halfcycle 0.3.26 → 0.3.28

package/dist/install.d.ts

@@ -237,6 +237,53 @@ export declare const ZONE_B_DIR = ".workbench";
  * depending on build mode — see the comment above `findBundleRoot`).
  */
 export declare const BUNDLE_ROOT: string;
+/** The committed pin. */
+export declare const BUNDLE_PIN_REL = ".halfcycle/bundle.json";
+/** The three files the installer merges into rather than owns. */
+export declare const SETTINGS_REL = ".claude/settings.json";
+export declare const GITIGNORE_REL = ".gitignore";
+export interface ClosedWriteSet {
+    /** Files the installer writes whole. */
+    readonly files: ReadonlySet<string>;
+    /** Files the installer merges its entries into. */
+    readonly merged: ReadonlySet<string>;
+    /** Every directory any of the above can create. */
+    readonly dirs: ReadonlySet<string>;
+    /** The directories owned by path: `.halfcycle/` and those under it. */
+    readonly ownedDirs: ReadonlySet<string>;
+    /** Every hook command string the installer generates into `.claude/settings.json`. */
+    readonly hookCommands: ReadonlySet<string>;
+    /** The SHA-256 of every deny rule the installer adds. */
+    readonly denyRuleSha256: ReadonlySet<string>;
+    /** Every line the installer appends to `.gitignore`. */
+    readonly gitignoreLines: ReadonlySet<string>;
+}
+/**
+ * THE CLOSED WRITE SET, derived from the same constants the installer writes with
+ * (`client-uninstall.md`, INV-023's two-key removal).
+ *
+ * THE SECOND KEY REACHES INSIDE THE MERGED FILES TOO (R-21, F1). A hook command, a
+ * deny rule or a `.gitignore` line is taken out only if the manifest records it AND
+ * it is one the installer generates: the commands `generateSettingsJson` emits, the
+ * hashes of `DENY_PATTERNS`, and the `.gitignore` header plus
+ * `REQUIRED_GITIGNORE_ENTRIES` plus the `.env.local` line older versions wrote.
+ * Without it a crafted manifest could name a developer's own hook, deny rule or
+ * ignore line and have uninstall delete it.
+ *
+ * A path in the install manifest never decides a removal on its own: uninstall
+ * removes or edits a path only if the manifest lists it AND it is a member here. The
+ * manifest is a committed file anyone who can land a commit can edit; this set is
+ * code, shipped in the package. So a manifest naming `src/index.ts` names a path
+ * that is not removed, whatever else it says.
+ *
+ * DERIVED, NOT LISTED. The command stubs come from `plugin.json`'s `commands[]`, the
+ * same array `copyManifestCommands` copies from; the hook scripts and the headers
+ * helper from `OWNED_GENERATED_HEADERS`, the table the owned-generated writes key
+ * on; the rest from the named constants their writers use. The directories are the
+ * ancestors of every member, so a new file under a new directory brings its
+ * directory with it. The writer and the remover therefore cannot hold two lists.
+ */
+export declare function closedWriteSet(): ClosedWriteSet;
 /**
  * The write outcome for one target path under the copy set.
  * - `written`  — the file did not exist and was created.
@@ -333,6 +380,87 @@ export declare const WRITE_CAPABLE_TOOLS: readonly string[];
  * across lines, this hook has one line of context budget to spend per prompt.
  */
 export declare const USER_PROMPT_REMINDER_SENTENCE: string;
+/** What `removeLegacyCiStanza` found on disk and did about it. */
+export type CiStanzaRemoval = 'removed' | 'kept-foreign' | 'kept-uncommitted' | 'absent' | 'failed';
+/**
+ * Delete `.halfcycle/ci-stanza.yml` when, and only when, BOTH hold (R-25 fix
+ * wave, F1): its opening line hashes to exactly one generation this installer
+ * ever shipped, AND the file is a clean, committed copy in git. Nothing writes
+ * this path any more; this only retires one an earlier version left on an
+ * already-installed tree.
+ *
+ * **Either check failing means KEEP, with a message — never delete.** A header
+ * hash matching none of `CI_STANZA_KNOWN_HEADER_HASHES` might be a developer's
+ * own file at this name, or a generation of ours this enumeration has not been
+ * kept in step with. A header that matches but a file that is uncommitted, or
+ * committed with local edits, might be a hand-edited stanza whose header line a
+ * developer left untouched while changing everything below it — the exact
+ * defect this rule now refuses, walked before this fix landed: a truncated
+ * prefix matched that file and deleted it. Either way, deleting on uncertainty
+ * is the wrong side of it. This is the same posture criterion 5 established for
+ * the generated hook scripts — evidence before disturbing a file this installer
+ * did not just write — applied to a delete instead of an overwrite.
+ *
+ * BEST-EFFORT, mirroring `migrateLegacyEnvLocal`: a read or unlink failure is
+ * reported, never thrown. Cleaning up a file this task retires must not fail an
+ * otherwise-successful install.
+ */
+export declare function removeLegacyCiStanza(targetRepo: string): CiStanzaRemoval;
+/**
+ * **THE INSTALLER WRITES NO `.env.example`, AND THIS IS WHERE THAT GENERATOR WAS.**
+ *
+ * It survived the removal of the four common addresses earlier the same day, still
+ * declaring three names — the engagement's token, its id, and the same credential
+ * under the name every other surface reads. The operator then read the file it
+ * produced and asked whether the remaining three needed to be there at all. They did
+ * not, and the block was **a second home**:
+ *
+ *   - The token and the engagement id were declared in the generated CI stanza,
+ *     **at the point they were used**, with their own correct explanation. The
+ *     scaffold repeated that for a job the stanza already owned. *(Overtaken
+ *     2026-09-16, T-15: the stanza declared neither by then — the CI job
+ *     authenticated with an identity token and no stored secret. Overtaken again
+ *     at T-25: the stanza itself is gone, CI setup being project scope rather than
+ *     a product requirement, so there is no generated file left for either name to
+ *     have a home in.)*
+ *   - `HALFCYCLE_TOKEN` is not in the stanza at all. It is the escape hatch for
+ *     running as a specific identity — ours, not something a client sets — which is
+ *     the same category as the control origin, and the same reason that one went.
+ *   - **The file's own text was the argument against it.** It spent twenty lines
+ *     explaining that you must not do the thing a `.env.example` exists for. The
+ *     convention of that filename is *copy this and fill it in*, and no comment
+ *     outranks a convention.
+ *
+ * So the decision is not "declare fewer names" but "declare none, and place no such
+ * file": one fewer file in someone else's repository, and each of these facts keeps
+ * exactly one home. The address paragraph this file used to carry did not die with
+ * it — it moved into the CI stanza's comment block, where a reader looking for
+ * something to configure will actually meet it.
+ *
+ * **AN EXISTING `.env.example` IS NOT TOUCHED, and that is a decision rather than an
+ * oversight.** A tree an older install wrote still carries the block it appended; a
+ * re-install neither strips nor deletes it. The alternative is a pass with DELETE
+ * authority over a file the developer owns, identifying our old block by a header
+ * string that has itself changed twice — guesswork, on a population that is close to
+ * empty, since the CLI reaches a developer only on a republish. The credential
+ * migration that does have delete authority earned it by operating on keys it wrote
+ * itself in a file this product created; neither is true here. The stale block names
+ * three variables that are genuinely the client's and instructs nobody to set an
+ * address, so leaving it is inert.
+ *
+ * **WHAT MUST NOT MOVE WITH IT.** `ENGAGEMENT_ENV_KEYS` and `CREDENTIAL_REQUIRED_KEYS`
+ * are untouched: every name is still WRITTEN into the machine-level credential store.
+ * Declaring and writing were decoupled when the addresses came out, and dropping a
+ * key from the store makes every already-installed repository read as credential-less
+ * on its next run and silently join a fresh credential.
+ */
+/** The project-scoped MCP registration file — `.mcp.json` at the repo root, the
+ * Claude Code convention. Root-level, so it is a distinct allowlist entry. */
+export declare const MCP_REGISTRATION_REL = ".mcp.json";
+/** The key the Halfcycle server is registered under inside `.mcp.json`'s
+ *  `mcpServers` — one home, because two generated shell scripts now look for it and
+ *  a literal typed twice is a literal that can disagree with itself. */
+export declare const MCP_SERVER_KEY = "halfcycle";
 /**
  * THE ONE HOME of *which generated files this installer claims as its own, and by
  * what evidence* (#1103). Every entry is a client-tree path this package
@@ -360,10 +488,12 @@ export declare const USER_PROMPT_REMINDER_SENTENCE: string;
  * change a marker. `test/install-stop-hook.test.ts` DID declare its own copy and
  * now imports this table instead.
  *
- * `.halfcycle/ci-stanza.yml` is deliberately ABSENT: its opening line has taken
- * four distinct forms, so no prefix long enough to be evidence covers every
- * generation. It stays collision-safe, the write site records why, and the gap is
- * filed as `#1112`.
+ * `.halfcycle/ci-stanza.yml` is deliberately ABSENT — it was never a member of
+ * this table even while it was generated, because its opening line took four
+ * distinct forms and no prefix long enough to be evidence covered every
+ * generation (`#1112`). T-25 removed the generator itself; the four forms' hashes
+ * now live in `CI_STANZA_KNOWN_HEADER_HASHES`, evidence for a REMOVAL rather than
+ * a write.
  */
 export declare const OWNED_GENERATED_HEADERS: {
     readonly '.claude/hooks/guard-runner.sh': "# Governance hook wrapper — generated by";
@@ -372,6 +502,12 @@ export declare const OWNED_GENERATED_HEADERS: {
     readonly '.claude/hooks/session-start-marker.sh': "# Session-start marker — generated by";
     readonly '.halfcycle/mcp-headers.sh': "# Halfcycle MCP connection headers — generated by";
 };
+/**
+ * The header line every `.gitignore` block this installer appends opens with. One
+ * form in every published version (`client-uninstall.md`, *Grounded claims*), which
+ * is what lets a first-manifest run claim the blocks an older version appended.
+ */
+export declare const GITIGNORE_HEADER = "# Halfcycle \u2014 machine-local secrets/state and Zone-B (never push to client remote)";
 /**
  * Read the pinned bundle.json from a target repo and compare its version
  * against the current bundle version. Returns the installed pin if present.
@@ -491,15 +627,18 @@ export declare function checkDrift(targetRepoRoot: string): {
  * 4. vendored guard binary → .halfcycle/bin/bin.bundle.mjs (self-contained)
  * 5. Governance-hook wiring (.claude/settings.json, guard-runner.sh,
  *    session-start-marker.sh, user-prompt-reminder.sh)
- * 6. CI stanza file + the MCP registration and the connection-headers helper it
- *    names (credentialed installs only — T-24). NO env scaffold: the installer
- *    writes no `.env.example` at all (operator decision, 2026-08-30)
+ * 6. (nothing) — no CI stanza (removed at T-25); the MCP registration and the
+ *    connection-headers helper it names (credentialed installs only — T-24).
+ *    NO env scaffold either: the installer writes no `.env.example` at all
+ *    (operator decision, 2026-08-30)
  * 7. .gitignore + project identity + the engagement credential (OUTSIDE the tree,
  *    at machine level — T-09) + migration of any pre-T-09 in-tree credential
  * 8. .halfcycle/bundle.json pin
  * 8b. .halfcycle/crew.json — CREW_ROSTER, serialised verbatim (crew-roster-and-dispatch)
  * 9. Bootstrap scan → .halfcycle/state.json (INV-021 — once, onboarding-time,
  *    a no-op if the file already exists; never re-run on a re-install)
+ * 10. .halfcycle/install-manifest.json — what this and every earlier install put
+ *    here, for `halfcycle uninstall` (T-21, `install-manifest.ts`)
  */
 export declare function install(options: InstallOptions): Promise<InstallResult>;
 export {};

