halfcycle 0.3.23 → 0.3.25

package/dist/ci-bind.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ci-bind.d.ts","sourceRoot":"","sources":["../src/ci-bind.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDG;AAEH,OAAO,EAIL,KAAK,cAAc,EACpB,MAAM,yBAAyB,CAAC;AAGjC,yDAAyD;AACzD,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,YAAY,GAAG,IAAI,CAOrE;AAED;;;;;;;;;GASG;AACH,qBAAa,aAAc,SAAQ,KAAK;aAEpB,MAAM,EAAE,MAAM;gBAAd,MAAM,EAAE,MAAM,EAC9B,OAAO,EAAE,MAAM;IAMjB,6EAA6E;IAC7E,IAAI,WAAW,IAAI,OAAO,CAEzB;IAED;;;;;;;;;;;;;;;;;;;OAmBG;IACH,IAAI,WAAW,IAAI,OAAO,CAEzB;CACF;AAiFD,qFAAqF;AACrF,wBAAgB,gBAAgB,CAC9B,UAAU,EAAE,MAAM,EAClB,YAAY,EAAE,MAAM,EACpB,UAAU,EAAE,YAAY,EACxB,IAAI,GAAE,cAAmB,GACxB,OAAO,CAAC,IAAI,CAAC,CAEf;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAChC,UAAU,EAAE,MAAM,EAClB,YAAY,EAAE,MAAM,EACpB,UAAU,EAAE,YAAY,EACxB,IAAI,GAAE,cAAmB,GACxB,OAAO,CAAC,IAAI,CAAC,CAEf"}

package/dist/cli-contract.d.ts

@@ -2,6 +2,16 @@
  * What each `halfcycle` verb REQUIRES — declared once, enforced from the
  * declaration (walk 8 `F-5`, W8-T-02).
  *
+ * **EVERY `missingMessage` BELOW IS PRINTED INTO A CLIENT'S TERMINAL**, and this
+ * file is bundled verbatim into the published entry, so none of them may carry an
+ * invariant id, a `packages/*` path, an issue number or the org name — an id
+ * points into a register a client cannot open. The rules the messages carry are
+ * named HERE instead: `--verdict` is the acceptance walk's own verdict (INV-009),
+ * which is why nothing derives it. A leading docblock is the right home because
+ * esbuild drops it; an id in a comment BESIDE a property survives into the
+ * published file, which is the trap `published-entry-vocabulary.test.ts` exists
+ * to catch.
+ *
  * ---
  *
  * **Why this file exists.** `orchestrator.ts` in the control plane printed
@@ -52,7 +62,7 @@
  * home is the failure mode it exists to prevent.
  */
 /** The verbs the CLI dispatches. Anything else after `halfcycle ` is unknown. */
-export declare const CLI_VERBS: readonly ["install", "check-drift", "build-record", "open-phase", "close-phase"];
+export declare const CLI_VERBS: readonly ["install", "check-drift", "build-record", "open-phase", "close-phase", "ci"];
 export type CliVerb = (typeof CLI_VERBS)[number];
 /** A flag every invocation of the verb must carry. */
 export interface RequiredFlag {

package/dist/cli-contract.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli-contract.d.ts","sourceRoot":"","sources":["../src/cli-contract.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoDG;AAEH,iFAAiF;AACjF,eAAO,MAAM,SAAS,kFAAmF,CAAC;AAE1G,MAAM,MAAM,OAAO,GAAG,CAAC,OAAO,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC;AAEjD,sDAAsD;AACtD,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,2DAA2D;IAC3D,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,+EAA+E;IAC/E,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;CACjC;AAED,iDAAiD;AACjD,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;CACjC;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,QAAQ,EAAE,SAAS,YAAY,EAAE,CAAC;IAC3C,QAAQ,CAAC,WAAW,EAAE,SAAS,eAAe,EAAE,CAAC;CAClD;AA0ED,6EAA6E;AAC7E,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,YAAY,GAAG,SAAS,CAElE;AAED,iDAAiD;AACjD,MAAM,WAAW,SAAS;IACxB,kEAAkE;IAClE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,oCAAoC;IACpC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAmBD;;;;;;;;;;;GAWG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,EAAE,CAyBxF;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAMtE;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAMvE"}
+{"version":3,"file":"cli-contract.d.ts","sourceRoot":"","sources":["../src/cli-contract.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8DG;AAEH,iFAAiF;AACjF,eAAO,MAAM,SAAS,wFAAyF,CAAC;AAEhH,MAAM,MAAM,OAAO,GAAG,CAAC,OAAO,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC;AAEjD,sDAAsD;AACtD,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,2DAA2D;IAC3D,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,+EAA+E;IAC/E,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;CACjC;AAED,iDAAiD;AACjD,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;CACjC;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,QAAQ,EAAE,SAAS,YAAY,EAAE,CAAC;IAC3C,QAAQ,CAAC,WAAW,EAAE,SAAS,eAAe,EAAE,CAAC;CAClD;AAkFD,6EAA6E;AAC7E,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,YAAY,GAAG,SAAS,CAElE;AAED,iDAAiD;AACjD,MAAM,WAAW,SAAS;IACxB,kEAAkE;IAClE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,oCAAoC;IACpC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAmBD;;;;;;;;;;;GAWG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,EAAE,CAyBxF;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAMtE;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAMvE"}

