halfcycle 0.3.7

package/dist/index.js

@@ -0,0 +1,2083 @@
+// dist/install.js
+import { existsSync as existsSync3, mkdirSync as mkdirSync3, readFileSync as readFileSync4, rmSync, writeFileSync as writeFileSync3 } from "node:fs";
+import { dirname as dirname2, join as join5, relative } from "node:path";
+import { fileURLToPath } from "node:url";
+
+// dist/engagement-credential.js
+import { chmodSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { platform as platform2 } from "node:os";
+import { join as join2 } from "node:path";
+
+// dist/account-credential.js
+import { homedir, platform } from "node:os";
+import { dirname, join } from "node:path";
+function halfcycleHome(home) {
+  return join(home ?? homedir(), ".halfcycle");
+}
+
+// dist/engagement-credential.js
+var ENGAGEMENTS_DIR = "engagements";
+var ENV_FILENAME = "env";
+var PIN_ENGAGEMENT_ID_FIELD = "engagementId";
+function engagementStateDir(engagementId, home) {
+  return join2(halfcycleHome(home), ENGAGEMENTS_DIR, engagementId);
+}
+function engagementEnvPath(engagementId, home) {
+  return join2(engagementStateDir(engagementId, home), ENV_FILENAME);
+}
+var GUARD_ENV_KEYS = [
+  "GUARD_SERVICE_URL",
+  "GUARD_SERVICE_TOKEN",
+  "GUARD_ENGAGEMENT_ID"
+];
+var ENGAGEMENT_ENV_KEYS = [
+  "HALFCYCLE_SERVICE_URL",
+  "HALFCYCLE_MCP_URL",
+  "HALFCYCLE_TOKEN",
+  "HALFCYCLE_ENGAGEMENT_ID",
+  ...GUARD_ENV_KEYS,
+  "CONTROL_TELEMETRY_URL"
+];
+var ENV_HEADER = "# Halfcycle per-engagement credential \u2014 machine level, owner-only, never in a repository.";
+function shq(value) {
+  return `'${value.replace(/'/g, `'\\''`)}'`;
+}
+function unquote(value) {
+  const v = value.trim();
+  if (v.length >= 2 && v.startsWith("'") && v.endsWith("'")) {
+    return v.slice(1, -1).split(`'\\''`).join(`'`);
+  }
+  if (v.length >= 2 && v.startsWith('"') && v.endsWith('"'))
+    return v.slice(1, -1);
+  return v;
+}
+function parseEnvText(raw) {
+  const out = {};
+  for (const line of raw.split("\n")) {
+    const eq = line.indexOf("=");
+    if (eq === -1)
+      continue;
+    const key = line.slice(0, eq).replace(/^\s*export\s+/, "").trim();
+    if (key === "" || key.startsWith("#"))
+      continue;
+    out[key] = unquote(line.slice(eq + 1));
+  }
+  return out;
+}
+function reconcileEnvText(existing, values, keys = ENGAGEMENT_ENV_KEYS) {
+  const desired = new Map(keys.map((k) => [k, values[k] ?? ""]));
+  const line = (k) => `${k}=${shq(desired.get(k) ?? "")}`;
+  if (existing === null) {
+    return `${ENV_HEADER}
+` + keys.map(line).join("\n") + "\n";
+  }
+  const seen = /* @__PURE__ */ new Set();
+  const out = existing.split("\n").map((existingLine) => {
+    const eq = existingLine.indexOf("=");
+    if (eq === -1)
+      return existingLine;
+    const lhs = existingLine.slice(0, eq);
+    const exported = /^\s*export\s+/.exec(lhs);
+    const prefix = exported === null ? "" : exported[0];
+    const key = lhs.slice(prefix.length).trim();
+    if (desired.has(key)) {
+      seen.add(key);
+      return `${prefix}${line(key)}`;
+    }
+    return existingLine;
+  });
+  const missing = keys.filter((k) => !seen.has(k));
+  if (missing.length > 0) {
+    const trailingBlank = out.length > 0 && out[out.length - 1] === "";
+    const prefix = trailingBlank ? "" : existing.endsWith("\n") ? "" : "\n";
+    out.push(`${prefix}${ENV_HEADER}
+` + missing.map(line).join("\n"));
+  }
+  let result = out.join("\n");
+  if (existing.endsWith("\n") && !result.endsWith("\n"))
+    result += "\n";
+  return result;
+}
+function readEngagementEnv(engagementId, home) {
+  try {
+    return parseEnvText(readFileSync(engagementEnvPath(engagementId, home), "utf-8"));
+  } catch {
+    return null;
+  }
+}
+function writeEngagementEnv(engagementId, values, home) {
+  const path = engagementEnvPath(engagementId, home);
+  const dir = engagementStateDir(engagementId, home);
+  mkdirSync(dir, { recursive: true, mode: 448 });
+  let existing;
+  try {
+    existing = readFileSync(path, "utf-8");
+  } catch {
+    existing = null;
+  }
+  const reconciled = reconcileEnvText(existing, values);
+  const outcome = existing === reconciled ? "skipped" : "written";
+  if (outcome === "written") {
+    writeFileSync(path, reconciled, { mode: 384 });
+  }
+  applyOwnerOnly(path, dir);
+  return outcome;
+}
+function applyOwnerOnly(path, dir) {
+  if (platform2() === "win32")
+    return;
+  try {
+    chmodSync(path, 384);
+  } catch {
+  }
+  try {
+    chmodSync(dir, 448);
+  } catch {
+  }
+}
+function engagementResolutionShell() {
+  return `# --- Halfcycle credential resolution (generated; do not edit) ----------------
+# THE CREDENTIAL IS NOT IN THIS REPOSITORY. It lives at
+#   $HOME/.halfcycle/${ENGAGEMENTS_DIR}/<engagement-id>/${ENV_FILENAME}
+# written owner-only by \`npx halfcycle\`. What this repository holds is the
+# engagement id, in the committed .halfcycle/bundle.json. So: read the id out of
+# the pin, then name the file. There is no jq here and node is not dependable on a
+# desktop session's PATH, so the id is cut out with sed \u2014 after flattening the
+# file, because sed is line-oriented and the pin's line breaks are not a contract.
+#
+# Sets HALFCYCLE_ENV_FILE, HALFCYCLE_ENV_ENGAGEMENT and HALFCYCLE_ENV_PROBLEM in
+# the CALLER's shell and returns a status. Call it as \`if halfcycle_env_file \u2026\`,
+# never as \`$(halfcycle_env_file \u2026)\` \u2014 a command substitution is a subshell and
+# would discard everything it set.
+halfcycle_env_file() {
+  HALFCYCLE_ENV_FILE=""
+  HALFCYCLE_ENV_ENGAGEMENT=""
+  HALFCYCLE_ENV_PROBLEM=""
+  hc_pin="$1/.halfcycle/bundle.json"
+  if [ ! -f "$hc_pin" ]; then
+    HALFCYCLE_ENV_PROBLEM="no-pin"
+    return 1
+  fi
+  hc_id=$(tr -d '\\n' < "$hc_pin" | sed -n 's/.*"${PIN_ENGAGEMENT_ID_FIELD}"[[:space:]]*:[[:space:]]*"\\([^"]*\\)".*/\\1/p')
+  if [ -z "$hc_id" ]; then
+    HALFCYCLE_ENV_PROBLEM="no-id"
+    return 1
+  fi
+  HALFCYCLE_ENV_ENGAGEMENT="$hc_id"
+  if [ -z "\${HOME:-}" ]; then
+    HALFCYCLE_ENV_PROBLEM="no-home"
+    return 1
+  fi
+  hc_env="$HOME/.halfcycle/${ENGAGEMENTS_DIR}/$hc_id/${ENV_FILENAME}"
+  if [ ! -f "$hc_env" ]; then
+    HALFCYCLE_ENV_PROBLEM="no-credential"
+    return 1
+  fi
+  HALFCYCLE_ENV_FILE="$hc_env"
+  return 0
+}
+# --- end Halfcycle credential resolution ------------------------------------`;
+}
+
+// dist/identity.js
+import { execFileSync } from "node:child_process";
+import { existsSync, readFileSync as readFileSync2 } from "node:fs";
+import { join as join3 } from "node:path";
+import { randomUUID } from "node:crypto";
+var PROJECT_IDENTITY_NOTE = 'projectId is NOT the engagement id \u2014 it identifies this repository/worktree to Halfcycle, not an engagement. The engagement id lives in .halfcycle/bundle.json, in its "engagementId" field.';
+function git(targetRepoRoot, args) {
+  try {
+    const out = execFileSync("git", ["-C", targetRepoRoot, ...args], {
+      encoding: "utf-8",
+      stdio: ["ignore", "pipe", "ignore"]
+    });
+    const trimmed = out.trim();
+    return trimmed.length > 0 ? trimmed : null;
+  } catch {
+    return null;
+  }
+}
+function readRootCommit(targetRepoRoot) {
+  const roots = git(targetRepoRoot, ["rev-list", "--max-parents=0", "HEAD"]);
+  if (!roots)
+    return null;
+  const lines = roots.split("\n").filter((l) => l.length > 0);
+  return lines.length > 0 ? lines[lines.length - 1] : null;
+}
+function readRemote(targetRepoRoot) {
+  return git(targetRepoRoot, ["remote", "get-url", "origin"]);
+}
+function mintOrReadIdentity(targetRepoRoot) {
+  const path = join3(targetRepoRoot, ".halfcycle", "project.json");
+  if (existsSync(path)) {
+    const onDisk = JSON.parse(readFileSync2(path, "utf-8"));
+    const identity2 = {
+      projectId: onDisk.projectId ?? "",
+      rootCommit: onDisk.rootCommit ?? null,
+      remote: onDisk.remote ?? null,
+      note: PROJECT_IDENTITY_NOTE
+    };
+    return { identity: identity2, minted: false };
+  }
+  const identity = {
+    projectId: randomUUID(),
+    rootCommit: readRootCommit(targetRepoRoot),
+    remote: readRemote(targetRepoRoot),
+    note: PROJECT_IDENTITY_NOTE
+  };
+  return { identity, minted: true };
+}
+
+// dist/mcp-endpoint.js
+var MCP_ENDPOINT_PATH = "/mcp";
+function mcpEndpointUrl(origin) {
+  return `${origin.trim().replace(/\/+$/, "")}${MCP_ENDPOINT_PATH}`;
+}
+
+// dist/merge-settings.js
+function isHalfcycleEntry(entry, halfcycleCommands) {
+  return entry.hooks.some((h) => halfcycleCommands.has(h.command));
+}
+function mergeSettings(existing, generated) {
+  const merged = { ...existing };
+  if (generated.$schema !== void 0) {
+    merged.$schema = generated.$schema;
+  }
+  const generatedHooks = generated.hooks ?? {};
+  const halfcycleCommands = /* @__PURE__ */ new Set();
+  for (const entries of Object.values(generatedHooks)) {
+    for (const entry of entries) {
+      for (const h of entry.hooks)
+        halfcycleCommands.add(h.command);
+    }
+  }
+  const existingHooks = existing.hooks ?? {};
+  const mergedHooks = {};
+  const events = /* @__PURE__ */ new Set([...Object.keys(existingHooks), ...Object.keys(generatedHooks)]);
+  for (const event of events) {
+    const developerEntries = (existingHooks[event] ?? []).filter((entry) => !isHalfcycleEntry(entry, halfcycleCommands));
+    const halfcycleEntries = generatedHooks[event] ?? [];
+    mergedHooks[event] = [...developerEntries, ...halfcycleEntries];
+  }
+  merged.hooks = mergedHooks;
+  merged.permissions = mergePermissions(existing.permissions, generated.permissions);
+  return merged;
+}
+function mergePermissions(existing, generated) {
+  if (existing === void 0 && generated === void 0)
+    return void 0;
+  const result = { ...existing ?? {} };
+  const generatedDeny = generated?.deny ?? [];
+  if (generatedDeny.length > 0) {
+    const theirs = existing?.deny ?? [];
+    const seen = new Set(theirs);
+    result.deny = [...theirs, ...generatedDeny.filter((p) => !seen.has(p))];
+  }
+  return result;
+}
+
+// dist/scan.js
+import { existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync3, writeFileSync as writeFileSync2 } from "node:fs";
+import { join as join4 } from "node:path";
+
+// ../events/dist/result.js
+import { z as z2 } from "zod";
+
+// ../core/dist/guard-record.js
+import { z } from "zod";
+var severitySchema = z.enum(["info", "warn", "block"]);
+var channelSchema = z.enum(["stable", "candidate", "rented"]);
+var matcherKindSchema = z.enum(["grep", "ast", "integrationTest", "llm"]);
+var matcherConfigSchema = z.record(z.string(), z.unknown());
+var grepMatcherSchema = z.object({ kind: z.literal("grep"), config: matcherConfigSchema }).strict();
+var astMatcherSchema = z.object({ kind: z.literal("ast"), config: matcherConfigSchema }).strict();
+var integrationTestMatcherSchema = z.object({ kind: z.literal("integrationTest"), config: matcherConfigSchema }).strict();
+var llmMatcherSchema = z.object({ kind: z.literal("llm"), config: matcherConfigSchema }).strict();
+var matcherSchema = z.discriminatedUnion("kind", [
+  grepMatcherSchema,
+  astMatcherSchema,
+  integrationTestMatcherSchema,
+  llmMatcherSchema
+]);
+
+// ../events/dist/result.js
+var firedGuardSchema = z2.object({
+  guardId: z2.string(),
+  patternRef: z2.string(),
+  severity: severitySchema,
+  explanation: z2.string()
+}).strict();
+var resultEnvelopeSchema = z2.object({
+  guardsFired: z2.array(firedGuardSchema),
+  severity: severitySchema.nullable(),
+  blocking: z2.boolean(),
+  explanation: z2.string()
+}).strict();
+var wireErrorSchema = z2.object({
+  statusCode: z2.number(),
+  error: z2.string(),
+  message: z2.string()
+}).strict();
+
+// ../events/dist/telemetry.js
+import { z as z3 } from "zod";
+var utcIso8601 = z3.string().regex(/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?Z$/, "must be a UTC ISO-8601 timestamp ending in Z (INV-015)");
+var guardEvalOutcomeSchema = z3.enum([
+  "evaluated",
+  "infra-error",
+  "contract-error",
+  "unconfigured"
+]);
+var guardEvalRunSchema = z3.object({
+  // `runId`/`outcome` are the E2 run-observability additions, declared
+  // field-level-OPTIONAL as the FIRST (expand) step of an expand-contract
+  // migration. Every new record populated by the migrated writer (T-07)
+  // carries both; a legacy line predating the amendment carries neither and
+  // must still parse (the mixed-era guard-eval log the Build-Record reader
+  // assembles from, and the runner emit not yet migrated). So the presence
+  // refinement below is skipped for a legacy line (no `outcome`), and the
+  // per-writer guarantee lives with the writer + reader-normalisation (T-07),
+  // where the schema may then be tightened to required. runId is uuid-checked
+  // WHEN present; outcome is enum-checked when present.
