/app/settings/capture-access";
+    /**
+     * The public bundle that vendors the exact binary — `CR-111d`, D20, D64.
+     *
+     * ⚠ THE ONLY HONEST TRUST OFFER LEFT. D64 made `vibecommit-capture` PRIVATE
+     * (MIT intact — the licence is the invariant, the visibility is not), so
+     * linking this repo would be linking a 404 and claiming readable source would
+     * be false. D20 keeps `claude-plugin` public non-negotiably.
+     *
+     * ⚠ AND THE SENTENCE BESIDE IT IS ONLY TRUE ONCE `CR-029e` LANDS. Measured at
+     * `claude-plugin` `1349896`, `bin/` was vendored from `vibecommit-capture`
+     * `8e772f1` — nine commits and eight tasks behind, with no `redact.js` at all.
+     * `CR-029e` re-vendors it. Written as §10.2 draws it, with the dependency
+     * disclosed in the PR rather than silently shipped.
+     */
+    readonly pluginBundle: "https://github.com/Vibe-Commit/claude-plugin";
+};