package/dist/confirm-identity.d.ts

@@ -145,6 +145,49 @@ export interface ConfirmIdentityDeps extends ResolveOptions {
     /** The `fetch` used to ask the plane who this credential is. Defaults to global. */
     fetchImpl?: typeof fetch;
 }
+/**
+ * Everything one `GET /account` said: who the credential belongs to, and whether
+ * the plane refused it.
+ *
+ * TWO FACTS FROM ONE CALL, which is the whole reason this shape exists. The
+ * installer's re-use arm needs the refusal to decide, and the report four hundred
+ * lines later needs the identity to print — and they are the same call. Fetching
+ * twice is what `identity-not-refetched.test.ts` exists to refuse, and it would
+ * also double what a machine with no network waits before either question is
+ * answered.
+ */
+export interface AccountAnswer {
+    /**
+     * The identity, when the plane named one. `undefined` on EVERY failure, exactly
+     * as `describeAccount` returns it — this field is that function's whole result.
+     */
+    readonly identity: AccountIdentity | undefined;
+    /**
+     * True iff a response arrived AND its status was `401`.
+     *
+     * **Not `identity === undefined`, and the gap between the two is the point.** A
+     * timeout, a `503`, an unparseable body and an unreachable host all leave
+     * `identity` undefined with `refused` false: nothing was said about the
+     * credential, so nothing may be concluded about it. Only this field may steer a
+     * decision; `identity` may only steer a display line.
+     */
+    readonly refused: boolean;
+}
+/**
+ * Ask the plane about a credential — the ONE composition of `GET /account` in this
+ * package, and the one home for reading its status.
+ *
+ * `describeAccount` below is this function with the status dropped, so there are
+ * not two requests, two timeouts or two readings of what a `401` means. A caller
+ * that has already decided takes `describeAccount`; a caller whose decision this
+ * answer IS takes this one.
+ *
+ * It throws for nothing. A network error, a timeout, a non-200, a body that is not
+ * JSON and a body this contract does not admit all come back as an answer rather
+ * than an exception, because one caller's next line prints a name to a human and
+ * the other's is a re-install that must not fail over a slow service.
+ */
+export declare function askAccount(serviceUrl: string, credential: string, fetchImpl?: typeof fetch): Promise<AccountAnswer>;
 /**
  * Ask the plane whose account a credential is. `undefined` when it will not say.
  *
@@ -153,6 +196,13 @@ export interface ConfirmIdentityDeps extends ResolveOptions {
  * contract does not admit. The caller's next line prints a name to a human — there is no
  * failure of this call that is worth costing a developer their install, and there is no
  * failure of it that may produce a name.
+ *
+ * **THE TOTALITY IS A CONTRACT ITS CALLERS DEPEND ON, AND T-10 DID NOT WEAKEN IT.**
+ * The re-use arm needed a `401` to reach it, and the way that was NOT done is worth
+ * recording: this function did not learn to branch on status or to fail loudly. It
+ * collapses `askAccount`'s answer to its identity, which is what the two callers
+ * here have always wanted, and the caller whose decision the status is calls
+ * `askAccount` directly.
  */
 export declare function describeAccount(serviceUrl: string, credential: string, fetchImpl?: typeof fetch): Promise<AccountIdentity | undefined>;
 /**