+  runId: z3.string().uuid().optional(),
+  engagementId: z3.string().optional(),
+  runType: z3.enum(["hook", "ci"]),
+  occurredAt: utcIso8601,
+  outcome: guardEvalOutcomeSchema.optional(),
+  failureReason: z3.string().optional(),
+  phase: z3.string().optional(),
+  scope: z3.record(z3.string(), z3.unknown()),
+  cost: z3.record(z3.string(), z3.unknown()).optional(),
+  result: resultEnvelopeSchema.optional()
+}).strict().superRefine((run, ctx) => {
+  if (run.outcome === void 0)
+    return;
+  if (run.outcome === "evaluated" && run.result === void 0) {
+    ctx.addIssue({
+      code: z3.ZodIssueCode.custom,
+      path: ["result"],
+      message: "result is required when outcome is 'evaluated'"
+    });
+  }
+  if (run.outcome !== "evaluated" && run.result !== void 0) {
+    ctx.addIssue({
+      code: z3.ZodIssueCode.custom,
+      path: ["result"],
+      message: "result is only present when outcome is 'evaluated'"
+    });
+  }
+  if (run.outcome !== "unconfigured" && run.engagementId === void 0) {
+    ctx.addIssue({
+      code: z3.ZodIssueCode.custom,
+      path: ["engagementId"],
+      message: "engagementId is required unless outcome is 'unconfigured'"
+    });
+  }
+});
+
+// dist/scan.js
+var HALFCYCLE_STATE_FORMAT = "halfcycle-state-file/v1";
+var HALFCYCLE_STATE_NOTE = [
+  "This file is a local cache written ONCE when Halfcycle was installed. It is not a",
+  "record of what this project has done, and it is never updated as work happens.",
+  'An empty or missing "layers" means the install-time scan found no pre-existing',
+  "artefacts on disk \u2014 it does NOT mean nothing has been done since, and it is not",
+  "evidence that any step is unfinished or any approval is outstanding.",
+  "The authoritative position lives in the Halfcycle service: call the",
+  "halfcycle_resolve tool to ask where this project stands. Do not answer that",
+  "question from this file."
+].join(" ");
+var LAYER_ARTEFACT_PATHS = {
+  l0: ["ENGAGEMENT.md"],
+  l1: ["docs/product-spec.md"],
+  l2: ["docs/architecture-overview.md"],
+  l3: ["docs/invariants.md"],
+  l4: ["docs/features"],
+  l5: ["docs/phases"]
+};
+function scanLayers(targetRepo, scannedAt = (/* @__PURE__ */ new Date()).toISOString()) {
+  const layers = {};
+  for (const [layer, paths] of Object.entries(LAYER_ARTEFACT_PATHS)) {
+    const found = paths.filter((p) => existsSync2(join4(targetRepo, p)));
+    if (found.length > 0) {
+      layers[layer] = {
+        value: "asserted",
+        source: "bootstrap-scan",
+        foundPaths: found,
+        scannedAt
+      };
+    }
+  }
+  return { format: HALFCYCLE_STATE_FORMAT, note: HALFCYCLE_STATE_NOTE, layers };
+}
+function runBootstrapScan(targetRepo) {
+  const statePath = join4(targetRepo, ".halfcycle", "state.json");
+  if (existsSync2(statePath)) {
+    const existing = JSON.parse(readFileSync3(statePath, "utf-8"));
+    return { state: existing, ran: false };
+  }
+  const state = scanLayers(targetRepo);
+  mkdirSync2(join4(targetRepo, ".halfcycle"), { recursive: true });
+  writeFileSync2(statePath, JSON.stringify(state, null, 2) + "\n", "utf-8");
+  return { state, ran: true };
+}
+function mergeWithRecords(state, layersWithRealRecords) {
+  const merged = {};
+  const allLayers = /* @__PURE__ */ new Set([
+    ...Object.keys(state.layers),
+    ...layersWithRealRecords
+  ]);
+  for (const layer of allLayers) {
+    if (layersWithRealRecords.has(layer)) {
+      merged[layer] = "complete";
+    } else if (state.layers[layer]) {
+      merged[layer] = "asserted";
+    }
+  }
+  return merged;
+}
+
+// dist/install.js
+var ZONE_B_DIR = ".workbench";
+var __filename = fileURLToPath(import.meta.url);
+var __dirname = dirname2(__filename);
+function findBundleRoot(startDir) {
+  let candidate = startDir;
+  for (let i = 0; i < 4; i++) {
+    const manifest = join5(candidate, ".claude-plugin", "plugin.json");
+    try {
+      if (existsSync3(manifest))
+        return candidate;
+    } catch {
+    }
+    candidate = dirname2(candidate);
+  }
+  return join5(startDir, "..");
+}
+var BUNDLE_ROOT = findBundleRoot(__dirname);
+function resolveVendoredBinary() {
+  const candidates = [
+    join5(BUNDLE_ROOT, "bin", "bin.bundle.mjs"),
+    join5(BUNDLE_ROOT, "..", "runner", "dist", "bin.bundle.mjs")
+  ];
+  for (const candidate of candidates) {
+    if (existsSync3(candidate))
+      return candidate;
+  }
+  throw new Error(`[bundle install] Cannot find the self-contained guard binary bin.bundle.mjs. Run the runner's "bundle" script (pnpm --filter @halfcycle/runner run build) so the vendored artefact exists before installing. Looked in: ${candidates.join(", ")}.`);
+}
+var WRITE_ALLOWLIST = [
+  ".claude/commands",
+  ".claude/hooks",
+  ".claude/settings.json",
+  ".halfcycle",
+  ".halfcycle/bundle.json",
+  ".halfcycle/bin",
+  "docs/build-records",
+  "test/fixtures/captured",
+  ".env.example",
+  ".mcp.json",
+  ZONE_B_DIR
+];
+function isAllowlisted(targetRelPath) {
+  const normalised = targetRelPath.replace(/\\/g, "/");
+  return WRITE_ALLOWLIST.some((prefix) => {
+    const p = prefix.replace(/\\/g, "/");
+    return normalised === p || normalised.startsWith(p + "/");
+  });
+}
+function readPluginManifest() {
+  const manifestPath = join5(BUNDLE_ROOT, ".claude-plugin", "plugin.json");
+  const raw = readFileSync4(manifestPath, "utf-8");
+  return JSON.parse(raw);
+}
+function copyManifestCommands(manifest, targetRepo, report) {
+  const commandsTargetDir = join5(targetRepo, ".claude", "commands");
+  for (const cmd of manifest.commands ?? []) {
+    const srcFile = join5(BUNDLE_ROOT, ".claude-plugin", cmd.path);
+    if (!existsSync3(srcFile)) {
+      throw new Error(`[bundle install] plugin.json declares command "${cmd.name}" at "${cmd.path}", but no file exists there (${srcFile}). The manifest and commands/ must agree.`);
+    }
+    const destFile = join5(commandsTargetDir, `${cmd.name}.md`);
+    const content = readFileSync4(srcFile, "utf-8");
+    const rel = relative(targetRepo, destFile).replace(/\\/g, "/");
+    record(report, writeCollisionSafe(destFile, targetRepo, content), rel);
+  }
+}
+function writeAllowlisted(targetAbsPath, targetRepoRoot, content, writtenPaths) {
+  const rel = relative(targetRepoRoot, targetAbsPath).replace(/\\/g, "/");
+  if (!isAllowlisted(rel)) {
+    throw new Error(`[bundle install] Write-allowlist violation: attempted to write "${rel}". Only the method surface and scaffolding paths are writable.`);
+  }
+  mkdirSync3(dirname2(targetAbsPath), { recursive: true });
+  writeFileSync3(targetAbsPath, content, "utf-8");
+  writtenPaths.push(rel);
+}
+function writeCollisionSafe(targetAbsPath, targetRepoRoot, content) {
+  const rel = relative(targetRepoRoot, targetAbsPath).replace(/\\/g, "/");
+  if (!isAllowlisted(rel)) {
+    throw new Error(`[bundle install] Write-allowlist violation: attempted to write "${rel}". Only the method surface and scaffolding paths are writable.`);
+  }
+  if (existsSync3(targetAbsPath)) {
+    const current = readFileSync4(targetAbsPath, "utf-8");
+    return current === content ? "skipped" : "collided";
+  }
+  mkdirSync3(dirname2(targetAbsPath), { recursive: true });
+  writeFileSync3(targetAbsPath, content, "utf-8");
+  return "written";
+}
+function record(report, outcome, rel) {
+  const bucket = {
+    written: report.writtenPaths,
+    skipped: report.skippedPaths,
+    collided: report.collidedPaths
+  };
+  bucket[outcome].push(rel);
+}
+var DENY_PATTERNS = [
+  "Bash(rm -rf:*)",
+  "Bash(git push --force:*)",
+  "Bash(git push -f:*)",
+  "Bash(git reset --hard:*)",
+  "Bash(pnpm publish:*)",
+  "Bash(npm publish:*)",
+  "Bash(gh repo delete:*)",
+  "Bash(git push --no-verify:*)",
+  "Bash(git commit --no-verify:*)"
+];
+var WRITE_CAPABLE_TOOLS = ["Edit", "MultiEdit", "NotebookEdit", "Write"];
+var USER_PROMPT_REMINDER_SENTENCE = "Where this project stands, and what order to work in, is recorded in the Halfcycle service and nowhere in this repository \u2014 call halfcycle_resolve before you answer or plan, because the files here will look complete and current and still be wrong about position.";
+function generateSettingsJson() {
+  const settings = {
+    $schema: "https://json.schemastore.org/claude-code-settings.json",
+    permissions: {
+      // deny ONLY. See DENY_PATTERNS — an allow list evaporates under bypass mode
+      // and is the machine owner's grant to make, not ours.
+      deny: [...DENY_PATTERNS]
+    },
+    hooks: {
+      SessionStart: [
+        {
+          hooks: [
+            {
+              type: "command",
+              command: "bash ./.claude/hooks/session-start-marker.sh",
+              timeout: 5
+            }
+          ]
+        }
+      ],
+      UserPromptSubmit: [
+        {
+          hooks: [
+            {
+              type: "command",
+              command: "bash ./.claude/hooks/user-prompt-reminder.sh",
+              timeout: 5
+            }
+          ]
+        }
+      ],
+      PostToolUse: [
+        {
+          matcher: WRITE_CAPABLE_TOOLS.join("|"),
+          hooks: [
+            {
+              type: "command",
+              command: "bash ./.claude/hooks/guard-runner.sh hook post-tool-use",
+              timeout: 60
+            }
+          ]
+        }
+      ],
+      SubagentStop: [
+        {
+          hooks: [
+            {
+              type: "command",
+              command: "bash ./.claude/hooks/guard-runner.sh hook subagent-stop",
+              timeout: 60
+            }
+          ]
+        }
+      ]
+    }
+  };
+  return JSON.stringify(settings, null, 2) + "\n";
+}
+var VENDORED_BIN_REL = ".halfcycle/bin/bin.bundle.mjs";
+function generateGuardRunnerWrapper() {
+  return `#!/usr/bin/env bash
+# Governance hook wrapper \u2014 generated by the Halfcycle installer.