package/dist/install.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"install.d.ts","sourceRoot":"","sources":["../src/install.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAyBH,MAAM,MAAM,cAAc,GAAG,YAAY,GAAG,QAAQ,CAAC;AAErD,MAAM,WAAW,SAAS;IACxB,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,cAAc,CAAC;IAC/B;;;;;OAKG;IACH,WAAW,EAAE,MAAM,CAAC;IACpB;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;;OAGG;IACH,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd;;;;;;;;;;;;;OAaG;IACH,MAAM,EAAE,MAAM,CAAC;IACf;;;;;;;;;;;;;;;;;OAiBG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;;;;;;;;;;;;;OAgBG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,cAAc,CAAC;IAC/B,kFAAkF;IAClF,UAAU,CAAC,EAAE,gBAAgB,CAAC;IAC9B;;;;;OAKG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,wDAAwD;IACxD,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,mFAAmF;IACnF,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,iFAAiF;IACjF,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB;;;OAGG;IACH,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAwCG;IACH,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB;;;;OAIG;IACH,gBAAgB,EAAE,OAAO,CAAC;IAC1B;;;;;;;;OAQG;IACH,oBAAoB,EAAE;QAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QAAC,OAAO,EAAE,MAAM,EAAE,CAAA;KAAE,GAAG,IAAI,CAAC;CACpE;AAMD,6EAA6E;AAC7E,eAAO,MAAM,UAAU,eAAe,CAAC;AAiCvC;;;;;;;GAOG;AACH,eAAO,MAAM,WAAW,QAA4B,CAAC;AAwLrD;;;;;;;;;GASG;AACH,KAAK,WAAW,GAAG,SAAS,GAAG,SAAS,GAAG,UAAU,CAAC;AA+FtD;;;oFAGoF;AACpF,wBAAgB,UAAU,CACxB,aAAa,EAAE,MAAM,EACrB,cAAc,EAAE,MAAM,EACtB,OAAO,EAAE,MAAM,GACd,WAAW,CA0Bb;AAoND;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,eAAO,MAAM,aAAa,EAAE,SAAS,MAAM,EAU1C,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,eAAO,MAAM,mBAAmB,EAAE,SAAS,MAAM,EAAmD,CAAC;AAErG;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,6BAA6B,QAG0C,CAAC;AA+gCrF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,eAAO,MAAM,uBAAuB;;;;;;CAM1B,CAAC;AAgYX;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,cAAc,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAItE;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuFG;AACH,wBAAgB,oBAAoB,CAClC,cAAc,EAAE,MAAM,EACtB,IAAI,CAAC,EAAE,MAAM,GACZ;IACD,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,gBAAgB,GAAG,SAAS,CAAC;IACzC;2EACuE;IACvE,kBAAkB,EAAE,OAAO,CAAC;CAC7B,GAAG,IAAI,CAkBP;AA+ED,wBAAgB,UAAU,CAAC,cAAc,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAMlH;AAmRD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,OAAO,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC,CA+U7E"}
+{"version":3,"file":"install.d.ts","sourceRoot":"","sources":["../src/install.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AA8CH,MAAM,MAAM,cAAc,GAAG,YAAY,GAAG,QAAQ,CAAC;AAErD,MAAM,WAAW,SAAS;IACxB,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,cAAc,CAAC;IAC/B;;;;;OAKG;IACH,WAAW,EAAE,MAAM,CAAC;IACpB;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;;OAGG;IACH,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd;;;;;;;;;;;;;OAaG;IACH,MAAM,EAAE,MAAM,CAAC;IACf;;;;;;;;;;;;;;;;;OAiBG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;;;;;;;;;;;;;OAgBG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,cAAc,CAAC;IAC/B,kFAAkF;IAClF,UAAU,CAAC,EAAE,gBAAgB,CAAC;IAC9B;;;;;OAKG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,wDAAwD;IACxD,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,mFAAmF;IACnF,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,iFAAiF;IACjF,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB;;;OAGG;IACH,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAwCG;IACH,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB;;;;OAIG;IACH,gBAAgB,EAAE,OAAO,CAAC;IAC1B;;;;;;;;OAQG;IACH,oBAAoB,EAAE;QAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QAAC,OAAO,EAAE,MAAM,EAAE,CAAA;KAAE,GAAG,IAAI,CAAC;CACpE;AAMD,6EAA6E;AAC7E,eAAO,MAAM,UAAU,eAAe,CAAC;AAiCvC;;;;;;;GAOG;AACH,eAAO,MAAM,WAAW,QAA4B,CAAC;AAoGrD,yBAAyB;AACzB,eAAO,MAAM,cAAc,2BAA2B,CAAC;AAOvD,kEAAkE;AAClE,eAAO,MAAM,YAAY,0BAA0B,CAAC;AACpD,eAAO,MAAM,aAAa,eAAe,CAAC;AAoB1C,MAAM,WAAW,cAAc;IAC7B,wCAAwC;IACxC,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACpC,mDAAmD;IACnD,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACrC,mDAAmD;IACnD,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACnC,uEAAuE;IACvE,QAAQ,CAAC,SAAS,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACxC,sFAAsF;IACtF,QAAQ,CAAC,YAAY,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IAC3C,yDAAyD;IACzD,QAAQ,CAAC,cAAc,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IAC7C,wDAAwD;IACxD,QAAQ,CAAC,cAAc,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CAC9C;AAoBD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,cAAc,IAAI,cAAc,CA8B/C;AA4OD;;;;;;;;;GASG;AACH,KAAK,WAAW,GAAG,SAAS,GAAG,SAAS,GAAG,UAAU,CAAC;AA+FtD;;;oFAGoF;AACpF,wBAAgB,UAAU,CACxB,aAAa,EAAE,MAAM,EACrB,cAAc,EAAE,MAAM,EACtB,OAAO,EAAE,MAAM,GACd,WAAW,CA0Bb;AAsND;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,eAAO,MAAM,aAAa,EAAE,SAAS,MAAM,EAU1C,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,eAAO,MAAM,mBAAmB,EAAE,SAAS,MAAM,EAAmD,CAAC;AAErG;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,6BAA6B,QAG0C,CAAC;AAysBrF,kEAAkE;AAClE,MAAM,MAAM,eAAe,GAAG,SAAS,GAAG,cAAc,GAAG,kBAAkB,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAuCpG;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,MAAM,GAAG,eAAe,CAqBxE;AAMD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AAMH;8EAC8E;AAC9E,eAAO,MAAM,oBAAoB,cAAc,CAAC;AAEhD;;wEAEwE;AACxE,eAAO,MAAM,cAAc,cAAc,CAAC;AA0I1C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,eAAO,MAAM,uBAAuB;;;;;;CAM1B,CAAC;AA2RX;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,4FACyD,CAAC;AA0NvF;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,cAAc,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAItE;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuFG;AACH,wBAAgB,oBAAoB,CAClC,cAAc,EAAE,MAAM,EACtB,IAAI,CAAC,EAAE,MAAM,GACZ;IACD,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,gBAAgB,GAAG,SAAS,CAAC;IACzC;2EACuE;IACvE,kBAAkB,EAAE,OAAO,CAAC;CAC7B,GAAG,IAAI,CAuBP;AA+ED,wBAAgB,UAAU,CAAC,cAAc,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAMlH;AAmRD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAsB,OAAO,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC,CAyZ7E"}