package/dist/confirm-identity.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"confirm-identity.d.ts","sourceRoot":"","sources":["../src/confirm-identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkGG;AAGH,OAAO,EAA4B,KAAK,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAInF,OAAO,EAAiB,KAAK,cAAc,EAAE,KAAK,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAKtG,uFAAuF;AACvF,eAAO,MAAM,iBAAiB,sBAAsB,CAAC;AAErD,6CAA6C;AAC7C,MAAM,MAAM,gBAAgB,GAAG,SAAS,GAAG,gBAAgB,GAAG,MAAM,CAAC;AAErE,6FAA6F;AAC7F,MAAM,MAAM,UAAU,GAClB;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GACxD;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;CAAE,CAAC;AAE1F,MAAM,WAAW,mBAAoB,SAAQ,cAAc;IACzD,8DAA8D;IAC9D,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC/B,gFAAgF;IAChF,GAAG,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5C;;;OAGG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,iEAAiE;IACjE,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB;;;;;;;;;OASG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;;OAKG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,oFAAoF;IACpF,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;CAC1B;AAED;;;;;;;;GAQG;AACH,wBAAsB,eAAe,CACnC,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,MAAM,EAClB,SAAS,GAAE,OAAO,KAAa,GAC9B,OAAO,CAAC,eAAe,GAAG,SAAS,CAAC,CAiBtC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,YAAY,CAC1B,QAAQ,EAAE,eAAe,GAAG,SAAS,EACrC,eAAe,EAAE,MAAM,GAAG,SAAS,EACnC,OAAO,UAAQ,GACd,MAAM,CASR;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,OAAO,CAE9E;AA+BD;;;;;;;;;GASG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,gBAAgB,CAK7D;AAgKD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,EAAE,WAAW,EAAE,OAAO,GAAG,MAAM,CAO3F;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,qBAAqB,CACzC,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,kBAAkB,EAC9B,GAAG,EAAE,UAAU,EACf,IAAI,GAAE,mBAAwB,GAC7B,OAAO,CAAC,kBAAkB,CAAC,CAuD7B"}
+{"version":3,"file":"confirm-identity.d.ts","sourceRoot":"","sources":["../src/confirm-identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkGG;AAGH,OAAO,EAA4B,KAAK,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAInF,OAAO,EAAiB,KAAK,cAAc,EAAE,KAAK,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAKtG,uFAAuF;AACvF,eAAO,MAAM,iBAAiB,sBAAsB,CAAC;AAErD,6CAA6C;AAC7C,MAAM,MAAM,gBAAgB,GAAG,SAAS,GAAG,gBAAgB,GAAG,MAAM,CAAC;AAErE,6FAA6F;AAC7F,MAAM,MAAM,UAAU,GAClB;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GACxD;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;CAAE,CAAC;AAE1F,MAAM,WAAW,mBAAoB,SAAQ,cAAc;IACzD,8DAA8D;IAC9D,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC/B,gFAAgF;IAChF,GAAG,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5C;;;OAGG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,iEAAiE;IACjE,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB;;;;;;;;;OASG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;;OAKG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,oFAAoF;IACpF,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;CAC1B;AAeD;;;;;;;;;;GAUG;AACH,MAAM,WAAW,aAAa;IAC5B;;;OAGG;IACH,QAAQ,CAAC,QAAQ,EAAE,eAAe,GAAG,SAAS,CAAC;IAC/C;;;;;;;;OAQG;IACH,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;CAC3B;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,UAAU,CAC9B,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,MAAM,EAClB,SAAS,GAAE,OAAO,KAAa,GAC9B,OAAO,CAAC,aAAa,CAAC,CAiBxB;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,eAAe,CACnC,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,MAAM,EAClB,SAAS,GAAE,OAAO,KAAa,GAC9B,OAAO,CAAC,eAAe,GAAG,SAAS,CAAC,CAEtC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,YAAY,CAC1B,QAAQ,EAAE,eAAe,GAAG,SAAS,EACrC,eAAe,EAAE,MAAM,GAAG,SAAS,EACnC,OAAO,UAAQ,GACd,MAAM,CASR;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,OAAO,CAE9E;AA+BD;;;;;;;;;GASG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,gBAAgB,CAK7D;AAgKD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,EAAE,WAAW,EAAE,OAAO,GAAG,MAAM,CAO3F;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,qBAAqB,CACzC,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,kBAAkB,EAC9B,GAAG,EAAE,UAAU,EACf,IAAI,GAAE,mBAAwB,GAC7B,OAAO,CAAC,kBAAkB,CAAC,CAuD7B"}

package/dist/create-engagement.d.ts

@@ -61,11 +61,22 @@
  * variable points at the wrong half used to get a bare 404 and no way to tell
  * which half of a two-service platform they had missed.
  *
- * INV-001: this file imports the global `fetch` (Node 20) and one bundle-internal
+ * INV-001: this file imports the global `fetch` (Node 20), one bundle-internal
  * constant (`DEFAULT_CONTROL_ORIGIN`, so the wrong-origin sentence names the same
- * plane the installer actually calls rather than a second copy of the address).
- * It never imports the control service — the create endpoint is an external HTTP
- * contract, exactly like the runner is an external binary contract.
+ * plane the installer actually calls rather than a second copy of the address), and
+ * `@halfcycle/events` — one of the exactly two workspace packages a shippable may
+ * import. It never imports the control service — the create endpoint is an external
+ * HTTP contract, exactly like the runner is an external binary contract.
+ *
+ * **THE SUCCESS BODY IS A DECLARED SHAPE SINCE T-04 (`credential-lifecycle`), AND
+ * THIS FILE NO LONGER DECIDES WHAT ITS KEYS ARE.** It was a route-level literal read
+ * here by hand, which was the right posture while exactly one package parsed it; the
+ * runner now parses the same body to refresh a timed-out token
+ * (`engagement-token-silent-refresh`), so INV-003 applies and
+ * `engagementCredentialResponseSchema` (`packages/events/src/credential-wire.ts`) is
+ * its one home. What stays here is what that declaration deliberately does not
+ * decide — whether a value it was handed is USABLE — and the named sentences that
+ * say so. See `requestEngagementValues`.
  */
 /** The four values `POST /engagements` returns (Option A — the session credential
  *  crosses once on create; `mcpUrl` and `guardUrl` are the server declaring where