+#
+# Loads this engagement's credentials so the guard runner has its GUARD_SERVICE_*
+# values when Claude Code fires PostToolUse / SubagentStop, then exec's the
+# SELF-CONTAINED binary vendored at ${VENDORED_BIN_REL} \u2014 a path inside this
+# project, so the hook resolves in any checkout of it.
+#
+# The runner itself reads only process.env, so env loading lives here in the hook
+# wiring rather than inside the binary.
+#
+# NO CREDENTIAL LIVES IN THIS REPOSITORY. See the resolution block below.
+PROJECT_DIR="\${CLAUDE_PROJECT_DIR:-.}"
+
+${engagementResolutionShell()}
+
+# A missing store is NOT an error here: on a CI runner there is no per-user store
+# and the credentials arrive in the environment instead. Exec either way and let
+# the runner say what it found \u2014 its never-configured branch is loud and non-zero
+# on purpose, and a wrapper that exited quietly here would hide it.
+if halfcycle_env_file "$PROJECT_DIR"; then
+  set -a
+  . "$HALFCYCLE_ENV_FILE"
+  set +a
+fi
+
+exec node "$PROJECT_DIR/${VENDORED_BIN_REL}" "$@"
+`;
+}
+function generateSessionStartMarker() {
+  return `#!/usr/bin/env bash
+# Session-start marker \u2014 generated by the Halfcycle installer.
+# Writes the current git HEAD SHA to a temp file so SubagentStop can
+# diff against session-start rather than just HEAD at stop time.
+REPO_ROOT="\${CLAUDE_PROJECT_DIR:-$(git rev-parse --show-toplevel 2>/dev/null)}"
+if [ -z "$REPO_ROOT" ]; then exit 0; fi
+HASH="$(echo -n "$REPO_ROOT" | shasum -a 256 | cut -c1-12)"
+MARKER_FILE="\${TMPDIR%/}/halfcycle-session-\${HASH}.ref"
+git -C "$REPO_ROOT" rev-parse HEAD > "$MARKER_FILE" 2>/dev/null || true
+exit 0
+`;
+}
+function generateUserPromptReminderHook() {
+  return `#!/usr/bin/env bash
+# UserPromptSubmit house-rule reminder \u2014 generated by the Halfcycle installer.
+#
+# Injects ONE plain-text sentence into context on every prompt (F-2(c),
+# W8-T-05b) \u2014 the per-turn twin of the house rule W8-T-05a put in the client's
+# CLAUDE.md, in its "Top rules (read first)" block. Byte-identical sentence,
+# one home: RULE_SENTENCE_PLAIN in the method repo's own position-house-rule
+# test governs it \u2014 reword there and here together, in the same commit.
+#
+# FAILS OPEN. This hook's stdout is always plain text, never JSON, so it
+# cannot form a {"decision":"block",...} body (UserPromptSubmit's only way to
+# hold the turn). But a write failure here (a closed stdout, say) must still
+# never wedge or stall a session, so any error exits 0 with no output rather
+# than propagate.
+trap 'exit 0' ERR
+set -e
+printf '%s\\n' '${USER_PROMPT_REMINDER_SENTENCE}'
+exit 0
+`;
+}
+function generateCiStanza() {
+  return `# Halfcycle guard CI job \u2014 generated by the Halfcycle installer.
+# Paste this job into your CI workflow. It assumes no package manager and no
+# monorepo tooling: it runs the self-contained guard binary vendored at
+# .halfcycle/bin/, so it works in a Python or Go repository as well as a Node
+# one \u2014 the only prerequisite is Node 20 to run the bundled binary.
+#
+# WHICH BRANCH MODEL THIS ASSUMES: none. It works on pull-request branches AND on
+# commits pushed straight to the default branch, which is the shape most
+# Halfcycle engagements settle on. \`fetch-depth\` is what makes that true: the
+# check needs the commit BEFORE the one it is evaluating, and the default
+# shallow checkout does not have it. With \`fetch-depth: 0\` the check fails loudly
+# if it cannot work out what to evaluate \u2014 it will not pass quietly having
+# evaluated nothing.
+#
+# halfcycle-guard-ci:
+#   runs-on: ubuntu-latest
+#   steps:
+#     - uses: actions/checkout@v4
+#       with:
+#         # REQUIRED. 0 = full history. The check diffs against the commit before
+#         # HEAD (or the fork point on a branch); the default depth of 1 has
+#         # neither. Do not lower this.
+#         fetch-depth: 0
+#     - uses: actions/setup-node@v4
+#       with:
+#         node-version: '20'
+#     - name: Halfcycle guard CI check
+#       env:
+#         GUARD_SERVICE_URL: \${{ secrets.GUARD_SERVICE_URL }}
+#         GUARD_SERVICE_TOKEN: \${{ secrets.GUARD_SERVICE_TOKEN }}
+#         GUARD_ENGAGEMENT_ID: \${{ secrets.GUARD_ENGAGEMENT_ID }}
+#       run: node ./.halfcycle/bin/bin.bundle.mjs ci
+#
+# The job prints the diff base it used and how many files it evaluated, on every
+# run. If that line says 0 files on a commit that changed something, the base is
+# wrong \u2014 set HALFCYCLE_DIFF_BASE in the env block above to name it explicitly
+# (on a GitHub push event, \${{ github.event.before }} is the right value).
+`;
+}
+var ENV_EXAMPLE_NAMES = [
+  "GUARD_SERVICE_URL",
+  "GUARD_SERVICE_TOKEN",
+  "GUARD_ENGAGEMENT_ID",
+  "HALFCYCLE_SERVICE_URL",
+  "HALFCYCLE_MCP_URL",
+  "HALFCYCLE_TOKEN",
+  // T-10 — declared because it is now WRITTEN into the credential store, and
+  // `install-guard-config.test.ts`'s INV-004 check requires every written name to
+  // be named here too (`HALFCYCLE_ENGAGEMENT_ID` is the one deliberate exception,
+  // recorded in the spec). Optional at runtime — the runner's own telemetry
+  // emission is fail-open when it is absent — but a name that is written and never
+  // declared is exactly what this generated section exists to prevent.
+  "CONTROL_TELEMETRY_URL"
+];
+function generateEnvExampleSection() {
+  return `
+# ---------------------------------------------------------------------------
+# Halfcycle runner (generated by the Halfcycle installer \u2014 names only, no values)
+# ---------------------------------------------------------------------------
+# YOU DO NOT NEED TO SET ANY OF THESE ON YOUR OWN MACHINE, and there is nowhere in
+# this repository to put them. \`npx halfcycle\` writes this engagement's credential
+# to $HOME/.halfcycle, owner-only, outside every checkout; the guard hook and the
+# MCP headers helper read it from there. Nothing Halfcycle writes a secret into
+# this tree, so there is no file here to leak, ignore or clean up.
+#
+# These names are declared because they ARE read from the environment in one
+# place: a CI job, which has no browser and no per-user store and supplies them as
+# workflow secrets (see .halfcycle/ci-stanza.yml). HALFCYCLE_TOKEN set in the
+# environment also takes precedence over the stored credential everywhere, which is
+# the escape hatch for running as a specific identity.
+GUARD_SERVICE_URL=<argType:runtime>
+GUARD_SERVICE_TOKEN=<argType:runtime>
+GUARD_ENGAGEMENT_ID=<argType:runtime>
+# TWO ORIGINS, TWO SERVICES (T-22). HALFCYCLE_SERVICE_URL is the Halfcycle
+# CONTROL plane \u2014 it serves engagement creation and the board's first-visit
+# code. HALFCYCLE_MCP_URL is the method-delivery service, which serves /mcp and
+# nothing else here. You configure the first; the platform reports the second on
+# create, so it is written for you and .mcp.json carries the composed address.
+HALFCYCLE_SERVICE_URL=<argType:runtime>
+HALFCYCLE_MCP_URL=<argType:runtime>
+HALFCYCLE_TOKEN=<argType:runtime>
+# CONTROL_TELEMETRY_URL (T-10) \u2014 the platform reports this on create/join, same as
+# HALFCYCLE_MCP_URL. OPTIONAL: absent, guard-eval telemetry is silently disabled
+# and the guard loop itself is unaffected \u2014 this name is declared only because it
+# is one this installer now writes to the machine-level store, same as every name
+# above it.
+CONTROL_TELEMETRY_URL=<argType:runtime>
+`;
+}
+var MCP_REGISTRATION_REL = ".mcp.json";
+var MCP_HEADERS_HELPER_REL = ".halfcycle/mcp-headers.sh";
+var MCP_HEADERS_HELPER_COMMAND = `/bin/sh -c 'd=$(pwd); while [ ! -f "$d/${MCP_HEADERS_HELPER_REL}" ] && [ "$d" != / ]; do d=$(dirname "$d"); done; [ -f "$d/${MCP_HEADERS_HELPER_REL}" ] || { echo "halfcycle: ${MCP_HEADERS_HELPER_REL} not found at or above $(pwd); re-run npx halfcycle" >&2; exit 1; }; exec /bin/sh "$d/${MCP_HEADERS_HELPER_REL}"'`;
+function generateMcpHeadersHelper() {
+  return `#!/bin/sh
+# Halfcycle MCP connection headers \u2014 generated by the Halfcycle installer.
+#
+# Claude Code runs this at MCP connection time, from the session's cwd, and merges
+# its stdout into the connection headers for the "halfcycle" server in .mcp.json.
+#
+# It exists because \${VAR} expansion in .mcp.json reads the PROCESS environment
+# only: nothing loads a credential into a session, so a referenced
+# \${HALFCYCLE_TOKEN} expanded to nothing and the server was silently absent from
+# the tool list.
+#
+# This file is tracked and holds NO secret. NEITHER DOES ANY OTHER FILE IN THIS
+# REPOSITORY (T-09): the credential lives at machine level, outside every checkout,
+# and this script READS one line out of it (never sources \u2014 a credential store is
+# not code).
+set -eu
+
+# The project root is resolved from THIS SCRIPT'S OWN LOCATION, never from the
+# caller's working directory. Claude Code runs the helper from the SESSION's cwd,
+# and a session started in a subdirectory still finds the root .mcp.json \u2014 so a
+# relative read here silently produced no credential for anyone who started the
+# session in any subdirectory of a monorepo.
+SCRIPT_DIR=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
+PROJECT_ROOT=$(CDPATH= cd -- "$SCRIPT_DIR/.." && pwd)
+
+${engagementResolutionShell()}
+
+# HALFCYCLE_TOKEN in the environment WINS, and it is the CI arm: a job with no
+# browser and no per-user store exports the credential, and a stale store on a
+# long-lived runner must not silently win over it. Same order, and the same reason,
+# as the CLI's own resolver (\`resolve-credential.ts\`).
+TOKEN=\${HALFCYCLE_TOKEN:-}
+
+if [ -z "$TOKEN" ]; then
+  if ! halfcycle_env_file "$PROJECT_ROOT"; then
+    case $HALFCYCLE_ENV_PROBLEM in
+      no-pin)
+        echo "halfcycle: no .halfcycle/bundle.json in $PROJECT_ROOT, so this repository has no Halfcycle engagement." >&2
+        echo "halfcycle: run \\"npx halfcycle\\" here to install one." >&2 ;;
+      no-id)
+        echo "halfcycle: $PROJECT_ROOT/.halfcycle/bundle.json names no engagement id." >&2
+        echo "halfcycle: run \\"npx halfcycle\\" here to rewrite it." >&2 ;;
+      no-home)
+        echo "halfcycle: HOME is not set, so the credential store cannot be located." >&2 ;;
+      *)
+        echo "halfcycle: this machine holds no credential for engagement $HALFCYCLE_ENV_ENGAGEMENT." >&2
+        echo "halfcycle: run \\"npx halfcycle\\" in this repository \u2014 it will sign you in through your browser if needed, and write the credential to $HOME/.halfcycle, outside this repository." >&2 ;;
+    esac
+    exit 1
+  fi
+  ENV_FILE="$HALFCYCLE_ENV_FILE"
+
+  # Last assignment wins, matching the shell's own \`.\` semantics. An optional
+  # leading \`export \` is tolerated because a hand-edited store may use one.