package/dist/loopback-signin.d.ts

@@ -20,7 +20,7 @@
  * chooses between them; this module only ever reports what it MEASURED.
  *
  * ---------------------------------------------------------------------------
- * FOUR PROPERTIES THIS MODULE IS RESPONSIBLE FOR. **Each one names the test that
+ * FIVE PROPERTIES THIS MODULE IS RESPONSIBLE FOR. **Each one names the test that
  * reds when it is mutated** — named, rather than claimed in aggregate, because the
  * aggregate version of this sentence shipped once while property 3's call site was
  * covered by nothing at all (see `createCallbackHandler`). A list that says "all of
@@ -51,8 +51,15 @@
  *      threw would push the caller towards guessing from the environment instead.
  *      → *"a port that is already taken is a MEASURED bind failure"*, against a real
  *      squatter on a real port.
+ *   5. **Only an engagement id reaches the completion page's onward address.** The
+ *      id the page may deep-link to arrives from a committed file or an argument, so
+ *      it is checked against `isEngagementId` — the shape's one home, in
+ *      `@halfcycle/core` — and anything else sends the browser to the projects list
+ *      instead. See `onwardTarget`.
+ *      → *"a hostile id never reaches the page"*, which feeds quotes, markup and a
+ *      `javascript:` URL through the real handler and reads back the body.
  *
- * INV-001: Node builtins and `@halfcycle/events` only.
+ * INV-001: Node builtins, `@halfcycle/core` and `@halfcycle/events` only.
  */
 import { type LoopbackRedirectTarget, type LoopbackResult } from '@halfcycle/events';
 /**
@@ -105,6 +112,12 @@ export interface LoopbackBindFailed {
     reason: string;
 }
 export type LoopbackBindOutcome = LoopbackListener | LoopbackBindFailed;
+/**
+ * How long the approved page stays up before it moves on, in seconds — long enough to
+ * read the line that says to go back to the terminal, short enough that nobody reaches
+ * for the link first. Pinned by a test that reads the literal out of the page body.
+ */
+export declare const COMPLETION_REDIRECT_SECONDS = 2;
 /**
  * Is this peer on the loopback interface?
  *
@@ -143,7 +156,7 @@ export interface LoopbackResponse {
  * THE ONE HANDLER, built here and used by `createServer` below and by nothing else.
  *
  * Extracted from the `createServer` call it used to be written inline in, for a
- * reason worth stating rather than filing as a refactor. This file's header claims
+ * reason worth stating rather than filing as a refactor. This file's header claimed
  * *"four properties, each of which has a test that reds when it is mutated"* — and
  * for property 3 (**a request from a non-loopback peer is refused, independently of
  * the bind address**) that was FALSE. Only the pure predicate `isLoopbackPeer` was
@@ -157,8 +170,12 @@ export interface LoopbackResponse {
  * survive a FUTURE widening of property 1 — the moment the bind is wrong, this is
  * what still refuses the network — so it needs an assertion that does not depend on
  * the bind being right. Handing the handler a peer address is that assertion.
+ *
+ * `engagementId` is where an approved page sends the browser next, when the caller
+ * knew the project before signing in. It is passed through to `completionPage` as
+ * given; `onwardTarget` is what decides whether it may be used.
  */
-export declare function createCallbackHandler(state: string, onCallback: (callback: LoopbackCallback) => void): (req: LoopbackRequest, res: LoopbackResponse) => void;
+export declare function createCallbackHandler(state: string, onCallback: (callback: LoopbackCallback) => void, engagementId?: string): (req: LoopbackRequest, res: LoopbackResponse) => void;
 /**
  * Bind the callback listener, or report why it could not be bound.
  *
@@ -168,6 +185,9 @@ export declare function createCallbackHandler(state: string, onCallback: (callba
  * `reason` string the caller prints. A heuristic would be wrong in both directions:
  * a container with a forwarded browser has no `DISPLAY` and works, and a locked-down
  * desktop has one and does not.
+ *
+ * `engagementId` is the project the completion page may send the browser on to —
+ * see `createCallbackHandler`.
  */
-export declare function bindLoopback(env?: NodeJS.ProcessEnv): Promise<LoopbackBindOutcome>;
+export declare function bindLoopback(env?: NodeJS.ProcessEnv, engagementId?: string): Promise<LoopbackBindOutcome>;
 //# sourceMappingURL=loopback-signin.d.ts.map