package/dist/create-engagement.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"create-engagement.d.ts","sourceRoot":"","sources":["../src/create-engagement.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoEG;AAIH;;oCAEoC;AACpC,MAAM,WAAW,iBAAiB;IAChC,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB;;;;;;;;;;;OAWG;IACH,MAAM,EAAE,MAAM,CAAC;IACf;;;;;;;;;;;;;;;;;OAiBG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;;;;;;;;;;;;;;;OAkBG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,qBAAa,uBAAwB,SAAQ,KAAK;IAE9C,6CAA6C;aAC7B,MAAM,EAAE,MAAM;IAC9B,8DAA8D;aAC9C,aAAa,EAAE,MAAM;IACrC,+DAA+D;aAC/C,SAAS,EAAE,MAAM,GAAG,SAAS;IAC7C;;;;;;;;;;;;OAYG;aACa,MAAM,EAAE,MAAM,GAAG,SAAS;;IAnB1C,6CAA6C;IAC7B,MAAM,EAAE,MAAM;IAC9B,8DAA8D;IAC9C,aAAa,EAAE,MAAM;IACrC,+DAA+D;IAC/C,SAAS,EAAE,MAAM,GAAG,SAAS;IAC7C;;;;;;;;;;;;OAYG;IACa,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1C,OAAO,EAAE,MAAM;IAMjB;;;;;;;;;;;;;;;;;;OAkBG;IACH,IAAI,WAAW,IAAI,OAAO,CAGzB;CACF;AA4ED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AACH,wBAAsB,gBAAgB,CACpC,OAAO,EAAE,MAAM,EACf,IAAI,CAAC,EAAE,MAAM,EACb,UAAU,CAAC,EAAE,MAAM,EACnB,WAAW,CAAC,EAAE,MAAM,GACnB,OAAO,CAAC,iBAAiB,CAAC,CAU5B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,wBAAsB,cAAc,CAClC,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,MAAM,EACpB,UAAU,CAAC,EAAE,MAAM,GAClB,OAAO,CAAC,iBAAiB,CAAC,CAW5B"}
+{"version":3,"file":"create-engagement.d.ts","sourceRoot":"","sources":["../src/create-engagement.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+EG;AAKH;;oCAEoC;AACpC,MAAM,WAAW,iBAAiB;IAChC,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB;;;;;;;;;;;OAWG;IACH,MAAM,EAAE,MAAM,CAAC;IACf;;;;;;;;;;;;;;;;;OAiBG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;;;;;;;;;;;;;;;OAkBG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,qBAAa,uBAAwB,SAAQ,KAAK;IAE9C,6CAA6C;aAC7B,MAAM,EAAE,MAAM;IAC9B,8DAA8D;aAC9C,aAAa,EAAE,MAAM;IACrC,+DAA+D;aAC/C,SAAS,EAAE,MAAM,GAAG,SAAS;IAC7C;;;;;;;;;;;;OAYG;aACa,MAAM,EAAE,MAAM,GAAG,SAAS;;IAnB1C,6CAA6C;IAC7B,MAAM,EAAE,MAAM;IAC9B,8DAA8D;IAC9C,aAAa,EAAE,MAAM;IACrC,+DAA+D;IAC/C,SAAS,EAAE,MAAM,GAAG,SAAS;IAC7C;;;;;;;;;;;;OAYG;IACa,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1C,OAAO,EAAE,MAAM;IAMjB;;;;;;;;;;;;;;;;;;OAkBG;IACH,IAAI,WAAW,IAAI,OAAO,CAGzB;CACF;AA4ED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AACH,wBAAsB,gBAAgB,CACpC,OAAO,EAAE,MAAM,EACf,IAAI,CAAC,EAAE,MAAM,EACb,UAAU,CAAC,EAAE,MAAM,EACnB,WAAW,CAAC,EAAE,MAAM,GACnB,OAAO,CAAC,iBAAiB,CAAC,CAU5B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,wBAAsB,cAAc,CAClC,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,MAAM,EACpB,UAAU,CAAC,EAAE,MAAM,GAClB,OAAO,CAAC,iBAAiB,CAAC,CAW5B"}

package/dist/device-signin.d.ts

@@ -101,6 +101,19 @@ export interface SignInDeps {
     sleep?: (ms: number) => Promise<void>;
     /** The clock the local deadline is measured on. Defaults to `Date.now`. */
     now?: () => number;
+    /**
+     * What signing in is FOR, spliced into `signIn`'s opening line: "Halfcycle needs
+     * an account before it can **<reason>** — signing you in through your browser."
+     *
+     * DEFAULTS TO THE INSTALL'S OWN REASON, because every caller of `signIn` was the
+     * installer until T-11 (`ci-oidc-token-exchange`) — an install always creates or
+     * joins an engagement immediately after obtaining a credential, so the hardcoded
+     * text was never false. `ci bind`/`ci unbind` create no engagement at all, and are
+     * the first callers for which the default would be — supplied here rather than a
+     * second hardcoded sentence in this file, which is how a caller's reason and this
+     * module's default come to disagree the next time either one changes.
+     */
+    reason?: string;
 }
 /**
  * The platform command that opens a URL in the user's browser, as `{command, args}`.