+  LINE=$(grep '^[[:space:]]*\\(export[[:space:]][[:space:]]*\\)\\{0,1\\}HALFCYCLE_TOKEN=' "$ENV_FILE" | tail -n 1)
+  TOKEN=\${LINE#*HALFCYCLE_TOKEN=}
+  TOKEN=$(printf '%s' "$TOKEN" | tr -d '\\r')
+
+  # Strip one layer of matching quotes. The store is WRITTEN single-quoted (both
+  # writers use the same shq: this installer and Studio's provider), because
+  # guard-runner.sh SOURCES the same file and an unquoted value carrying a space
+  # would execute its own remainder. This reader greps rather than sources, so it
+  # has to undo the quoting itself \u2014 and it must land on the same value the
+  # sourcing consumer gets, or one file has two answers.
+  case $TOKEN in
+    '"'*'"') TOKEN=\${TOKEN#'"'}; TOKEN=\${TOKEN%'"'} ;;
+    "'"*"'")
+      TOKEN=\${TOKEN#"'"}; TOKEN=\${TOKEN%"'"}
+      # \u2026and undo shq's embedded-quote escape, '\\'' -> '. The backslash is matched
+      # through a BRACKET EXPRESSION on purpose. MEASURED, on GNU sed 4.9 (Linux,
+      # the CI platform) and BSD sed (macOS), feeding each the script from a file so
+      # no shell quoting is in the way:
+      #
+      #   s/'[\\]''/'/g   a'\\''b -> a'b     both      <- shipped
+      #   s/'\\''/'/g     a'\\''b -> a'\\''b   both      <- matches NOTHING, exit 0
+      #
+      # A bare \\' in a BRE is undefined by POSIX, and the obvious pattern therefore
+      # does not fail loudly \u2014 it silently substitutes nothing, on BOTH platforms,
+      # and the token then travels with four stray characters in it. The bracket
+      # expression makes the backslash literal by a construction POSIX does define.
+      TOKEN=$(printf '%s' "$TOKEN" | sed "s/'[\\]''/'/g") ;;
+  esac
+
+  if [ -z "$TOKEN" ]; then
+    echo "halfcycle: HALFCYCLE_TOKEN is absent or empty in $ENV_FILE." >&2
+    echo "halfcycle: run \\"npx halfcycle\\" in this repository to rewrite this machine's credential." >&2
+    exit 1
+  fi
+fi
+
+# JSON-escape: backslash first, then double quote. A token carrying either would
+# otherwise emit invalid JSON, and invalid JSON is dropped SILENTLY \u2014 the
+# connection succeeds carrying no Authorization header at all.
+ESCAPED=$(printf '%s' "$TOKEN" | sed -e 's/\\\\/\\\\\\\\/g' -e 's/"/\\\\"/g')
+
+printf '{"Authorization":"Bearer %s"}\\n' "$ESCAPED"
+`;
+}
+function generateMcpRegistration(existing, mcpOrigin) {
+  let base = { mcpServers: {} };
+  if (existing !== null) {
+    const parsed = JSON.parse(existing);
+    if (parsed !== null && typeof parsed === "object") {
+      base = { mcpServers: {}, ...parsed };
+    }
+  }
+  if (typeof base.mcpServers !== "object" || base.mcpServers === null) {
+    base.mcpServers = {};
+  }
+  base.mcpServers["halfcycle"] = {
+    type: "http",
+    url: mcpEndpointUrl(mcpOrigin),
+    headersHelper: MCP_HEADERS_HELPER_COMMAND
+  };
+  return JSON.stringify(base, null, 2) + "\n";
+}
+function reconcileEnvExample(targetRepo) {
+  const envExamplePath = join5(targetRepo, ".env.example");
+  const section = generateEnvExampleSection();
+  if (!existsSync3(envExamplePath)) {
+    mkdirSync3(dirname2(envExamplePath), { recursive: true });
+    writeFileSync3(envExamplePath, section.trimStart(), "utf-8");
+    return "written";
+  }
+  const existing = readFileSync4(envExamplePath, "utf-8");
+  const missing = ENV_EXAMPLE_NAMES.filter((name) => !existing.includes(name));
+  if (missing.length === 0)
+    return "skipped";
+  writeFileSync3(envExamplePath, existing + section, "utf-8");
+  return "written";
+}
+var REQUIRED_GITIGNORE_ENTRIES = [".halfcycle/state.json", `${ZONE_B_DIR}/`];
+function gitignoreCovers(content) {
+  const lines = new Set(content.split("\n").map((l) => l.trim()));
+  return REQUIRED_GITIGNORE_ENTRIES.every((entry) => lines.has(entry));
+}
+function reconcileGitignore(targetRepo) {
+  const gitignorePath = join5(targetRepo, ".gitignore");
+  const header = "# Halfcycle \u2014 machine-local secrets/state and Zone-B (never push to client remote)";
+  try {
+    if (!existsSync3(gitignorePath)) {
+      const body = [header, ...REQUIRED_GITIGNORE_ENTRIES].join("\n") + "\n";
+      writeFileSync3(gitignorePath, body, "utf-8");
+      return "written";
+    }
+    const existing = readFileSync4(gitignorePath, "utf-8");
+    if (gitignoreCovers(existing))
+      return "skipped";
+    const existingLines = new Set(existing.split("\n").map((l) => l.trim()));
+    const toAdd = REQUIRED_GITIGNORE_ENTRIES.filter((entry) => !existingLines.has(entry));
+    const suffix = (existing.endsWith("\n") ? "" : "\n") + `
+${header}
+` + toAdd.join("\n") + "\n";
+    writeFileSync3(gitignorePath, existing + suffix, "utf-8");
+    return "written";
+  } catch {
+    return "failed";
+  }
+}
+function writeBundlePin(targetRepoRoot, version, engagementId, engagementType, writtenPaths) {
+  const pin = {
+    version,
+    engagementId,
+    engagementType,
+    installedAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  const pinPath = join5(targetRepoRoot, ".halfcycle", "bundle.json");
+  writeAllowlisted(pinPath, targetRepoRoot, JSON.stringify(pin, null, 2) + "\n", writtenPaths);
+}
+function readBundlePin(targetRepoRoot) {
+  const pinPath = join5(targetRepoRoot, ".halfcycle", "bundle.json");
+  if (!existsSync3(pinPath))
+    return null;
+  return JSON.parse(readFileSync4(pinPath, "utf-8"));
+}
+var CREDENTIAL_REQUIRED_KEYS = [
+  "HALFCYCLE_SERVICE_URL",
+  "HALFCYCLE_TOKEN",
+  "HALFCYCLE_MCP_URL",
+  "GUARD_SERVICE_URL"
+];
+function missingRequiredKeys(found) {
+  const serviceUrl = (process.env["HALFCYCLE_SERVICE_URL"]?.trim() ?? "") || (found["HALFCYCLE_SERVICE_URL"] ?? "");
+  const resolved = { ...found, HALFCYCLE_SERVICE_URL: serviceUrl };
+  return CREDENTIAL_REQUIRED_KEYS.filter((key) => (resolved[key] ?? "") === "");
+}
+function checkDrift(targetRepoRoot) {
+  const manifest = readPluginManifest();
+  const pin = readBundlePin(targetRepoRoot);
+  const installed = pin?.version ?? null;
+  const current = manifest.version;
+  return { drifted: installed !== current, installed, current };
+}
+function writeProjectIdentity(targetRepo) {
+  const path = join5(targetRepo, ".halfcycle", "project.json");
+  const { identity } = mintOrReadIdentity(targetRepo);
+  const serialized = JSON.stringify(identity, null, 2) + "\n";
+  if (existsSync3(path) && readFileSync4(path, "utf-8") === serialized)
+    return "skipped";
+  writeFileSync3(path, serialized, "utf-8");
+  return "written";
+}
+function writeEngagementCredential(credential, engagementId, home) {
+  const values = {
+    HALFCYCLE_SERVICE_URL: credential.serviceUrl,
+    // T-22 — the second origin, persisted for the developer and for any tool that
+    // wants it by name. NOTHING EXPANDS IT ANY MORE: since T-24 the installer
+    // composes the endpoint and writes it into `.mcp.json` as a literal, so this
+    // key no longer feeds the registration. (It read "the registration expands to
+    // `/mcp` against an empty string" until T-24 removed the expansion; a comment
+    // describing a mechanism that no longer exists is how the next reader builds
+    // on a claim that is not true.)
+    HALFCYCLE_MCP_URL: credential.mcpUrl,
+    HALFCYCLE_TOKEN: credential.token,
+    HALFCYCLE_ENGAGEMENT_ID: engagementId,
+    // FW-4 (F-29) — the three the hook this same module generates requires. The
+    // guard origin is a third deployed service the platform reports on create;
+    // the token is the one per-engagement credential under the name the runner
+    // reads; the id is the engagement the guard service binds the body to.
+    GUARD_SERVICE_URL: credential.guardUrl,
+    GUARD_SERVICE_TOKEN: credential.token,
+    GUARD_ENGAGEMENT_ID: engagementId,
+    // T-10 — the eighth key. Written as '' when the plane has not reported one
+    // (never `undefined`, for the exact reason the comment above this function
+    // measures: a loose `Record<string, string>` let a missing key write the
+    // literal string "undefined" with a clean typecheck. An empty value here reads
+    // back as absent — `toCredential` treats a blank CONTROL_TELEMETRY_URL as no
+    // telemetry origin, same as every other optional field on `DeviceCredential`.