package/dist/loopback-signin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"loopback-signin.d.ts","sourceRoot":"","sources":["../src/loopback-signin.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDG;AAIH,OAAO,EASL,KAAK,sBAAsB,EAC3B,KAAK,cAAc,EACpB,MAAM,mBAAmB,CAAC;AAE3B;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,iBAAiB,4BAA4B,CAAC;AAE3D,wDAAwD;AACxD,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,cAAc,CAAC;CACxB;AAED,+EAA+E;AAC/E,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,IAAI,CAAC;IACZ,MAAM,EAAE,sBAAsB,CAAC;IAC/B;;;;;;;;OAQG;IACH,YAAY,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,eAAe,CAAC,IAAI,EAAE;QACpB,SAAS,EAAE,MAAM,CAAC;QAClB,+DAA+D;QAC/D,cAAc,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,IAAI,CAAC;QAC7C,cAAc,CAAC,EAAE,MAAM,CAAC;KACzB,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;IACrC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED,4EAA4E;AAC5E,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,KAAK,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,MAAM,mBAAmB,GAAG,gBAAgB,GAAG,kBAAkB,CAAC;AAoCxE;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,aAAa,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAIzE;AAgBD;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,eAAe;IAC9B,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5B,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzB,MAAM,EAAE;QAAE,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;KAAE,CAAC;CAChD;AAED,MAAM,WAAW,gBAAgB;IAC/B,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,gBAAgB,CAAC;IAC9E,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;CAC7B;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,MAAM,EACb,UAAU,EAAE,CAAC,QAAQ,EAAE,gBAAgB,KAAK,IAAI,GAC/C,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,gBAAgB,KAAK,IAAI,CAmCvD;AAoBD;;;;;;;;;GASG;AACH,wBAAsB,YAAY,CAChC,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,OAAO,CAAC,mBAAmB,CAAC,CAmE9B"}
+{"version":3,"file":"loopback-signin.d.ts","sourceRoot":"","sources":["../src/loopback-signin.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8DG;AAKH,OAAO,EASL,KAAK,sBAAsB,EAC3B,KAAK,cAAc,EACpB,MAAM,mBAAmB,CAAC;AAE3B;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,iBAAiB,4BAA4B,CAAC;AAE3D,wDAAwD;AACxD,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,cAAc,CAAC;CACxB;AAED,+EAA+E;AAC/E,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,IAAI,CAAC;IACZ,MAAM,EAAE,sBAAsB,CAAC;IAC/B;;;;;;;;OAQG;IACH,YAAY,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,eAAe,CAAC,IAAI,EAAE;QACpB,SAAS,EAAE,MAAM,CAAC;QAClB,+DAA+D;QAC/D,cAAc,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,IAAI,CAAC;QAC7C,cAAc,CAAC,EAAE,MAAM,CAAC;KACzB,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;IACrC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED,4EAA4E;AAC5E,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,KAAK,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,MAAM,mBAAmB,GAAG,gBAAgB,GAAG,kBAAkB,CAAC;AAKxE;;;;GAIG;AACH,eAAO,MAAM,2BAA2B,IAAI,CAAC;AAqG7C;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,aAAa,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAIzE;AAgBD;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,eAAe;IAC9B,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5B,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzB,MAAM,EAAE;QAAE,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;KAAE,CAAC;CAChD;AAED,MAAM,WAAW,gBAAgB;IAC/B,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,gBAAgB,CAAC;IAC9E,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;CAC7B;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,MAAM,EACb,UAAU,EAAE,CAAC,QAAQ,EAAE,gBAAgB,KAAK,IAAI,EAChD,YAAY,CAAC,EAAE,MAAM,GACpB,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,gBAAgB,KAAK,IAAI,CAmCvD;AAoBD;;;;;;;;;;;;GAYG;AACH,wBAAsB,YAAY,CAChC,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,YAAY,CAAC,EAAE,MAAM,GACpB,OAAO,CAAC,mBAAmB,CAAC,CAuE9B"}

package/dist/merge-settings.d.ts

@@ -60,6 +60,18 @@ export interface ClaudeSettings {
     permissions?: ClaudePermissions;
     [key: string]: unknown;
 }
+/**
+ * True iff `entry` is Halfcycle-authored — i.e. it carries a hook command that
+ * matches one of ours. This is how a re-install replaces our entry in place
+ * rather than appending a duplicate. A developer's own entry (any other command
+ * string) is never matched, so it is never touched.
+ *
+ * Exported because it is THE rule for recognising a Halfcycle hook entry, and the
+ * installer's manifest (deciding whether a pre-manifest settings file is adopted)
+ * and the uninstaller (deciding which entries to take apart) ask the same question.
+ * A second predicate beside either of them would be a second answer to it.
+ */
+export declare function isHalfcycleEntry(entry: HookEntry, halfcycleCommands: Set<string>): boolean;
 /**
  * Merge Halfcycle's generated hook entries into an existing settings object.
  *