package/dist/device-signin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"device-signin.d.ts","sourceRoot":"","sources":["../src/device-signin.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4DG;AAIH,OAAO,EAKL,KAAK,uBAAuB,EAC5B,KAAK,kBAAkB,EACxB,MAAM,mBAAmB,CAAC;AAG3B;;;;;;;;GAQG;AACH,qBAAa,aAAc,SAAQ,KAAK;aAEpB,MAAM,EAAE,MAAM;gBAAd,MAAM,EAAE,MAAM,EAC9B,OAAO,EAAE,MAAM;CAKlB;AAED,gFAAgF;AAChF,eAAO,MAAM,iBAAiB,cAAc,CAAC;AAE7C;;;;;;GAMG;AACH,eAAO,MAAM,uBAAuB,QAGV,CAAC;AAE3B;;;;;;;;GAQG;AACH,eAAO,MAAM,+BAA+B,QAGsC,CAAC;AAQnF,yEAAyE;AACzE,MAAM,WAAW,UAAU;IACzB,8DAA8D;IAC9D,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC/B,qDAAqD;IACrD,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACtC,2EAA2E;IAC3E,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAUD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,kBAAkB,CAChC,EAAE,EAAE,MAAM,EACV,GAAG,EAAE,MAAM,GACV;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAE,CAIrC;AAED;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAOlD;AAaD,+DAA+D;AAC/D,MAAM,WAAW,kBAAkB;IACjC,oEAAoE;IACpE,MAAM,EAAE,OAAO,CAAC;IAChB;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,wBAAsB,WAAW,CAC/B,GAAG,EAAE,MAAM,EACX,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,OAAO,CAAC,kBAAkB,CAAC,CAmE7B;AAED,sDAAsD;AACtD,wBAAgB,gBAAgB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,OAAO,CAG9E;AAED,oFAAoF;AACpF,wBAAsB,eAAe,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAsC1F;AAYD;;;;;;;;GAQG;AACH,wBAAsB,iBAAiB,CACrC,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,uBAAuB,EAChC,IAAI,GAAE,UAAe,GACpB,OAAO,CAAC,kBAAkB,CAAC,CAmD7B;AAED,uCAAuC;AACvC,MAAM,WAAW,QAAQ;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,kFAAkF;IAClF,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,wBAAwB,QAIF,CAAC;AAiEpC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,wBAAsB,MAAM,CAC1B,UAAU,EAAE,MAAM,EAClB,IAAI,GAAE,UAAU,GAAG;IAAE,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAA;CAAO,GAClD,OAAO,CAAC,QAAQ,CAAC,CAmFnB"}
+{"version":3,"file":"device-signin.d.ts","sourceRoot":"","sources":["../src/device-signin.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4DG;AAIH,OAAO,EAKL,KAAK,uBAAuB,EAC5B,KAAK,kBAAkB,EACxB,MAAM,mBAAmB,CAAC;AAG3B;;;;;;;;GAQG;AACH,qBAAa,aAAc,SAAQ,KAAK;aAEpB,MAAM,EAAE,MAAM;gBAAd,MAAM,EAAE,MAAM,EAC9B,OAAO,EAAE,MAAM;CAKlB;AAED,gFAAgF;AAChF,eAAO,MAAM,iBAAiB,cAAc,CAAC;AAE7C;;;;;;GAMG;AACH,eAAO,MAAM,uBAAuB,QAGV,CAAC;AAE3B;;;;;;;;GAQG;AACH,eAAO,MAAM,+BAA+B,QAGsC,CAAC;AAQnF,yEAAyE;AACzE,MAAM,WAAW,UAAU;IACzB,8DAA8D;IAC9D,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC/B,qDAAqD;IACrD,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACtC,2EAA2E;IAC3E,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB;;;;;;;;;;;OAWG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAcD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,kBAAkB,CAChC,EAAE,EAAE,MAAM,EACV,GAAG,EAAE,MAAM,GACV;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAE,CAIrC;AAED;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAOlD;AAaD,+DAA+D;AAC/D,MAAM,WAAW,kBAAkB;IACjC,oEAAoE;IACpE,MAAM,EAAE,OAAO,CAAC;IAChB;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,wBAAsB,WAAW,CAC/B,GAAG,EAAE,MAAM,EACX,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,OAAO,CAAC,kBAAkB,CAAC,CAmE7B;AAED,sDAAsD;AACtD,wBAAgB,gBAAgB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,OAAO,CAG9E;AAED,oFAAoF;AACpF,wBAAsB,eAAe,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAsC1F;AAYD;;;;;;;;GAQG;AACH,wBAAsB,iBAAiB,CACrC,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,uBAAuB,EAChC,IAAI,GAAE,UAAe,GACpB,OAAO,CAAC,kBAAkB,CAAC,CAmD7B;AAED,uCAAuC;AACvC,MAAM,WAAW,QAAQ;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,kFAAkF;IAClF,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,wBAAwB,QAIF,CAAC;AAiEpC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,wBAAsB,MAAM,CAC1B,UAAU,EAAE,MAAM,EAClB,IAAI,GAAE,UAAU,GAAG;IAAE,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAA;CAAO,GAClD,OAAO,CAAC,QAAQ,CAAC,CAmFnB"}