+    CONTROL_TELEMETRY_URL: credential.controlTelemetryUrl ?? ""
+  };
+  return writeEngagementEnv(engagementId, values, home);
+}
+var LEGACY_ENV_LOCAL_REL = ".env.local";
+function migrateLegacyEnvLocal(targetRepo, stored) {
+  const path = join5(targetRepo, LEGACY_ENV_LOCAL_REL);
+  if (!existsSync3(path))
+    return { outcome: "absent", unbacked: [], missingForAdoption: [] };
+  let raw;
+  try {
+    raw = readFileSync4(path, "utf-8");
+  } catch {
+    return { outcome: "failed", unbacked: [], missingForAdoption: [] };
+  }
+  const inFile = parseEnvText(raw);
+  const present = ENGAGEMENT_ENV_KEYS.filter((key) => key in inFile);
+  if (present.length === 0)
+    return { outcome: "absent", unbacked: [], missingForAdoption: [] };
+  const storeUnusable = missingRequiredKeys(stored).length > 0;
+  const unbacked = present.filter((key) => (inFile[key] ?? "") !== "" && (storeUnusable || (stored[key] ?? "") === ""));
+  if (unbacked.length > 0) {
+    return { outcome: "kept", unbacked, missingForAdoption: missingRequiredKeys(inFile) };
+  }
+  const ours = new Set(ENGAGEMENT_ENV_KEYS);
+  const kept = raw.split("\n").filter((line) => {
+    const eq = line.indexOf("=");
+    if (eq === -1)
+      return true;
+    return !ours.has(line.slice(0, eq).replace(/^\s*export\s+/, "").trim());
+  });
+  const substantive = kept.filter((line) => line.trim() !== "" && !line.trim().startsWith("# Halfcycle"));
+  try {
+    if (substantive.length === 0) {
+      rmSync(path);
+      return { outcome: "removed", unbacked: [], missingForAdoption: [] };
+    }
+    writeFileSync3(path, kept.join("\n"), "utf-8");
+    return { outcome: "stripped", unbacked: [], missingForAdoption: [] };
+  } catch {
+    return { outcome: "failed", unbacked: [], missingForAdoption: [] };
+  }
+}
+async function install(options) {
+  const { targetRepo, engagementId, engagementType, credential, home } = options;
+  if (!existsSync3(targetRepo)) {
+    throw new Error(`[bundle install] Target repo does not exist: ${targetRepo}`);
+  }
+  const manifest = readPluginManifest();
+  const report = {
+    writtenPaths: [],
+    skippedPaths: [],
+    mergedPaths: [],
+    collidedPaths: []
+  };
+  copyManifestCommands(manifest, targetRepo, report);
+  const capturedDir = join5(targetRepo, "test", "fixtures", "captured");
+  const capturedManifest = join5(capturedDir, "manifest.json");
+  if (!existsSync3(capturedManifest)) {
+    const srcManifest = join5(BUNDLE_ROOT, "scaffolding", "test", "fixtures", "captured", "manifest.json");
+    writeAllowlisted(capturedManifest, targetRepo, readFileSync4(srcManifest, "utf-8"), report.writtenPaths);
+  } else {
+    report.skippedPaths.push("test/fixtures/captured/manifest.json");
+  }
+  const vendoredBinSrc = resolveVendoredBinary();
+  const vendoredBinDest = join5(targetRepo, ".halfcycle", "bin", "bin.bundle.mjs");
+  record(report, writeCollisionSafe(vendoredBinDest, targetRepo, readFileSync4(vendoredBinSrc, "utf-8")), ".halfcycle/bin/bin.bundle.mjs");
+  const settingsPath = join5(targetRepo, ".claude", "settings.json");
+  const settingsPreexisted = existsSync3(settingsPath);
+  const generatedSettings = JSON.parse(generateSettingsJson());
+  const existingSettings = settingsPreexisted ? JSON.parse(readFileSync4(settingsPath, "utf-8")) : {};
+  const mergedSettings = mergeSettings(existingSettings, generatedSettings);
+  const mergedSettingsText = JSON.stringify(mergedSettings, null, 2) + "\n";
+  mkdirSync3(dirname2(settingsPath), { recursive: true });
+  writeFileSync3(settingsPath, mergedSettingsText, "utf-8");
+  (settingsPreexisted ? report.mergedPaths : report.writtenPaths).push(".claude/settings.json");
+  for (const [name, content] of [
+    ["guard-runner.sh", generateGuardRunnerWrapper()],
+    ["session-start-marker.sh", generateSessionStartMarker()],
+    ["user-prompt-reminder.sh", generateUserPromptReminderHook()]
+  ]) {
+    const hookPath = join5(targetRepo, ".claude", "hooks", name);
+    record(report, writeCollisionSafe(hookPath, targetRepo, content), `.claude/hooks/${name}`);
+  }
+  const ciStanzaPath = join5(targetRepo, ".halfcycle", "ci-stanza.yml");
+  record(report, writeCollisionSafe(ciStanzaPath, targetRepo, generateCiStanza()), ".halfcycle/ci-stanza.yml");
+  record(report, reconcileEnvExample(targetRepo), ".env.example");
+  if (credential) {
+    const helperPath = join5(targetRepo, MCP_HEADERS_HELPER_REL);
+    record(report, writeCollisionSafe(helperPath, targetRepo, generateMcpHeadersHelper()), MCP_HEADERS_HELPER_REL);
+    const mcpPath = join5(targetRepo, MCP_REGISTRATION_REL);
+    const existingMcp = existsSync3(mcpPath) ? readFileSync4(mcpPath, "utf-8") : null;
+    const mcpContent = generateMcpRegistration(existingMcp, credential.mcpUrl);
+    if (existingMcp === null) {
+      writeAllowlisted(mcpPath, targetRepo, mcpContent, report.writtenPaths);
+    } else if (existingMcp !== mcpContent) {
+      writeAllowlisted(mcpPath, targetRepo, mcpContent, report.mergedPaths);
+    } else {
+      report.skippedPaths.push(MCP_REGISTRATION_REL);
+    }
+  } else {
+    report.skippedPaths.push(`${MCP_REGISTRATION_REL} (no MCP origin \u2014 no credential supplied)`);
+  }
+  const gitignoreOutcome = reconcileGitignore(targetRepo);
+  if (gitignoreOutcome === "failed") {
+    report.skippedPaths.push(".gitignore (write failed \u2014 see credential refusal)");
+  } else {
+    record(report, gitignoreOutcome, ".gitignore");
+  }
+  record(report, writeProjectIdentity(targetRepo), ".halfcycle/project.json");
+  const credentialPath = engagementEnvPath(engagementId, home);
+  if (credential) {
+    record(report, writeEngagementCredential(credential, engagementId, home), credentialPath);
+  } else {
+    report.skippedPaths.push(`${credentialPath} (no credential supplied)`);
+  }
+  const stored = readEngagementEnv(engagementId, home) ?? {};
+  const migration = migrateLegacyEnvLocal(targetRepo, stored);
+  switch (migration.outcome) {
+    case "removed":
+      report.writtenPaths.push(".env.local (REMOVED \u2014 the credential now lives outside this repository)");
+      break;
+    case "stripped":
+      report.writtenPaths.push(".env.local (Halfcycle keys REMOVED \u2014 your own entries are untouched; the credential now lives outside this repository)");
+      break;
+    case "kept":
+      report.skippedPaths.push(`.env.local (KEPT \u2014 nothing removed: this repository still holds the only copy of ${migration.unbacked.join(", ")}, and the store at ${credentialPath} does not)`);
+      break;
+    case "failed":
+      report.skippedPaths.push(".env.local (could not be rewritten \u2014 DELETE IT BY HAND: it holds a credential this repository no longer needs)");
+      break;
+    case "absent":
+      break;
+  }
+  writeBundlePin(targetRepo, manifest.version, engagementId, engagementType, report.writtenPaths);
+  const scanResult = runBootstrapScan(targetRepo);
+  return {
+    version: manifest.version,
+    writtenPaths: report.writtenPaths,
+    skippedPaths: report.skippedPaths,
+    mergedPaths: report.mergedPaths,
+    collidedPaths: report.collidedPaths,
+    bootstrapScanRan: scanResult.ran,
+    legacyCredentialKept: migration.outcome === "kept" ? { keys: migration.unbacked, missing: migration.missingForAdoption } : null
+  };
+}
+
+// dist/create-engagement.js
+var CreateEngagementRefused = class extends Error {
+  status;
+  serverMessage;
+  errorCode;
+  constructor(status, serverMessage, errorCode, message) {
+    super(message);
+    this.status = status;
+    this.serverMessage = serverMessage;
+    this.errorCode = errorCode;
+    this.name = "CreateEngagementRefused";
+  }
+  /**
+   * Is this a refusal of the CALLER's credential — the arm signing in again can fix?
+   *
+   * `PublicStartDisabled` is excluded even though it is a 403, and that exclusion is
+   * the whole reason this is a method rather than a status comparison at the call
+   * site: the flag gates the DEPLOYMENT, identically for every caller, so no
+   * credential and no sign-in changes the answer. Treating it as an auth refusal
+   * would send a developer through a browser handoff to arrive at the same 403.
+   *
+   * **THIS IS THE CREATE ROUTE'S DERIVATION AND THE JOIN CALLER MUST NOT USE IT
+   * (T-24).** On the join route a 403 has two causes that share a status AND a
+   * discriminant (`error: 'Forbidden'`), so nothing on this object can tell them
+   * apart: the credential may be a live engagement token carrying no account, or the
+   * engagement id may not resolve. Signing in again cannot fix the second, and
+   * treating it as though it could would discard a good credential, walk the
+   * developer through a browser, and arrive at the identical 403 — a remedy that
+   * loops. `bin.ts`'s join path therefore retries on `401` ALONE, at the call site,
+   * where the reason can be written down. See `joinPinnedEngagement` there.
+   */
+  get authRefused() {
+    if (this.errorCode === "PublicStartDisabled")
+      return false;
+    return this.status === 401 || this.status === 403;
+  }
+};
+function planeRefusal(detail) {
+  let body;
+  try {
+    body = JSON.parse(detail);
+  } catch {
+    return void 0;
+  }
+  if (typeof body !== "object" || body === null)
+    return void 0;
+  const candidate = body;
+  if (typeof candidate.message !== "string" || candidate.message.trim() === "")
+    return void 0;
+  const hasDiscriminant = typeof candidate.error === "string" || typeof candidate.statusCode === "number" || typeof candidate.status === "string";
+  if (!hasDiscriminant)
+    return void 0;
+  return {
+    message: candidate.message,
+    error: typeof candidate.error === "string" ? candidate.error : void 0
+  };
+}
+var CONTROL_ORIGIN_HINT = "HALFCYCLE_SERVICE_URL must be the Halfcycle CONTROL origin \u2014 the one that serves /engagements and /board/enter-codes. The MCP server runs at a different address, and the platform supplies that one itself; you do not configure it.";
+async function createEngagement(baseUrl, name, credential) {
+  return requestEngagementValues(`${baseUrl.replace(/\/+$/, "")}/engagements`, name ? { name } : {}, credential, { action: "Create-engagement", nothingHappened: "No engagement was created", route: "POST /engagements" });
+}
+async function requestEngagementValues(url, requestBody, credential, shape) {
+  const bearer = credential?.trim();
+  let res;
+  try {
+    res = await fetch(url, {
+      method: "POST",
+      headers: {
+        "content-type": "application/json",
+        ...bearer ? { authorization: `Bearer ${bearer}` } : {}
+      },
+      body: JSON.stringify(requestBody)
+    });
+  } catch (err) {
+    throw new Error(`[bundle install] Could not reach the Halfcycle control plane at ${url}: ${err instanceof Error ? err.message : String(err)}. ${shape.nothingHappened}. ` + CONTROL_ORIGIN_HINT);
+  }
+  if (!res.ok) {
+    const detail = await res.text().catch(() => "");
+    const refusal = res.status === 404 ? void 0 : planeRefusal(detail);
+    if (refusal) {
+      throw new CreateEngagementRefused(res.status, refusal.message, refusal.error, `[bundle install] ${shape.action} failed: ${url} returned ${res.status}. ${refusal.message} ${shape.nothingHappened}.`);
+    }
+    const wrongOrigin = res.status === 404 ? `That address answered, but it does not serve ${shape.route} \u2014 so it is not the control plane. ` : "";
+    throw new Error(`[bundle install] ${shape.action} failed: ${url} returned ${res.status}. ${wrongOrigin}${detail ? `Response: ${detail.slice(0, 300)}. ` : ""}${shape.nothingHappened}. ` + CONTROL_ORIGIN_HINT);
+  }
+  const body = await res.json().catch(() => null);
+  if (!body || typeof body.engagementId !== "string" || typeof body.sessionToken !== "string") {
+    throw new Error(`[bundle install] ${shape.action} response from ${url} did not carry {engagementId, sessionToken}. ${shape.nothingHappened}. ` + CONTROL_ORIGIN_HINT);
+  }
+  for (const [field, value] of [
+    ["engagementId", body.engagementId],
+    ["sessionToken", body.sessionToken]
+  ]) {
+    if (value.trim() === "") {
+      throw new Error(`[bundle install] The Halfcycle plane at ${url} answered with a blank ${field} (the field is present but empty). An install cannot proceed on it: it would be written into this engagement's credential store, read back as a configured value, and every guard evaluation would fail against it for the life of the engagement. ${shape.nothingHappened} and nothing was written. ` + CONTROL_ORIGIN_HINT);
+    }
+  }
+  if (typeof body.mcpUrl !== "string" || body.mcpUrl.trim() === "") {