package/dist/merge-settings.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"merge-settings.d.ts","sourceRoot":"","sources":["../src/merge-settings.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,yEAAyE;AACzE,MAAM,WAAW,WAAW;IAC1B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,6DAA6D;AAC7D,MAAM,WAAW,SAAS;IACxB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,WAAW,EAAE,CAAC;CACtB;AAED;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;IACf,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,sEAAsE;AACtE,MAAM,WAAW,cAAc;IAC7B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;IACpC,WAAW,CAAC,EAAE,iBAAiB,CAAC;IAChC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAYD;;;;;;;;;;GAUG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAAE,cAAc,EAAE,SAAS,EAAE,cAAc,GAAG,cAAc,CAwCjG"}
+{"version":3,"file":"merge-settings.d.ts","sourceRoot":"","sources":["../src/merge-settings.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,yEAAyE;AACzE,MAAM,WAAW,WAAW;IAC1B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,6DAA6D;AAC7D,MAAM,WAAW,SAAS;IACxB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,WAAW,EAAE,CAAC;CACtB;AAED;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;IACf,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,sEAAsE;AACtE,MAAM,WAAW,cAAc;IAC7B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;IACpC,WAAW,CAAC,EAAE,iBAAiB,CAAC;IAChC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,SAAS,EAAE,iBAAiB,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,OAAO,CAE1F;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAAE,cAAc,EAAE,SAAS,EAAE,cAAc,GAAG,cAAc,CAwCjG"}

package/dist/open-phase.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"open-phase.d.ts","sourceRoot":"","sources":["../src/open-phase.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAIH,OAAO,EAIL,KAAK,kBAAkB,EACxB,MAAM,mBAAmB,CAAC;AAS3B;;;;;;;;GAQG;AACH,MAAM,WAAW,iBAAiB;IAChC,wEAAwE;IACxE,IAAI,EAAE,MAAM,CAAC;IACb,iEAAiE;IACjE,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,sFAAsF;AACtF,MAAM,WAAW,WAAW;IAC1B,iDAAiD;IACjD,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,qDAAqD;IACrD,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B;;;;OAIG;IACH,YAAY,EAAE,iBAAiB,GAAG,IAAI,CAAC;IACvC,QAAQ,EAAE;QACR,UAAU,EAAE,MAAM,CAAC;QACnB,QAAQ,EAAE,MAAM,CAAC;QACjB,KAAK,EAAE,MAAM,CAAC;QACd,aAAa,EAAE,MAAM,CAAC;QACtB,yEAAyE;QACzE,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;QAC/B,SAAS,EAAE,MAAM,CAAC;KACnB,CAAC;CACH;AAED;;;;;;GAMG;AACH,qBAAa,gBAAiB,SAAQ,KAAK;aAEvB,MAAM,EAAE,MAAM;aAEd,OAAO,EAAE,MAAM,GAAG,IAAI;gBAFtB,MAAM,EAAE,MAAM,EAC9B,OAAO,EAAE,MAAM,EACC,OAAO,EAAE,MAAM,GAAG,IAAI;CAKzC;AAED;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,kFAItB,CAAC;AAEX,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;CACtB;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,MAAM,EAChB,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,IAAI,CAAC,EAAE,MAAM,GACZ,cAAc,CA0BhB;AAuBD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAgB,eAAe,CAC7B,YAAY,EAAE,MAAM,EACpB,KAAK,EAAE,MAAM,GAAG,IAAI,EACpB,IAAI,CAAC,EAAE,MAAM,GACZ,iBAAiB,GAAG,IAAI,CAc1B;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,SAAS,CAC7B,UAAU,EAAE,cAAc,EAC1B,KAAK,EAAE,MAAM,GAAG,IAAI,EACpB,KAAK,EAAE,kBAAkB,EACzB,IAAI,CAAC,EAAE,MAAM,GACZ,OAAO,CAAC,WAAW,CAAC,CAyEtB"}
+{"version":3,"file":"open-phase.d.ts","sourceRoot":"","sources":["../src/open-phase.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAIH,OAAO,EAIL,KAAK,kBAAkB,EACxB,MAAM,mBAAmB,CAAC;AAY3B;;;;;;;;GAQG;AACH,MAAM,WAAW,iBAAiB;IAChC,wEAAwE;IACxE,IAAI,EAAE,MAAM,CAAC;IACb,iEAAiE;IACjE,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,sFAAsF;AACtF,MAAM,WAAW,WAAW;IAC1B,iDAAiD;IACjD,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,qDAAqD;IACrD,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B;;;;OAIG;IACH,YAAY,EAAE,iBAAiB,GAAG,IAAI,CAAC;IACvC,QAAQ,EAAE;QACR,UAAU,EAAE,MAAM,CAAC;QACnB,QAAQ,EAAE,MAAM,CAAC;QACjB,KAAK,EAAE,MAAM,CAAC;QACd,aAAa,EAAE,MAAM,CAAC;QACtB,yEAAyE;QACzE,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;QAC/B,SAAS,EAAE,MAAM,CAAC;KACnB,CAAC;CACH;AAED;;;;;;GAMG;AACH,qBAAa,gBAAiB,SAAQ,KAAK;aAEvB,MAAM,EAAE,MAAM;aAEd,OAAO,EAAE,MAAM,GAAG,IAAI;gBAFtB,MAAM,EAAE,MAAM,EAC9B,OAAO,EAAE,MAAM,EACC,OAAO,EAAE,MAAM,GAAG,IAAI;CAKzC;AAED;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,kFAItB,CAAC;AAEX,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;CACtB;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,MAAM,EAChB,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,IAAI,CAAC,EAAE,MAAM,GACZ,cAAc,CA4BhB;AAuBD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAgB,eAAe,CAC7B,YAAY,EAAE,MAAM,EACpB,KAAK,EAAE,MAAM,GAAG,IAAI,EACpB,IAAI,CAAC,EAAE,MAAM,GACZ,iBAAiB,GAAG,IAAI,CAmB1B;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,SAAS,CAC7B,UAAU,EAAE,cAAc,EAC1B,KAAK,EAAE,MAAM,GAAG,IAAI,EACpB,KAAK,EAAE,kBAAkB,EACzB,IAAI,CAAC,EAAE,MAAM,GACZ,OAAO,CAAC,WAAW,CAAC,CAyEtB"}