package/dist/engagement-credential.d.ts

@@ -73,20 +73,30 @@
  * why `halfcycleHome()` is imported from it rather than re-derived.
  *
  * ---------------------------------------------------------------------------
- * TWO HOMES FOR THIS PATH SHAPE ACROSS THE REPO, AND IT IS A PRESENT CONSTRAINT,
- * NOT AN OVERSIGHT. `packages/mac-workspace-provider/src/registry.ts` has its own
- * `engagementEnvPath()` for the identical path — Studio's writer. `packages/bundle`
- * is shippable and its import allowlist is exactly `{packages/core, packages/events}`
- * (INV-001), and the provider is hosted-only, so the two cannot share a function
- * today. `packages/core` is the one package both may import and is where this
- * belongs eventually; that is the same direction `GUARD_ENV_KEYS`'s docblock in
- * `install.ts` records as #476, and it is deliberately not done mid-wave. What
- * binds the two meanwhile is a test that reads the provider's source text off disk
- * and asserts the shapes agree (`test/credential-out-of-repo.test.ts`) — an `fs`
- * read, not an import, so there is no build edge and nothing crosses the moat.
- *
- * INV-001: Node builtins and this package's own modules only.
+ * THE FORMAT MOVED TO `packages/core`; THE I/O DID NOT (T-01,
+ * `engagement-token-silent-refresh`). `shq`/`unquote`, `parseEnvText`,
+ * `reconcileEnvText`, the header constant and the path SEGMENTS are now defined
+ * once in `@halfcycle/core` and re-exported from here, so this package's import
+ * sites are untouched. Every `readFileSync`/`writeFileSync`/`chmodSync`/`join` in
+ * this file STAYS here: core is transpiled into browser bundles by
+ * `apps/dashboard` and must hold no `node:` import at all, type-only included.
+ *
+ * That hoist is what makes a THIRD writer legal. `packages/runner` is shippable
+ * and may import only `{packages/core, packages/events}` (INV-001), so the refresh
+ * (T-08) reaches this format without reaching this package — and one writer's
+ * bytes are the same bytes whichever wrote them.
+ *
+ * `packages/mac-workspace-provider/src/registry.ts` still keeps its own copy of
+ * the path shape and of `shq` — it is hosted-only and could import core, but that
+ * consolidation is not this task's (#476 remains open for it). What binds Studio's
+ * copy meanwhile is a test that reads source text off disk and asserts the shapes
+ * agree (`test/credential-out-of-repo.test.ts`), and since T-01 the text it reads
+ * is CORE's, not this file's — an `fs` read, not an import, so there is no build
+ * edge and nothing crosses the moat.
+ *
+ * INV-001: Node builtins, `@halfcycle/core` and this package's own modules only.
  */
+export { ENGAGEMENT_ENV_HEADER, ENGAGEMENTS_DIR_NAME, ENGAGEMENT_ENV_FILENAME, HALFCYCLE_DIR_NAME, NOT_THIS_ACCOUNT_MARKER_FILENAME, parseEnvText, shq, unquote, } from '@halfcycle/core';
 /**
  * The field the committed pin (`.halfcycle/bundle.json`) carries the engagement id
  * under. Named once here because BOTH readers of it — `readEngagementCredential`'s
@@ -101,6 +111,29 @@ export declare const PIN_ENGAGEMENT_ID_FIELD = "engagementId";
 export declare function engagementStateDir(engagementId: string, home?: string): string;
 /** `~/.halfcycle/engagements/<id>/env` — the owner-only per-engagement env file. */
 export declare function engagementEnvPath(engagementId: string, home?: string): string;
+/**
+ * WHY THE NOT-THIS-ACCOUNT MARKER IS A FILE OF ITS OWN — the reason record for
+ * outcome B (T-02b, `solo-project-ownership`). The filename itself is one of
+ * core's path segments (`NOT_THIS_ACCOUNT_MARKER_FILENAME`, re-exported above),
+ * because the generated POSIX snippet below composes the same path.
+ *
+ * **BESIDE THE CREDENTIAL STORE, NEVER IN IT AND NEVER IN THE PIN.** S-01's memo
+ * ruled out both other homes and both rulings hold: the committed pin
+ * (`.halfcycle/bundle.json`) travels with the repository, so a flag there would
+ * tell EVERY clone — including the owner's own second machine — that it is not the
+ * owner's; and a ninth key in the credential env file would corrupt
+ * `CREDENTIAL_REQUIRED_KEYS`' conjunction, which is what decides whether a checkout
+ * is treated as holding a credential at all (`install.ts`). This is a THIRD file,
+ * a sentinel whose only fact is its own existence — cheap enough for the generated
+ * shell to test with `[ -f … ]` (see `engagementResolutionShell` below) and for a
+ * Node process to `existsSync` the same way.
+ *
+ * **WHAT IT RECORDS AND WHY THAT IS ENOUGH.** The refusal is permanent for this
+ * machine as this account (retrying cannot change it — only signing in as a
+ * different account can), so the fact is stable for as long as this credential-less
+ * state persists. Its content is a timestamp, for a support conversation; the three
+ * remedy sites that read it (S1/S2/S3) branch on presence alone, never on content.
+ */
 /**
  * `~/.halfcycle/engagements/<id>/not-this-account` — see
  * `NOT_THIS_ACCOUNT_MARKER_FILENAME` above for why this is a third file rather than
@@ -218,78 +251,24 @@ export type EngagementEnvKey = (typeof ENGAGEMENT_ENV_KEYS)[number];
  */
 export declare const PHASE_STAMP_ENV_KEY = "HALFCYCLE_PHASE";
 /**
- * Parse `KEY=value` lines. **PARSES, NEVER SOURCES** — a credential store is not
- * code, and `.` would execute whatever the file happens to contain. An optional
- * leading `export ` is tolerated because the shells that source this file accept
- * one, so a hand-edited store must read the same both ways, and one layer of
- * matching quotes is stripped for the same reason (see the encoding note above).
- *