+    throw new Error(`[bundle install] The Halfcycle plane at ${url} created an engagement but did not say where its MCP server lives (no mcpUrl on the response). Without that address the install would write an MCP registration pointing nowhere, so nothing was written. Either that plane is older than this installer, or ${url} is not a Halfcycle control plane.`);
+  }
+  if (typeof body.guardUrl !== "string" || body.guardUrl.trim() === "") {
+    throw new Error(`[bundle install] The Halfcycle plane at ${url} created an engagement but did not say where its guard service lives (no guardUrl on the response). Without that address the install would wire a guard hook that evaluates nothing, so nothing was written. Either that plane is older than this installer, or ${url} is not a Halfcycle control plane.`);
+  }
+  const controlTelemetryUrl = typeof body.controlTelemetryUrl === "string" && body.controlTelemetryUrl.trim() !== "" ? body.controlTelemetryUrl.trim().replace(/\/+$/, "") : void 0;
+  return {
+    engagementId: body.engagementId,
+    sessionToken: body.sessionToken,
+    mcpUrl: body.mcpUrl.trim().replace(/\/+$/, ""),
+    guardUrl: body.guardUrl.trim().replace(/\/+$/, ""),
+    ...controlTelemetryUrl !== void 0 ? { controlTelemetryUrl } : {}
+  };
+}
+
+// dist/mint-board-code.js
+async function mintBoardEnterCode(baseUrl, sessionToken) {
+  const url = `${baseUrl.replace(/\/+$/, "")}/board/enter-codes`;
+  let res;
+  try {
+    res = await fetch(url, {
+      method: "POST",
+      headers: {
+        "content-type": "application/json",
+        authorization: `Bearer ${sessionToken}`
+      },
+      body: "{}"
+    });
+  } catch (err) {
+    throw new Error(`[bundle install] Could not reach the Halfcycle board mint endpoint at ${url}: ${err instanceof Error ? err.message : String(err)}.`);
+  }
+  if (!res.ok) {
+    throw new Error(`[bundle install] Board code mint failed: ${url} returned ${res.status}.`);
+  }
+  const body = await res.json().catch(() => null);
+  if (!body || typeof body.enterCode !== "string" || typeof body.engagementId !== "string" || typeof body.boardUrl !== "string" || typeof body.expiresAt !== "string") {
+    throw new Error(`[bundle install] Board code mint response from ${url} did not carry {enterCode, engagementId, boardUrl, expiresAt}.`);
+  }
+  return {
+    enterCode: body.enterCode,
+    engagementId: body.engagementId,
+    boardUrl: body.boardUrl,
+    expiresAt: body.expiresAt
+  };
+}
+
+// dist/setup/manifest.js
+import { existsSync as existsSync4, lstatSync, mkdirSync as mkdirSync4, readFileSync as readFileSync5, statSync, writeFileSync as writeFileSync4 } from "node:fs";
+import { dirname as dirname3, join as join6, posix } from "node:path";
+var DECLARED_ROOT_FILES = ["CLAUDE.md", "AGENTS.md", "ENGAGEMENT.md"];
+var DECLARED_DIR_PREFIX = "docs";
+var RESERVED_MIRROR_PATH = "docs/method";
+var STEP_ID_GRAMMAR = /\b(?:l[0-5](?:-l[0-5])?|xl)\.[a-z0-9-]+/i;
+var STEP_ANNOTATION = /<!--\s*step:/i;
+var ANCHOR_DECLARATION = /<!--\s*anchor:/i;
+function normalise(path) {
+  const slashed = path.replace(/\\/g, "/");
+  if (slashed.trim() === "")
+    return "";
+  return posix.normalize(slashed).replace(/\/+$/, "");
+}
+function isUnder(candidate, prefix) {
+  return candidate === prefix || candidate.startsWith(prefix + "/");
+}
+function isUnderIgnoringCase(candidate, prefix) {
+  return isUnder(candidate.toLowerCase(), prefix.toLowerCase());
+}
+function foldWin32Canonicalisation(path) {
+  return path.split("/").map((segment) => segment.replace(/[. ]+$/, "")).join("/");
+}
+function assertWritable(relPath) {
+  const path = normalise(relPath);
+  if (path === "" || path === "." || path.startsWith("/") || /^[A-Za-z]:/.test(path)) {
+    throw new Error(`[halfcycle setup] Refusing to write "${relPath}": the manifest writes repository-relative paths only.`);
+  }
+  if (path.split("/").includes("..")) {
+    throw new Error(`[halfcycle setup] Refusing to write "${relPath}": a path may not climb out of the repository.`);
+  }
+  if (isUnderIgnoringCase(foldWin32Canonicalisation(path), RESERVED_MIRROR_PATH)) {
+    throw new Error(`[halfcycle setup] Refusing to write "${relPath}": ${RESERVED_MIRROR_PATH}/ is reserved and is never created in a project repository. The method is served per step and never installed (INV-016).`);
+  }
+  const declared = DECLARED_ROOT_FILES.includes(path) || isUnder(path, DECLARED_DIR_PREFIX);
+  if (!declared) {
+    throw new Error(`[halfcycle setup] Refusing to write "${relPath}": setup writes only ${DECLARED_ROOT_FILES.join(", ")} and paths under ${DECLARED_DIR_PREFIX}/.`);
+  }
+}
+function assertContentCarriesNoMethodStructure(relPath, content) {
+  const carried = STEP_ID_GRAMMAR.test(content) && "a method step identifier" || STEP_ANNOTATION.test(content) && "a method step annotation" || ANCHOR_DECLARATION.test(content) && "a method anchor declaration, so this is corpus text";
+  if (carried) {
+    throw new Error(`[halfcycle setup] Refusing to write "${relPath}": the content carries ${carried}. What a step directs is executed, never transcribed into the repository (INV-016).`);
+  }
+}
+function assertUsableHeading(relPath, heading) {
+  if (heading.trim().length === 0) {
+    throw new Error(`[halfcycle setup] Refusing to write "${relPath}": a section needs a heading, and an empty one cannot be found again on the next run.`);
+  }
+  if (/[\r\n\u2028\u2029]/.test(heading)) {
+    throw new Error(`[halfcycle setup] Refusing to write "${relPath}": a section heading must be a single line. A heading that spans lines can never be found again, so the section would be appended on every run.`);
+  }
+  if (heading !== heading.trim()) {
+    throw new Error(`[halfcycle setup] Refusing to write "${relPath}": a section heading may not begin or end with whitespace \u2014 it would not match itself on the next run.`);
+  }
+}
+function assertNoConflictingDuplicates(rows) {
+  const seen = /* @__PURE__ */ new Set();
+  for (const row of rows) {
+    const key = row.kind === "section" ? `${normalise(row.path)}##${row.heading}` : normalise(row.path);
+    if (seen.has(key)) {
+      throw new Error(`[halfcycle setup] Refusing this batch: "${row.path}" is named twice in one step's writes with the same "${row.kind === "section" ? row.heading : ""}" section. The second would be reported as a path you already own, which would be false.`);
+    }
+    seen.add(key);
+    if (row.kind !== "section") {
+      for (const other of rows) {
+        if (other !== row && normalise(other.path) === normalise(row.path)) {
+          throw new Error(`[halfcycle setup] Refusing this batch: "${row.path}" is named twice in one step's writes, once as a whole ${row.kind}. Those cannot both be honoured.`);
+        }
+      }
+    }
+  }
+}
+function renderSection(heading, body) {
+  return `## ${heading}
+
+${body.replace(/\s+$/, "")}
+`;
+}
+function hasSection(text, heading) {
+  return text.split("\n").some((line) => line.trim() === `## ${heading}`);
+}
+function firstSymlinkOnPath(targetRepo, path) {
+  const segments = path.split("/").filter((s) => s.length > 0);
+  let walked = targetRepo;
+  for (let i = 0; i < segments.length; i++) {
+    walked = join6(walked, segments[i]);
+    try {
+      if (lstatSync(walked).isSymbolicLink())
+        return segments.slice(0, i + 1).join("/");
+    } catch {
+      return null;
+    }
+  }
+  return null;
+}
+function symlinkEntry(path, link, isDirectoryRow) {
+  return {
+    path: isDirectoryRow ? `${path}/` : path,
+    outcome: "left-alone",
+    note: `"${link}" is a symbolic link \u2014 left exactly as it was, and not followed, because writing through it would put this file outside your repository`
+  };
+}
+function applyFileRow(targetRepo, path, content) {
+  const abs = join6(targetRepo, path);
+  const link = firstSymlinkOnPath(targetRepo, path);
+  if (link !== null)
+    return symlinkEntry(path, link, false);
+  if (existsSync4(abs)) {
+    const current = readFileSync5(abs, "utf-8");
+    return current === content ? { path, outcome: "already-present", note: "already present and correct \u2014 nothing written" } : { path, outcome: "left-alone", note: "you already own this file \u2014 left exactly as it was" };
+  }
+  mkdirSync4(dirname3(abs), { recursive: true });
+  writeFileSync4(abs, content, "utf-8");
+  return { path, outcome: "created", note: "created" };
+}
+function applySectionRow(targetRepo, path, heading, body) {
+  const abs = join6(targetRepo, path);
+  const link = firstSymlinkOnPath(targetRepo, path);
+  if (link !== null)
+    return symlinkEntry(path, link, false);
+  const section = renderSection(heading, body);
+  if (!existsSync4(abs)) {
+    mkdirSync4(dirname3(abs), { recursive: true });
+    writeFileSync4(abs, section, "utf-8");
+    return { path, outcome: "created", note: `created, with a "${heading}" section` };
+  }
+  const existing = readFileSync5(abs, "utf-8");
+  if (hasSection(existing, heading)) {
+    return {
+      path,
+      outcome: "already-present",
+      note: `a "${heading}" section is already there \u2014 nothing written`
+    };
+  }
+  const separator = existing.endsWith("\n") ? "\n" : "\n\n";
+  writeFileSync4(abs, existing + separator + section, "utf-8");
+  return {
+    path,
+    outcome: "section-added",
+    note: `gained a "${heading}" section; everything you had is unchanged`
+  };
+}
+function applyDirectoryRow(targetRepo, path) {
+  const abs = join6(targetRepo, path);
+  const link = firstSymlinkOnPath(targetRepo, path);
+  if (link !== null)
+    return symlinkEntry(path, link, true);
+  if (existsSync4(abs)) {
+    const kind = statSync(abs).isDirectory() ? "directory" : "file";
+    return kind === "directory" ? { path: `${path}/`, outcome: "already-present", note: "already there \u2014 nothing written" } : { path, outcome: "left-alone", note: "you already own this path \u2014 left exactly as it was" };
+  }
+  mkdirSync4(abs, { recursive: true });
+  return { path: `${path}/`, outcome: "created", note: "created" };
+}
+function applySetupWrites(targetRepo, rows) {
+  if (!existsSync4(targetRepo)) {
+    throw new Error(`[halfcycle setup] The project directory does not exist: ${targetRepo}`);
+  }
+  assertNoConflictingDuplicates(rows);
+  for (const row of rows) {
+    assertWritable(row.path);
+    if (row.kind === "file")
+      assertContentCarriesNoMethodStructure(row.path, row.content);
+    if (row.kind === "section") {
+      assertUsableHeading(row.path, row.heading);
+      assertContentCarriesNoMethodStructure(row.path, `${row.heading}
+${row.body}`);
+    }
+  }
+  const entries = [];
+  for (const row of rows) {
+    const path = normalise(row.path);
+    if (row.kind === "file")
+      entries.push(applyFileRow(targetRepo, path, row.content));
+    else if (row.kind === "section") {
+      entries.push(applySectionRow(targetRepo, path, row.heading, row.body));
+    } else
+      entries.push(applyDirectoryRow(targetRepo, path));
+  }
+  return { entries };
+}
+var SetupManifest = class {
+  rows = [];
+  /** Fold one resolve's report into the run's manifest. */
+  add(report) {
+    this.rows.push(...report.entries);
+  }
+  /** Every row, in the order the resolves produced them. */
+  entries() {
+    return this.rows;
+  }
+  /** The paths this run actually changed — created or section-added. */
+  changedPaths() {
+    return this.rows.filter((r) => r.outcome === "created" || r.outcome === "section-added").map((r) => r.path);
+  }
+  /** True iff the run changed nothing — the honest output of a second run. */
+  nothingToDo() {
+    return this.changedPaths().length === 0;
+  }
+  /**
+   * The paths this run wanted and did not get: a name the developer already uses, or
+   * a symlink it would not follow. **Not the same as "already set up"** — a run where
+   * every row is `left-alone` changed nothing *and* set nothing up, and reporting
+   * that as done is the failure the report exists to prevent.
+   */
+  leftAlonePaths() {
+    return this.rows.filter((r) => r.outcome === "left-alone").map((r) => r.path);
+  }
+  /**
+   * The report, in plain words. Names every path touched, including the ones left
+   * alone — a path the command decided not to write is exactly what a developer
+   * needs told.
+   *
+   * **The header describes the run's actual composition, and says nothing universal
+   * unless it holds.** Two earlier forms got this wrong in the same way, one round
+   * apart: the first printed "already set up" for a run that wrote nothing *because
+   * every path was already the developer's*, and the second printed "every path this
+   * needed is already yours" for the **mixed** state — some rows already correct
+   * from an earlier run, some blocked — which is the ordinary second-run case and is
+   * simply false. Counts are what the header is built from now, and *every* appears
+   * only when the count says every.