package/dist/own-engagement.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"own-engagement.d.ts","sourceRoot":"","sources":["../src/own-engagement.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAA2B,KAAK,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAClF,OAAO,EAIL,KAAK,iBAAiB,EACvB,MAAM,wBAAwB,CAAC;AAOhC,OAAO,EAAyB,KAAK,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAGxF;;;GAGG;AACH,MAAM,MAAM,iBAAiB,GAAG,mBAAmB,CAAC;AAEpD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,WAAW,eAAgB,SAAQ,iBAAiB;IACxD,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC;;;;;;OAMG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,eAAe,CAAC;CAC3C;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,OAAO,EAAE,kBAAkB,CAAC;IACrC,+EAA+E;IAC/E,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB;;;;;OAKG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,eAAe,CAAC;CAC3C;AAED,gFAAgF;AAChF,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,eAAe,GAAG,eAAe,GACxC,MAAM,IAAI,eAAe,CAE3B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,wBAAsB,qBAAqB,CACzC,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,MAAM,EAClB,IAAI,GAAE,iBAAsB,GAC3B,OAAO,CAAC,eAAe,CAAC,CAmD1B;AAyCD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2EG;AACH,wBAAsB,oBAAoB,CACxC,UAAU,EAAE,MAAM,EAClB,YAAY,EAAE,MAAM,EACpB,UAAU,EAAE,MAAM,EAClB,IAAI,GAAE,iBAAsB,GAC3B,OAAO,CAAC,eAAe,GAAG,eAAe,CAAC,CA4E5C"}
+{"version":3,"file":"own-engagement.d.ts","sourceRoot":"","sources":["../src/own-engagement.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAA2B,KAAK,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAClF,OAAO,EAIL,KAAK,iBAAiB,EACvB,MAAM,wBAAwB,CAAC;AAOhC,OAAO,EAAyB,KAAK,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAGxF;;;GAGG;AACH,MAAM,MAAM,iBAAiB,GAAG,mBAAmB,CAAC;AAEpD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,WAAW,eAAgB,SAAQ,iBAAiB;IACxD,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC;;;;;;OAMG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,eAAe,CAAC;CAC3C;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,OAAO,EAAE,kBAAkB,CAAC;IACrC,+EAA+E;IAC/E,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB;;;;;OAKG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,eAAe,CAAC;CAC3C;AAED,gFAAgF;AAChF,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,eAAe,GAAG,eAAe,GACxC,MAAM,IAAI,eAAe,CAE3B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,wBAAsB,qBAAqB,CACzC,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,MAAM,EAClB,IAAI,GAAE,iBAAsB,GAC3B,OAAO,CAAC,eAAe,CAAC,CAmD1B;AAmDD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2EG;AACH,wBAAsB,oBAAoB,CACxC,UAAU,EAAE,MAAM,EAClB,YAAY,EAAE,MAAM,EACpB,UAAU,EAAE,MAAM,EAClB,IAAI,GAAE,iBAAsB,GAC3B,OAAO,CAAC,eAAe,GAAG,eAAe,CAAC,CAuF5C"}

package/dist/scan.d.ts

@@ -101,6 +101,13 @@ export interface HalfcycleStateFile {
 export declare const LAYER_ARTEFACT_PATHS: Partial<Record<MethodLayer, string[]>>;
 /** Scan `targetRepo` for each layer's artefact convention. Pure filesystem read. */
 export declare function scanLayers(targetRepo: string, scannedAt?: string): HalfcycleStateFile;
+/**
+ * Where the scan writes, relative to the repository root. Named once because the
+ * installer's closed write set (`install.ts`, `closedWriteSet`) is derived from the
+ * constants the writers use, so the path uninstall may remove is the path this
+ * writes, and not a second spelling of it.
+ */
+export declare const BOOTSTRAP_STATE_REL = ".halfcycle/state.json";
 /**
  * Run the bootstrap scan ONCE. If `.halfcycle/state.json` already exists this
  * is a no-op (returns the existing file unchanged) — the "never again" half of

package/dist/scan.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scan.d.ts","sourceRoot":"","sources":["../src/scan.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAIH,OAAO,EAAE,iBAAiB,EAAE,KAAK,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAMxE,4EAA4E;AAC5E,eAAO,MAAM,sBAAsB,EAAG,yBAAkC,CAAC;AAEzE,kFAAkF;AAClF,OAAO,EAAE,iBAAiB,EAAE,CAAC;AAE7B;;;;;;;GAOG;AACH,MAAM,MAAM,iBAAiB,GAAG,UAAU,CAAC;AAE3C,0DAA0D;AAC1D,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,iBAAiB,CAAC;IACzB,oEAAoE;IACpE,MAAM,EAAE,gBAAgB,CAAC;IACzB,2EAA2E;IAC3E,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,gDAAgD;IAChD,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,oBAAoB,QAStB,CAAC;AAEZ,4CAA4C;AAC5C,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,OAAO,sBAAsB,CAAC;IACtC;;;OAGG;IACH,IAAI,EAAE,OAAO,oBAAoB,CAAC;IAClC,kEAAkE;IAClE,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,iBAAiB,CAAC,CAAC,CAAC;CACzD;AAMD;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,oBAAoB,EAAE,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,EAAE,CAAC,CAOvE,CAAC;AAMF,oFAAoF;AACpF,wBAAgB,UAAU,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,GAAE,MAAiC,GAAG,kBAAkB,CAc/G;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,MAAM,GAAG;IAAE,KAAK,EAAE,kBAAkB,CAAC;IAAC,GAAG,EAAE,OAAO,CAAA;CAAE,CAUhG;AAMD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,gBAAgB,CAC9B,KAAK,EAAE,kBAAkB,EACzB,qBAAqB,EAAE,WAAW,CAAC,WAAW,CAAC,GAC9C,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,UAAU,GAAG,UAAU,CAAC,CAAC,CAcvD"}
+{"version":3,"file":"scan.d.ts","sourceRoot":"","sources":["../src/scan.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAIH,OAAO,EAAE,iBAAiB,EAAE,KAAK,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAMxE,4EAA4E;AAC5E,eAAO,MAAM,sBAAsB,EAAG,yBAAkC,CAAC;AAEzE,kFAAkF;AAClF,OAAO,EAAE,iBAAiB,EAAE,CAAC;AAE7B;;;;;;;GAOG;AACH,MAAM,MAAM,iBAAiB,GAAG,UAAU,CAAC;AAE3C,0DAA0D;AAC1D,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,iBAAiB,CAAC;IACzB,oEAAoE;IACpE,MAAM,EAAE,gBAAgB,CAAC;IACzB,2EAA2E;IAC3E,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,gDAAgD;IAChD,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,oBAAoB,QAStB,CAAC;AAEZ,4CAA4C;AAC5C,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,OAAO,sBAAsB,CAAC;IACtC;;;OAGG;IACH,IAAI,EAAE,OAAO,oBAAoB,CAAC;IAClC,kEAAkE;IAClE,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,iBAAiB,CAAC,CAAC,CAAC;CACzD;AAMD;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,oBAAoB,EAAE,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,EAAE,CAAC,CAOvE,CAAC;AAMF,oFAAoF;AACpF,wBAAgB,UAAU,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,GAAE,MAAiC,GAAG,kBAAkB,CAc/G;AAED;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,0BAA0B,CAAC;AAE3D;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,MAAM,GAAG;IAAE,KAAK,EAAE,kBAAkB,CAAC;IAAC,GAAG,EAAE,OAAO,CAAA;CAAE,CAUhG;AAMD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,gBAAgB,CAC9B,KAAK,EAAE,kBAAkB,EACzB,qBAAqB,EAAE,WAAW,CAAC,WAAW,CAAC,GAC9C,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,UAAU,GAAG,UAAU,CAAC,CAAC,CAcvD"}