- * (The one exception is `guard-runner.sh`, which genuinely sources rather than
- * parses: it must EXPORT the values into a child process, which is a thing only the
- * shell can do. That file is generated by us, written `0600` outside every
- * repository, and is Studio's adopted contract — a narrower surface than the
- * developer-editable `.env.local` it replaces.)
- */
-export declare function parseEnvText(raw: string): Record<string, string>;
-/**
- * Reconcile our keys into an existing env-file body BY KEY.
- *
- * Every pre-existing line survives byte-for-byte: a `KEY=value` line whose key is
- * one of ours is updated IN PLACE (so key order is preserved and no duplicate is
- * introduced); one of ours that is absent is appended under the header; and any
- * other line — comments, blanks, a key some other Halfcycle writer put here — is
- * copied through untouched.
- *
- * **`export KEY=` counts as that key.** `parseEnvText` and the installer's legacy
- * migration both tolerate the prefix, and this function did not — so an existing
- * `export HALFCYCLE_TOKEN=old` was left alone and a bare `HALFCYCLE_TOKEN=new`
- * appended below it. Last-assignment-wins meant nothing observably broke, which is
- * why it survived: a superseded token simply stayed on disk, in the one feature
- * whose whole subject is where a credential is allowed to be. The prefix is
- * preserved on the rewritten line rather than normalised away, because "every
- * pre-existing line survives" is the contract and `export` is the developer's.
- *
- * Values are written `shq`-quoted — see the encoding note above; the file is
- * SOURCED by `guard-runner.sh`, so an unquoted value carrying a space executes
- * its own remainder.
- *
- * **The non-destructiveness is not vestigial after the move out of the tree.** This
- * path is Studio's too: `packages/mac-workspace-provider` writes
- * `CONTROL_TELEMETRY_TOKEN` and `HALFCYCLE_GUARD_EVAL_LOG_DIR` into the same file for
- * an engagement it manages. A whole-file overwrite here would silently delete them on
- * any machine where both ever touch one engagement. Reconciling by key costs nothing
- * and removes that whole class.
- *
- * **`CONTROL_TELEMETRY_URL` is deliberately NOT named alongside those two** — this
- * said `CONTROL_TELEMETRY_*` (the whole family) until a T-10 follow-up correction.
- * `CONTROL_TELEMETRY_URL` is one of OURS since T-10 (`ENGAGEMENT_ENV_KEYS` above), so
- * it is reconciled the same as `HALFCYCLE_TOKEN` — updated in place by a Connect
- * install, not preserved as a foreign writer's key. A Studio-written value for it is
- * legitimately overwritten on the next Connect install; only `CONTROL_TELEMETRY_TOKEN`
- * is still genuinely foreign.
- *
- * **A `null` VALUE REMOVES THE KEY'S LINE. An absent one still writes `KEY=''`.**
- * The two are different requests and this function had no way to make the first
- * one: `values[k] ?? ''` mapped both to the empty string, so the only reachable
- * way to "unset" a key was to write it blank. Blank is not absent to any reader of
- * this file — the shell that SOURCES it sets the variable to the empty string, and
- * the Build-Record write predicate refuses an empty phase identity, so a phase
- * stamp cleared by blanking would fire a refusal on the ordinary project-scope
- * return. `open-phase --none` and `close-phase` therefore pass `null` and the
- * assignment leaves the file wherever it sat, `export ` prefix and all. Nothing is
- * appended for a removed key.
- *
- * **The header block is appended AT MOST ONCE per file**, and that follows from the
- * same pair of verbs: `HALFCYCLE_PHASE` leaves on every close and comes back on
- * every open, so a header emitted with each re-appearance would grow the file by a
- * comment block per phase. A file that already carries the header gets the new
- * lines under the one it has.
- *
- * **Appended lines go BEFORE the file's final newline, not after a blank one.** The
- * append used to land after the trailing empty element of the split, which put a
- * blank line above the new block — invisible when a key is written once and never
- * removed, and one blank line per phase once a key comes and goes. The
- * pre-existing text is still an untouched prefix either way.
+ * Reconcile the engagement credential's keys into an existing env-file body.
+ *
+ * **This is core's `reconcileEnvText` with THIS package's key set as the
+ * default, and nothing else.** No logic lives here: the reconciliation — lines
+ * preserved byte-for-byte, `export ` prefixes kept, `null` removing a key, the
+ * header appended at most once, the append landing before the final newline — is
+ * core's, and the runner calls the same function for the same bytes. What the
+ * default adds is the fact that when this package does not say which keys it
+ * owns, it owns the eight credential keys (`ENGAGEMENT_ENV_KEYS`), which is the
+ * installer's call and is not core's to know. Callers passing `keys` explicitly
+ * (the phase stamp's two verbs) are unaffected.
+ *
+ * `CONTROL_TELEMETRY_URL` is one of OURS since T-10 (`ENGAGEMENT_ENV_KEYS`
+ * above), so it is reconciled like `HALFCYCLE_TOKEN` — updated in place by a
+ * Connect install, not preserved as a foreign writer's key. A Studio-written
+ * value for it is legitimately overwritten on the next Connect install; only
+ * `CONTROL_TELEMETRY_TOKEN` and `HALFCYCLE_GUARD_EVAL_LOG_DIR` are still
+ * genuinely foreign, and core's by-key reconcile is what keeps them.
  */
 export declare function reconcileEnvText(existing: string | null, values: Record<string, string | null | undefined>, keys?: readonly string[]): string;
 /**