+   */
+  render() {
+    if (this.rows.length === 0)
+      return "Nothing to do \u2014 nothing was asked for.";
+    const lines = this.rows.map((r) => `${r.path} \u2014 ${r.note}`);
+    if (!this.nothingToDo())
+      return ["Set up this project. Here is every path touched:", ...lines].join("\n");
+    const skipped = this.leftAlonePaths().length;
+    const already = this.rows.filter((r) => r.outcome === "already-present").length;
+    let header;
+    if (skipped === 0)
+      header = "Nothing to do \u2014 this project is already set up.";
+    else if (already === 0) {
+      header = `Nothing was written: ${skipped === 1 ? "the one path" : `all ${skipped} paths`} this needed ${skipped === 1 ? "is" : "are"} already yours, so ${skipped === 1 ? "it was" : "they were"} left alone. Here is what that was:`;
+    } else {
+      header = `Nothing was written this time: ${already} ${already === 1 ? "path was" : "paths were"} already set up, and ${skipped} ${skipped === 1 ? "is" : "are"} already yours and ${skipped === 1 ? "was" : "were"} left alone. Here is every path:`;
+    }
+    return [header, ...lines].join("\n");
+  }
+};
+
+// dist/setup/rows.js
+var FLAT_FILE_TRACKER_HOME = "docs/tasks";
+function contextIndexRow(heading, body) {
+  return { path: "CLAUDE.md", kind: "section", heading, body };
+}
+function agentsPointerRow(content) {
+  return { path: "AGENTS.md", kind: "file", content };
+}
+function layerDocumentRow(path, content) {
+  return { path, kind: "file", content };
+}
+function documentSectionRow(path, heading, body) {
+  return { path, kind: "section", heading, body };
+}
+function engagementRecordRow(content) {
+  return { path: "ENGAGEMENT.md", kind: "file", content };
+}
+function trackerHomeRow(home = FLAT_FILE_TRACKER_HOME) {
+  return { path: home, kind: "directory" };
+}
+
+// dist/setup/discovery.js
+import { existsSync as existsSync5, readFileSync as readFileSync6, readdirSync, statSync as statSync2 } from "node:fs";
+import { join as join7 } from "node:path";
+function renderAnchor(anchor) {
+  return anchor.kind === "file" ? `${anchor.path}:${anchor.line}` : `$ ${anchor.command}`;
+}
+function settleOrAsk(key, candidate, question, findings, questions) {
+  if (candidate === null) {
+    questions.push({
+      key,
+      question,
+      why: "nothing in this repository answers it, so it is a decision rather than a finding"
+    });
+    return;
+  }
+  findings.push({ key, value: candidate.value, anchor: candidate.anchor });
+}
+function lineOf(text, needle) {
+  const lines = text.split("\n");
+  for (let i = 0; i < lines.length; i++) {
+    if (lines[i].includes(needle))
+      return i + 1;
+  }
+  return null;
+}
+function readOrNull(repo, rel) {
+  const abs = join7(repo, rel);
+  return existsSync5(abs) && statSync2(abs).isFile() ? readFileSync6(abs, "utf-8") : null;
+}
+function anchoredIn(repo, rel, needle, value) {
+  const text = readOrNull(repo, rel);
+  if (text === null)
+    return null;
+  const line = lineOf(text, needle);
+  if (line === null)
+    return null;
+  return { value, anchor: { kind: "file", path: rel, line } };
+}
+function presenceAnchor(repo, rel) {
+  const abs = join7(repo, rel);
+  if (!existsSync5(abs))
+    return null;
+  return statSync2(abs).isDirectory() ? { kind: "command", command: `ls -d ${rel}`, output: `${rel}/` } : { kind: "file", path: rel, line: 1 };
+}
+function anchoredByPresence(repo, rel, value) {
+  const anchor = presenceAnchor(repo, rel);
+  return anchor === null ? null : { value, anchor };
+}
+var LOCKFILES = [
+  ["pnpm-lock.yaml", "pnpm"],
+  ["package-lock.json", "npm"],
+  ["yarn.lock", "yarn"],
+  ["bun.lockb", "bun"],
+  ["poetry.lock", "poetry"],
+  ["uv.lock", "uv"],
+  ["Cargo.lock", "cargo"],
+  ["go.sum", "go modules"]
+];
+var MANIFESTS = [
+  ["package.json", '"name"', "JavaScript/TypeScript"],
+  ["pyproject.toml", "name", "Python"],
+  ["go.mod", "module", "Go"],
+  ["Cargo.toml", "name", "Rust"],
+  ["pom.xml", "<artifactId>", "Java"]
+];
+var WORKSPACE_MARKERS = [
+  ["pnpm-workspace.yaml", "packages:", "a pnpm workspace"],
+  ["package.json", '"workspaces"', "an npm/yarn workspace"],
+  ["Cargo.toml", "[workspace]", "a cargo workspace"],
+  ["go.work", "use", "a Go multi-module workspace"]
+];
+function firstMatch(items, f) {
+  for (const item of items) {
+    const hit = f(item);
+    if (hit !== null)
+      return hit;
+  }
+  return null;
+}
+function ciWorkflows(repo) {
+  const dir = join7(repo, ".github", "workflows");
+  if (!existsSync5(dir) || !statSync2(dir).isDirectory())
+    return [];
+  return readdirSync(dir).filter((f) => f.endsWith(".yml") || f.endsWith(".yaml")).sort();
+}
+function existingLayerDocuments(repo) {
+  const found = [];
+  for (const paths of Object.values(LAYER_ARTEFACT_PATHS)) {
+    for (const p of paths ?? []) {
+      if (existsSync5(join7(repo, p)))
+        found.push(p);
+    }
+  }
+  return found.sort();
+}
+function discoverRepository(targetRepo) {
+  if (!existsSync5(targetRepo)) {
+    throw new Error(`[halfcycle setup] The project directory does not exist: ${targetRepo}`);
+  }
+  const findings = [];
+  const questions = [];
+  settleOrAsk("project-language", firstMatch(MANIFESTS, ([file, needle, language]) => anchoredIn(targetRepo, file, needle, language)), "What is this project written in?", findings, questions);
+  settleOrAsk("package-manager", firstMatch(LOCKFILES, ([file, manager]) => anchoredByPresence(targetRepo, file, manager)), "Which package manager does this project use?", findings, questions);
+  settleOrAsk("repo-structure", firstMatch(WORKSPACE_MARKERS, ([file, needle, shape]) => anchoredIn(targetRepo, file, needle, shape)) ?? (existsSync5(join7(targetRepo, "package.json")) || existsSync5(join7(targetRepo, "go.mod")) || existsSync5(join7(targetRepo, "pyproject.toml")) ? anchoredByPresence(targetRepo, "package.json", "a single-package repository") ?? anchoredByPresence(targetRepo, "go.mod", "a single-package repository") ?? anchoredByPresence(targetRepo, "pyproject.toml", "a single-package repository") : null), "Is this one repository for one product, or one of several?", findings, questions);
+  const workflows = ciWorkflows(targetRepo);
+  settleOrAsk("ci-strategy", workflows.length > 0 ? {
+    value: `GitHub Actions \u2014 ${workflows.length === 1 ? "one workflow" : `${workflows.length} workflows`}: ${workflows.join(", ")}`,
+    anchor: { kind: "file", path: `.github/workflows/${workflows[0]}`, line: 1 }
+  } : null, "How does this project run CI?", findings, questions);
+  const layerDocs = existingLayerDocuments(targetRepo);
+  settleOrAsk("existing-layer-documents", layerDocs.length > 0 ? anchoredByPresence(targetRepo, layerDocs[0], `already written: ${layerDocs.join(", ")}`) : null, "Which of the project documents already exist?", findings, questions);
+  settleOrAsk("context-index", anchoredByPresence(targetRepo, "CLAUDE.md", "a context index is already in place"), "Where should the project context index live?", findings, questions);
+  settleOrAsk("tracker", anchoredByPresence(targetRepo, "docs/tasks", "a flat-file task directory is already in place") ?? anchoredByPresence(targetRepo, ".github/ISSUE_TEMPLATE", "GitHub Issues is already in use"), "Where should tasks live?", findings, questions);
+  settleOrAsk("push-policy", null, "How does work reach the default branch?", findings, questions);
+  settleOrAsk("branch-policy", null, "How are branches organised for a piece of work?", findings, questions);
+  return { findings, questions };
+}
+function questionsToPut(result) {
+  const settled = new Set(result.findings.map((f) => f.key));
+  return result.questions.filter((q) => !settled.has(q.key));
+}
+function renderDiscovery(result) {
+  const lines = result.findings.map((f) => `${f.value}  (${renderAnchor(f.anchor)})`);
+  const asks = questionsToPut(result).map((q) => `? ${q.question}`);
+  return [...lines, ...asks].join("\n");
+}
+
+// dist/setup/engagement.js
+function flatFileTrackerDefault() {
+  return {
+    chosen: "flat-file, in this repository",
+    alternativeOffered: "your existing issue tracker",
+    rationale: "tasks stay beside the code and in the same review, so there is one place to look; an issue tracker is offered instead when the team already lives in one",
+    home: FLAT_FILE_TRACKER_HOME
+  };
+}
+function isSettled(d) {
+  return d.answer.trim().length > 0 && d.rationale.trim().length > 0;
+}
+function renderEngagementDocument(input) {
+  const lines = [
+    `# Engagement defaults \u2014 ${input.projectName}`,
+    "",
+    `Settled ${input.settledAt}.`,
+    "",
+    "## Decisions",
+    ""
+  ];
+  for (const d of input.decisions) {
+    lines.push(`### ${d.question}`, "", `**Decided:** ${d.answer}`, "", `**Why:** ${d.rationale}`, "");
+  }
+  lines.push("## Tracker", "", `**Chosen:** ${input.tracker.chosen}`, "", `**Offered instead:** ${input.tracker.alternativeOffered}`, "", `**Why:** ${input.tracker.rationale}`, "");
+  if (input.tracker.home !== null) {
+    lines.push(`**Where tasks live:** \`${input.tracker.home}/\``, "");
+  }
+  return lines.join("\n");
+}
+function buildEngagementRecord(input) {
+  const unsettled = input.decisions.filter((d) => !isSettled(d)).map((d) => d.key);
+  const missingCount = Math.max(0, input.requiredDecisions - input.decisions.length);
+  if (unsettled.length > 0 || missingCount > 0) {
+    const parts = [];
+    if (unsettled.length > 0) {
+      parts.push(`${unsettled.length} of the decisions has no answer or no reason recorded (${unsettled.join(", ")})`);
+    }
+    if (missingCount > 0)
+      parts.push(`${missingCount} were never put`);
+    return {
+      ok: false,
+      halt: {
+        halted: true,
+        unsettled,
+        reason: `Stopping before writing anything: ${parts.join("; ")}. This file records what was decided and why, so an unanswered question cannot be written down as an answer. Answer it and run this again.`,
+        emits: Object.freeze([])
+      }
+    };
+  }
+  const document = renderEngagementDocument(input);
+  const rows = [engagementRecordRow(document)];
+  if (input.tracker.home !== null)
+    rows.push(trackerHomeRow(input.tracker.home));
+  return { ok: true, document, rows };
+}
+
+// dist/build-record/types.js
+var BUILD_RECORD_FORMAT = "halfcycle-build-record/v1";
+function projectSeedGuard(fired, includeExplanation) {
+  const seed = {
+    patternRef: fired.patternRef,
+    severity: fired.severity
+  };
+  if (includeExplanation && fired.explanation)
+    seed.explanation = fired.explanation;
+  return seed;
+}
+
+// dist/build-record/sources.js
+import { readFileSync as readFileSync7, existsSync as existsSync6 } from "node:fs";
+import { createHash } from "node:crypto";
+import { join as join8 } from "node:path";
+import { execFileSync as execFileSync2 } from "node:child_process";
+var MissingSourceError = class extends Error {
+  constructor(sourceName, detail) {
+    super(`[build-record] missing required source: ${sourceName} \u2014 ${detail}`);
+    this.name = "MissingSourceError";
+  }
+};
+function projectSeedGuards(runs) {
+  const byRef = /* @__PURE__ */ new Map();
+  for (const run of runs) {
+    if (!run.result)
+      continue;
+    for (const fired of run.result.guardsFired) {
+      const seed = projectSeedGuard(
+        fired,
+        /* includeExplanation */
+        false
+      );
+      const existing = byRef.get(seed.patternRef);
+      if (!existing) {
+        byRef.set(seed.patternRef, seed);
+      } else if (existing.severity !== seed.severity) {
+        byRef.set(seed.patternRef, pickHigherSeverity(existing, seed));
+      }
+    }
+  }
+  return [...byRef.values()].sort((a, b) => a.patternRef.localeCompare(b.patternRef));
+}
+var SEVERITY_ORDINAL = { info: 0, warn: 1, block: 2 };
+function pickHigherSeverity(a, b) {
+  return (SEVERITY_ORDINAL[a.severity] ?? -1) >= (SEVERITY_ORDINAL[b.severity] ?? -1) ? a : b;
+}
+function normalizeLegacyLine(parsed) {
+  if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
+    return parsed;
+  }
+  const record2 = parsed;
+  if (record2["outcome"] !== void 0)