package/dist/uninstall.d.ts

@@ -0,0 +1,96 @@
+/**
+ * `halfcycle uninstall` — takes back exactly what the installer put in this
+ * repository, and nothing else (`client-uninstall.md`, T-21).
+ *
+ * WHAT DECIDES THAT A PATH IS OURS: two keys, both required (INV-023). The committed
+ * install manifest (`install-manifest.ts`) must list it, AND it must be a member of
+ * the closed write set held in code (`install.ts`, `closedWriteSet`). The manifest is
+ * a file anyone who can land a commit can edit, so on its own it decides nothing.
+ * A file is then removed only while its bytes still hash to what the installer last
+ * wrote; one that changed is kept and named. A symbolic link, or a path under one, is
+ * never followed.
+ *
+ * THE ORDER OF WORK IS THE SPEC'S, and it is load-bearing:
+ *   1. validate everything and change nothing on any failure — the arguments (in
+ *      `bin.ts`), the manifest, the pin, the project id when the credential is to go,
+ *      and that each merged JSON file present parses as a JSON object;
+ *   2. unmerge `.claude/settings.json` first, so no hook points at a deleted script,
+ *      then `.mcp.json`, so no registration points at a deleted helper;
+ *   3. remove the recorded files, except the pin and the manifest, and the CI
+ *      template an earlier version wrote (`removeLegacyCiStanza`, which carries its
+ *      own two keys: an exact known header and a clean committed copy);
+ *   4. remove the directories an install created, deepest first, when empty;
+ *   5. trim `.gitignore`;
+ *   6. remove this machine's credential for the project, if asked;
+ *   7. only when nothing so far failed: the pin, the manifest, then `.halfcycle/`.
+ * A failure at 3–6 therefore leaves the pin and the manifest in place, and a rerun
+ * finds everything else already absent — absent counts as removed — and retries.
+ *
+ * WHAT IT NEVER TOUCHES: any path outside the closed write set (Build Records, what
+ * setup wrote, `.workbench/`, captured fixtures, `.claude/agents/`), the project on
+ * Halfcycle, this machine's sign-in (`~/.halfcycle/account.json`) and the shared
+ * local log directory. It makes no network call and asks nothing.
+ *
+ * INV-001: imports only Node built-ins and this package's own modules.
+ */
+/** The verb's one flag. */
+export declare const REMOVE_CREDENTIAL_FLAG = "--remove-credential";
+export interface UninstallOptions {
+    readonly targetRepo: string;
+    readonly removeCredential: boolean;
+    /** The home directory `~/.halfcycle` lives under; defaults to `os.homedir()`. */
+    readonly home?: string;
+}
+/** What happened to this machine's credential for the project. */
+export type CredentialOutcome = {
+    readonly kind: 'nothing-to-say';
+} | {
+    readonly kind: 'still-held';
+    readonly dir: string;
+} | {
+    readonly kind: 'invalid-id';
+} | {
+    readonly kind: 'removed';
+    readonly dir: string;
+} | {
+    readonly kind: 'not-held';
+    readonly dir: string;
+} | {
+    readonly kind: 'no-project-id';
+} | {
+    readonly kind: 'failed';
+    readonly dir: string;
+    readonly reason: string;
+};
+export interface UninstallResult {
+    readonly outcome: 'not-installed' | 'refused' | 'uninstalled';
+    readonly exitCode: 0 | 1;
+    /** Why a refused run changed nothing, and what to do. */
+    readonly refusal?: string;
+    readonly removed: string[];
+    readonly restored: string[];
+    /** Installed files that changed after the installer wrote them. */
+    readonly kept: string[];
+    /** `.gitignore` lines kept because the path they cover still exists. */
+    readonly keptIgnoreLines: string[];
+    readonly leftAlone: string[];
+    readonly failed: string[];
+    readonly credential: CredentialOutcome;
+}
+/** Parse the verb's arguments (global flags are already stripped by `bin.ts`). */
+export declare function parseUninstallArgs(args: readonly string[]): {
+    removeCredential: boolean;
+} | {
+    error: string;
+};
+/**
+ * Run the uninstall. Never throws for a condition the spec names: a refusal comes
+ * back as `outcome: 'refused'` with nothing changed.
+ */
+export declare function uninstall(options: UninstallOptions): UninstallResult;
+/** The report, as the CLI prints it: stdout for a finished run, stderr for a refusal. */
+export declare function renderUninstallReport(result: UninstallResult, home?: string): {
+    stdout: string;
+    stderr: string;
+};
+//# sourceMappingURL=uninstall.d.ts.map

package/dist/uninstall.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"uninstall.d.ts","sourceRoot":"","sources":["../src/uninstall.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAsCH,2BAA2B;AAC3B,eAAO,MAAM,sBAAsB,wBAAwB,CAAC;AAE5D,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC;IACnC,iFAAiF;IACjF,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,kEAAkE;AAClE,MAAM,MAAM,iBAAiB,GACzB;IAAE,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAA;CAAE,GACnC;IAAE,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GACrD;IAAE,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAA;CAAE,GAC/B;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAClD;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GACnD;IAAE,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAA;CAAE,GAClC;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAE/E,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,OAAO,EAAE,eAAe,GAAG,SAAS,GAAG,aAAa,CAAC;IAC9D,QAAQ,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,CAAC;IACzB,yDAAyD;IACzD,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;IAC5B,mEAAmE;IACnE,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;IACxB,wEAAwE;IACxE,QAAQ,CAAC,eAAe,EAAE,MAAM,EAAE,CAAC;IACnC,QAAQ,CAAC,SAAS,EAAE,MAAM,EAAE,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,iBAAiB,CAAC;CACxC;AAED,kFAAkF;AAClF,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG;IAAE,gBAAgB,EAAE,OAAO,CAAA;CAAE,GAAG;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,CAc7G;AAwWD;;;GAGG;AACH,wBAAgB,SAAS,CAAC,OAAO,EAAE,gBAAgB,GAAG,eAAe,CA6HpE;AA+OD,yFAAyF;AACzF,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,eAAe,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAmEhH"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "halfcycle",
-  "version": "0.3.26",
+  "version": "0.3.28",
   "description": "Your coding agents are the engineers. Halfcycle is the rest of the team: product owner, architect, planner and independent reviewer for Claude Code.",
   "keywords": [
     "claude",
@@ -19,7 +19,7 @@
   "homepage": "https://halfcycle.ai",
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/Halfcycle-AI/halfcycle-cli.git"
+    "url": "git+https://github.com/Halfcycle-AI/halfcycle.git"
   },
   "license": "MIT",
   "type": "module",