package/dist/engagement-credential.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"engagement-credential.d.ts","sourceRoot":"","sources":["../src/engagement-credential.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwFG;AAiBH;;;;;;;;GAQG;AACH,eAAO,MAAM,uBAAuB,iBAAiB,CAAC;AAEtD,oFAAoF;AACpF,wBAAgB,kBAAkB,CAAC,YAAY,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,CAE9E;AAED,oFAAoF;AACpF,wBAAgB,iBAAiB,CAAC,YAAY,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,CAE7E;AAyBD;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,YAAY,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,CAEpF;AAED;;;;;;;;;GASG;AACH,wBAAgB,yBAAyB,CAAC,YAAY,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAMnF;AAMD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,eAAO,MAAM,cAAc,8EAIjB,CAAC;AAEX;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,eAAO,MAAM,4BAA4B,mDAExC,CAAC;AAEF;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,mBAAmB,mMAOtB,CAAC;AAEX,MAAM,MAAM,gBAAgB,GAAG,CAAC,OAAO,mBAAmB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEpE;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,mBAAmB,oBAAoB,CAAC;AAmErD;;;;;;;;;;;;GAYG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAUhE;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2DG;AACH,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,MAAM,GAAG,IAAI,EACvB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,EACjD,IAAI,GAAE,SAAS,MAAM,EAAwB,GAC5C,MAAM,CAwDR;AAMD;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAC/B,YAAY,EAAE,MAAM,EACpB,IAAI,CAAC,EAAE,MAAM,GACZ,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAM/B;AAED,8DAA8D;AAC9D,MAAM,MAAM,eAAe,GAAG,SAAS,GAAG,SAAS,CAAC;AAEpD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,kBAAkB,CAChC,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,EACjD,IAAI,CAAC,EAAE,MAAM,EACb,IAAI,GAAE,SAAS,MAAM,EAAwB,GAC5C,eAAe,CAoBjB;AA4BD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AACH,wBAAgB,yBAAyB,IAAI,MAAM,CA8ClD"}
+{"version":3,"file":"engagement-credential.d.ts","sourceRoot":"","sources":["../src/engagement-credential.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiGG;AAiBH,OAAO,EACL,qBAAqB,EACrB,oBAAoB,EACpB,uBAAuB,EACvB,kBAAkB,EAClB,gCAAgC,EAChC,YAAY,EACZ,GAAG,EACH,OAAO,GACR,MAAM,iBAAiB,CAAC;AAgBzB;;;;;;;;GAQG;AACH,eAAO,MAAM,uBAAuB,iBAAiB,CAAC;AAEtD,oFAAoF;AACpF,wBAAgB,kBAAkB,CAAC,YAAY,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,CAE9E;AAED,oFAAoF;AACpF,wBAAgB,iBAAiB,CAAC,YAAY,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,CAE7E;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,YAAY,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,CAEpF;AAED;;;;;;;;;GASG;AACH,wBAAgB,yBAAyB,CAAC,YAAY,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAMnF;AAMD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,eAAO,MAAM,cAAc,8EAIjB,CAAC;AAEX;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,eAAO,MAAM,4BAA4B,mDAExC,CAAC;AAEF;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,mBAAmB,mMAOtB,CAAC;AAEX,MAAM,MAAM,gBAAgB,GAAG,CAAC,OAAO,mBAAmB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEpE;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,mBAAmB,oBAAoB,CAAC;AAoCrD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,MAAM,GAAG,IAAI,EACvB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,EACjD,IAAI,GAAE,SAAS,MAAM,EAAwB,GAC5C,MAAM,CAER;AAMD;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAC/B,YAAY,EAAE,MAAM,EACpB,IAAI,CAAC,EAAE,MAAM,GACZ,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAM/B;AAED,8DAA8D;AAC9D,MAAM,MAAM,eAAe,GAAG,SAAS,GAAG,SAAS,CAAC;AAEpD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,kBAAkB,CAChC,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,EACjD,IAAI,CAAC,EAAE,MAAM,EACb,IAAI,GAAE,SAAS,MAAM,EAAwB,GAC5C,eAAe,CAoBjB;AA4BD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AACH,wBAAgB,yBAAyB,IAAI,MAAM,CA8ClD"}