+    return parsed;
+  return {
+    ...record2,
+    runId: record2["runId"] ?? syntheticRunId(record2),
+    outcome: "evaluated"
+  };
+}
+function syntheticRunId(record2) {
+  const key = [
+    record2["engagementId"],
+    record2["occurredAt"],
+    record2["runType"],
+    record2["phase"]
+  ].join("|");
+  const hex = createHash("sha256").update(`legacy-guard-eval-run:${key}`).digest("hex");
+  return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-4${hex.slice(13, 16)}-8${hex.slice(17, 20)}-${hex.slice(20, 32)}`;
+}
+function readGuardEvalLog(logDir, phaseId) {
+  const logPath = join8(logDir, `phase-${phaseId}.jsonl`);
+  if (!existsSync6(logPath)) {
+    throw new MissingSourceError("guard-eval log", `no runner guard-eval log at ${logPath} for phase ${phaseId}`);
+  }
+  const raw = readFileSync7(logPath, "utf-8");
+  const runs = [];
+  for (const line of raw.split("\n")) {
+    const trimmed = line.trim();
+    if (trimmed === "")
+      continue;
+    const parsed = JSON.parse(trimmed);
+    runs.push(guardEvalRunSchema.parse(normalizeLegacyLine(parsed)));
+  }
+  return runs;
+}
+function readOrchestrationState(phasesDir, phaseId) {
+  const statePath = join8(phasesDir, `phase-${phaseId}-orchestration-state.json`);
+  if (!existsSync6(statePath)) {
+    throw new MissingSourceError("orchestration state", `no orchestration-state file at ${statePath} for phase ${phaseId}`);
+  }
+  const parsed = JSON.parse(readFileSync7(statePath, "utf-8"));
+  if (!parsed.tasks || typeof parsed.tasks !== "object") {
+    throw new MissingSourceError("orchestration state", `${statePath} has no tasks map`);
+  }
+  const tasks = {};
+  for (const [id, t] of Object.entries(parsed.tasks)) {
+    if (!t || typeof t.status !== "string") {
+      throw new MissingSourceError("orchestration state", `task ${id} has no status`);
+    }
+    tasks[id] = { status: t.status };
+  }
+  return { tasks };
+}
+function readGitClose(repoRoot) {
+  let closeCommit;
+  let closedDate;
+  try {
+    closeCommit = execFileSync2("git", ["-C", repoRoot, "rev-parse", "--short", "HEAD"], {
+      encoding: "utf-8"
+    }).trim();
+    closedDate = execFileSync2("git", ["-C", repoRoot, "show", "-s", "--format=%cs", "HEAD"], { encoding: "utf-8" }).trim();
+  } catch (err) {
+    throw new MissingSourceError("git HEAD", `cannot resolve close commit/date in ${repoRoot}: ${err instanceof Error ? err.message : String(err)}`);
+  }
+  if (!closeCommit)
+    throw new MissingSourceError("git HEAD", `empty commit sha in ${repoRoot}`);
+  if (!closedDate)
+    throw new MissingSourceError("git HEAD", `empty commit date in ${repoRoot}`);
+  return { closeCommit, closedDate };
+}
+function validateNarrated(narrated) {
+  const req = (v, name) => {
+    if (v === void 0 || v === null || v === "") {
+      throw new MissingSourceError("narrated artefact", `${name} is missing`);
+    }
+  };
+  req(narrated.engagement, "engagement");
+  req(narrated.engagementType, "engagementType");
+  req(narrated.phase?.name, "phase.name");
+  req(narrated.status, "status");
+  req(narrated.thesis, "thesis");
+  req(narrated.delivered, "delivered");
+  req(narrated.acceptance, "acceptance");
+  req(narrated.acceptance?.verdict, "acceptance.verdict");
+  req(narrated.gatesEarnedKeep, "gatesEarnedKeep");
+  req(narrated.instruments, "instruments");
+  if (!Array.isArray(narrated.deviations)) {
+    throw new MissingSourceError("narrated artefact", "deviations must be an array");
+  }
+  return narrated;
+}
+function loadSources(opts) {
+  const orchestration = readOrchestrationState(opts.phasesDir, opts.phaseId);
+  const guardEvalRuns = readGuardEvalLog(opts.guardEvalLogDir, opts.phaseId);
+  const git2 = readGitClose(opts.repoRoot);
+  const narrated = validateNarrated(opts.narrated);
+  if (!Array.isArray(opts.touchedInvariants)) {
+    throw new MissingSourceError("feature-spec Touches", "touchedInvariants must be an array");
+  }
+  return {
+    orchestration,
+    narrated,
+    git: git2,
+    guardEvalRuns,
+    touchedInvariants: opts.touchedInvariants
+  };
+}
+
+// dist/build-record/assemble.js
+var LANDED_STATES = /* @__PURE__ */ new Set(["merged", "done"]);
+var CANCELLED_STATE = "cancelled";
+function deriveTasks(orchestration) {
+  const ids = Object.keys(orchestration.tasks);
+  const cancelled = ids.filter((id) => orchestration.tasks[id].status === CANCELLED_STATE).sort((a, b) => a.localeCompare(b));
+  const landed = ids.filter((id) => LANDED_STATES.has(orchestration.tasks[id].status)).length;
+  return { planned: ids.length, landed, cancelled };
+}
+function deriveThesisHeld(acceptance) {
+  if (acceptance.verdict !== "clean")
+    return false;
+  for (const dw of Object.values(acceptance.doneWhen)) {
+    if (dw.result === "dropped")
+      continue;
+    if (dw.result !== "pass")
+      return false;
+  }
+  return true;
+}
+function deriveInvariantsExercised(touched) {
+  return [...new Set(touched)].sort((a, b) => a.localeCompare(b));
+}
+function assembleBuildRecord(sources) {
+  const { narrated, git: git2, orchestration } = sources;
+  return {
+    format: BUILD_RECORD_FORMAT,
+    engagement: narrated.engagement,
+    engagementType: narrated.engagementType,
+    phase: { id: narrated.phase.id, name: narrated.phase.name },
+    status: narrated.status,
+    closedDate: git2.closedDate,
+    closeCommit: git2.closeCommit,
+    thesis: narrated.thesis,
+    thesisHeld: deriveThesisHeld(narrated.acceptance),
+    delivered: narrated.delivered,
+    seedGuards: projectSeedGuards(sources.guardEvalRuns),
+    acceptance: narrated.acceptance,
+    gatesEarnedKeep: narrated.gatesEarnedKeep,
+    instruments: narrated.instruments,
+    invariantsExercised: deriveInvariantsExercised(sources.touchedInvariants),
+    deviations: narrated.deviations,
+    tasks: deriveTasks(orchestration)
+  };
+}
+
+// dist/build-record/template.js
+function severityLabel(seed) {
+  return `\`${seed.patternRef}\` (severity \`${seed.severity}\`)`;
+}
+function renderDoneWhenRows(record2) {
+  const rows = [];
+  for (const [key, dw] of Object.entries(record2.acceptance.doneWhen)) {
+    const mark = dw.result === "pass" ? "\u2705" : dw.result === "dropped" ? "\u2014" : dw.result;
+    rows.push(`| ${key} | ${mark} | ${dw.detail} |`);
+  }
+  return rows.join("\n");
+}
+function renderBuildRecordMarkdown(record2) {
+  const { phase } = record2;
+  const guardsList = record2.seedGuards.map(severityLabel).join(", ");
+  const lines = [
+    // Fixed prose (vault-canonical template) + projected title slots.
+    `# Build Record \u2014 Phase ${phase.id}: ${phase.name}`,
+    "",
+    `**Format:** \`${record2.format}\` (markdown + JSON pair; portable, readable without Halfcycle systems)`,
+    "",
+    "> This Build Record was assembled automatically at phase close by the method bundle (`packages/bundle`). Every data field below is projected from the companion JSON \u2014 no record content is hand-authored.",
+    "",
+    `**Engagement:** ${record2.engagement} (${record2.engagementType})`,
+    `**Phase:** ${phase.id} \u2014 ${phase.name}`,
+    `**Status:** ${record2.status.toUpperCase()} \xB7 **Closed:** ${record2.closedDate} \xB7 **Close commit:** \`${record2.closeCommit}\``,
+    `**Companion:** [\`phase-${phase.id}.json\`](phase-${phase.id}.json)`,
+    "",
+    "## What this phase proved",
+    "",
+    `${record2.thesis} **Thesis held: ${record2.thesisHeld ? "yes" : "no"}.**`,
+    "",
+    "## Delivered",
+    "",
+    `- **Packages:** ${record2.delivered.packages.join(", ")}`,
+    `- **Services:** ${record2.delivered.services.join(", ")}`,
+    `- **Tools:** ${record2.delivered.tools.join(", ")}`,
+    `- **Dogfood:** ${record2.delivered.dogfood}`,
+    "",
+    guardsList ? `Guards evaluated (INV-007-safe results): ${guardsList}. *(Guard \`channel\`/\`version\` are guard-asset metadata, excluded from the v1 record \u2014 INV-007/INV-001.)*` : "No guards fired during this phase.",
+    "",
+    `## Acceptance (independent walk \u2014 walker ${record2.acceptance.walker})`,
+    "",
+    `**Verdict:** ${record2.acceptance.verdict} \xB7 **Findings:** ${record2.acceptance.findings}`,
+    "",
+    "| Done-when | Result | Evidence |",
+    "|---|---|---|",
+    renderDoneWhenRows(record2),
+    ""
+  ];
+  if (record2.acceptance.inv002ProdBypassProbe) {
+    lines.push(`**INV-002 production bypass probe:** ${record2.acceptance.inv002ProdBypassProbe.result} \u2014 ${record2.acceptance.inv002ProdBypassProbe.detail}`, "");
+  }
+  lines.push("## Gates that earned their keep", "", `**${record2.gatesEarnedKeep.defectsCaughtPreHuman}** defects were caught by the gates before the human walk; the walk itself found **${record2.gatesEarnedKeep.bugsReachingHumanWalk}**. Named: ${record2.gatesEarnedKeep.named.join("; ")}.`, "", "## Instruments", "", `- **Marginal-cost self-accounting:** ${record2.instruments.marginalCostSelfAccounting}`, `- **COE add-rate:** seam-new ${record2.instruments.coeAddRate.seamNew}, seam-repeat ${record2.instruments.coeAddRate.seamRepeat}, model-limitation ${record2.instruments.coeAddRate.modelLimitation}. ${record2.instruments.coeAddRate.notes}`, "", "## Invariants exercised", "", record2.invariantsExercised.join(", "), "", "## Deviations & decisions recorded", "", ...record2.deviations.map((d) => `- ${d}`), "", "## Tasks", "", `- **Planned:** ${record2.tasks.planned} \xB7 **Landed:** ${record2.tasks.landed} \xB7 **Cancelled:** ${record2.tasks.cancelled.length > 0 ? record2.tasks.cancelled.join(", ") : "none"}`, "");
+  return lines.join("\n");
+}
+
+// dist/build-record/write.js
+import { mkdirSync as mkdirSync5, writeFileSync as writeFileSync5 } from "node:fs";
+import { join as join9, resolve, relative as relative2, isAbsolute } from "node:path";
+var BUILD_RECORD_DIR = join9("docs", "build-records");
+function serialiseRecordJson(record2) {
+  return JSON.stringify(record2, null, 2) + "\n";
+}
+function writeBuildRecord(repoRoot, record2) {
+  const outDir = resolve(repoRoot, BUILD_RECORD_DIR);
+  const expected = resolve(repoRoot, BUILD_RECORD_DIR);
+  const rel = relative2(expected, outDir);
+  if (rel !== "" || isAbsolute(rel)) {
+    throw new Error(`[build-record] refusing to write outside ${BUILD_RECORD_DIR}`);
+  }
+  mkdirSync5(outDir, { recursive: true });
+  const jsonPath = join9(outDir, `phase-${record2.phase.id}.json`);
+  const mdPath = join9(outDir, `phase-${record2.phase.id}.md`);
+  writeFileSync5(jsonPath, serialiseRecordJson(record2), "utf-8");
+  writeFileSync5(mdPath, renderBuildRecordMarkdown(record2), "utf-8");
+  return { jsonPath, mdPath };
+}
+
+// dist/build-record/index.js
+function assemblePhaseBuildRecord(opts) {
+  const sources = loadSources({
+    repoRoot: opts.repoRoot,
+    phasesDir: opts.phasesDir,
+    guardEvalLogDir: opts.guardEvalLogDir,
+    phaseId: opts.phaseId,
+    narrated: opts.narrated,
+    touchedInvariants: opts.touchedInvariants
+  });
+  const record2 = assembleBuildRecord(sources);
+  return writeBuildRecord(opts.repoRoot, record2);
+}
+export {
+  BUILD_RECORD_DIR,
+  BUILD_RECORD_FORMAT,
+  CreateEngagementRefused,
+  FLAT_FILE_TRACKER_HOME,
+  HALFCYCLE_STATE_FORMAT,
+  MissingSourceError,
+  SetupManifest,
+  ZONE_B_DIR,
+  agentsPointerRow,
+  applySetupWrites,
+  assembleBuildRecord,
+  assemblePhaseBuildRecord,
+  buildEngagementRecord,
+  checkDrift,
+  contextIndexRow,
+  createEngagement,
+  deriveInvariantsExercised,
+  deriveTasks,
+  deriveThesisHeld,
+  discoverRepository,
+  documentSectionRow,
+  engagementRecordRow,
+  flatFileTrackerDefault,
+  install,
+  layerDocumentRow,
+  loadSources,
+  mergeSettings,
+  mergeWithRecords,
+  mintBoardEnterCode,
+  mintOrReadIdentity,
+  projectSeedGuard,
+  projectSeedGuards,
+  questionsToPut,
+  readBundlePin,
+  readGitClose,
+  readGuardEvalLog,
+  readOrchestrationState,
+  readRemote,
+  readRootCommit,
+  renderAnchor,
+  renderBuildRecordMarkdown,
+  renderDiscovery,
+  runBootstrapScan,
+  scanLayers,
+  serialiseRecordJson,
+  trackerHomeRow,
+  validateNarrated,
+  writeBuildRecord
+};
+//# sourceMappingURL=index.js.map