package/dist/ci-bind.d.ts

@@ -1,116 +0,0 @@
-/**
- * THE `ci bind` / `ci unbind` VERBS' WIRING — the client half of T-05's
- * account-authenticated trust binding (`ci-oidc-token-exchange`, T-11, AC2 client
- * half).
- *
- * `PUT|DELETE {baseUrl}/engagements/:engagementId/ci-bindings/:owner/:repo` says
- * which repository's GitHub Actions OIDC tokens an engagement trusts — a signed-in
- * developer states it once, from their own machine, and a client's CI afterwards
- * needs no secret of ours to authenticate (the exchange itself, on the control
- * plane, is the other half).
- *
- * WIRING, NOT MACHINERY — the same posture as `open-phase.ts` and `close-phase.ts`.
- * Every rule this route enforces (ownership, the one-project-at-a-time conflict,
- * what a repository string may be) is the route's; this module builds the request,
- * sends it, and reports what came back.
- *
- * ---------------------------------------------------------------------------
- * **THE ACCOUNT CREDENTIAL, NOT THE ENGAGEMENT TOKEN.** The route refuses a browser
- * session by construction and refuses EVERY engagement token as a class — whether or
- * not it carries an account. So this module resolves its credential exactly the way
- * `own-engagement.ts` resolves the create/join credential — `resolve-credential.ts`'s
- * `obtainCredential`, never `open-phase.ts`'s `readRepoCredential`, which reads the
- * OTHER credential class (the engagement token) out of a repository's pinned env.
- *
- * **THIS PARAGRAPH USED TO REST ON "an engagement token that carries no account", AND
- * THAT WAS THE HOLE** (T-05f, 2026-09-16): that phrasing describes a column, not a
- * credential class, and once those rows began carrying an account the route admitted
- * them — measured, at 204, with the binding surviving the token's revocation. There is
- * a consequence for the caller here, and it is intended: `obtainCredential` gives
- * `HALFCYCLE_TOKEN` precedence over a saved sign-in, so a developer with that variable
- * set is now refused with a `403` whose sentence names unsetting it as the step. Before
- * the fix that caller silently bound with the wrong credential class.
- *
- * **NO IDENTITY-CONFIRMATION CEREMONY, AND THAT IS A DELIBERATE NARROWING FROM
- * `own-engagement.ts`, NOT AN OMISSION.** `createOwnedEngagement`/`joinPinnedEngagement`
- * run `confirmActingIdentity` first because a create or a join under a stale saved
- * sign-in SUCCEEDS silently, under the wrong account — a durable resource now exists
- * that the person at the keyboard did not ask for. A bind under the wrong account
- * cannot do that: T-05's `isOwnedBy` gate refuses it with `CiBindRefused` (403)
- * before anything changes, so the failure mode this ceremony exists to interrupt is
- * not reachable here — the route answers it, every time, without this client having
- * to ask first.
- *
- * **THE RETRY IS ON `401` ALONE**, mirroring `joinPinnedEngagement`'s reasoning in
- * `own-engagement.ts` exactly: this route's other refusals — `403` (not an account
- * credential, or an engagement the caller does not own) and `409` (bound elsewhere)
- * — are not a stale credential, and retrying either would discard a perfectly good
- * sign-in to arrive at the identical refusal a moment later.
- *
- * INV-001: Node builtins, `@halfcycle/events` (transitively, via `resolve-credential`),
- * and bundle-internal modules — never the control service. The route declares no
- * wire shape (T-05: path segments in, `204` out — deliberately, so a `POST … {
- * repository, engagementId }` body never needed a second `packages/events` home),
- * so there is nothing here for this file to validate a body against; its only job
- * is the path and the header.
- */
-import { type ResolveOptions } from './resolve-credential.js';
-/** The repository a `ci bind`/`ci unbind` call names. */
-export interface CiRepository {
-    readonly owner: string;
-    readonly repo: string;
-}
-/**
- * Read `owner/repo` off the command line. `null` for anything that is not exactly
- * two non-blank segments — the same shape the route's own repository normaliser
- * refuses, checked here only so a malformed argument fails before a round trip
- * rather than after one to a route this CLI could have refused itself.
- */
-export declare function parseCiRepositoryArg(arg: string): CiRepository | null;
-/**
- * A refusal from the control plane, carried whole so the CLI can print it.
- *
- * `403` covers two causes this file cannot and must not tell apart — the caller's
- * credential is not an account credential at all, or it names an engagement the
- * caller does not own — the same one-sentence-for-both posture T-05's own
- * `CI_BIND_REFUSED_MESSAGE` is written with, so nothing here would have a second
- * sentence to pick between anyway. `409` is the repository being bound elsewhere,
- * client-safely worded by the route to name no other project.
- */
-export declare class CiBindRefused extends Error {
-    readonly status: number;
-    constructor(status: number, message: string);
-    /** Is this the ONE arm signing in again can fix — see this file's header. */
-    get authRefused(): boolean;
-    /**
-     * Is this "ours to fix, try again", not "yours to fix"? The question is not
-     * mechanical (did a handler run) — it is what a developer reading the message
-     * does next. `502`/`504` are the reverse proxy in front of the published origin
-     * answering for a control plane that is down or slow, with an HTML body this
-     * file's own `requestBinding` cannot parse, so the message would otherwise
-     * degrade to a bare "the URL returned 502". `503` is `resolveAccount`'s own
-     * fail-closed refusal when it could not reach the token store — the caller's
-     * credential was never actually checked, and its posture is emphatic this is NOT
-     * a "no". **`500` belongs beside them, not with the 4xx arms.** It is an
-     * unhandled throw: nothing decided the request's merits, and the bind may even
-     * have half-happened if the throw landed after a commit. On this route the
-     * body is the same degraded "the URL returned 500" a 502/504 produces — an
-     * internal path echoed back with no advice — so `refused (500)` would send a
-     * developer to re-check ownership, the repository name and whether it is bound
-     * elsewhere: every 4xx question, none of them this status's actual cause.
-     *
-     * So this is every `5xx`, not an enumerated set of three — the boundary is
-     * "did any handler decide yes or no", and a 4xx is the only family that ever did.
-     */
-    get unavailable(): boolean;
-}
-/** Trust this engagement's CI with tokens from `repository` (T-05's `PUT` route). */
-export declare function bindCiRepository(serviceUrl: string, engagementId: string, repository: CiRepository, deps?: ResolveOptions): Promise<void>;
-/**
- * Withdraw that trust (T-05's `DELETE` route) — reversible, and a success whether or
- * not the repository was bound to this engagement in the first place (T-05's own
- * docblock: `204` either way, so this route is never an oracle for whether a
- * repository the caller does not own is bound to something else).
- */
-export declare function unbindCiRepository(serviceUrl: string, engagementId: string, repository: CiRepository, deps?: ResolveOptions): Promise<void>;
-//# sourceMappingURL=ci-bind.d.ts.map

package/dist/ci-bind.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"ci-bind.d.ts","sourceRoot":"","sources":["../src/ci-bind.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDG;AAEH,OAAO,EAIL,KAAK,cAAc,EACpB,MAAM,yBAAyB,CAAC;AAGjC,yDAAyD;AACzD,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,YAAY,GAAG,IAAI,CAOrE;AAED;;;;;;;;;GASG;AACH,qBAAa,aAAc,SAAQ,KAAK;aAEpB,MAAM,EAAE,MAAM;gBAAd,MAAM,EAAE,MAAM,EAC9B,OAAO,EAAE,MAAM;IAMjB,6EAA6E;IAC7E,IAAI,WAAW,IAAI,OAAO,CAEzB;IAED;;;;;;;;;;;;;;;;;;;OAmBG;IACH,IAAI,WAAW,IAAI,OAAO,CAEzB;CACF;AAiFD,qFAAqF;AACrF,wBAAgB,gBAAgB,CAC9B,UAAU,EAAE,MAAM,EAClB,YAAY,EAAE,MAAM,EACpB,UAAU,EAAE,YAAY,EACxB,IAAI,GAAE,cAAmB,GACxB,OAAO,CAAC,IAAI,CAAC,CAEf;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAChC,UAAU,EAAE,MAAM,EAClB,YAAY,EAAE,MAAM,EACpB,UAAU,EAAE,YAAY,EACxB,IAAI,GAAE,cAAmB,GACxB,OAAO,CAAC,IAAI,CAAC,CAEf"}