halfcycle 0.4.7 → 0.4.9

package/dist/close-phase.d.ts

@@ -1,45 +1,52 @@
 /**
- * Close-phase wiring — the CLI's call to `POST {baseUrl}/engagements/:id/accept`
- * (walk 6 F-1, INV-022's sixth occurrence).
+ * Close-phase wiring — the CLI's half of the close review (feature
+ * `close-review-and-carry-drop` AC1, decision 2; System view · E3).
  *
- * WHY THIS EXISTS AT ALL, WHICH IS THE WHOLE POINT OF THE FINDING. Closing a phase
- * has had a reachable route since PM-E6-T-18 and a working transition from `active`
- * since W4-1 — but the only CLI that drove it is `phase-close-admin`, which ships
- * inside the control plane and is therefore hosted-only (INV-001). A Connect client runs
- * `npx halfcycle` in their own repo and can never run it. So the clean close was
- * reachable by curl and by nothing the product ships, and every acceptance walk was
- * pushed onto `open-phase --override` instead.
+ * WHAT THIS VERB DOES NOW. It closes nothing. A phase closes only on its owner's last
+ * review decision, which the control service makes inside that decision's own
+ * transaction. This verb is the coordinator's act: it carries what the coordinator
+ * knows — the walk's verdict and findings (INV-009: sourced from the acceptance walk,
+ * never inferred), who ran the close step, and the client's statements — and asks the
+ * service to open the review. It writes no Build Record and clears no phase stamp:
+ * the phase is still open. `build-record <phase>`, run once the owner's last decision
+ * has closed it, writes the record and clears the stamp (`build-record/obtain.ts`).
  *
- * `open-phase` and `close-phase` are the two halves of one cycle and now sit beside
- * each other in one package, with one credential and one shape. That is the fix:
- * not a new precondition, not a way to make a Studio gate satisfiable — the gate was
- * never the problem — but the missing client half of a path that already worked.
+ * THE ORDER, AND WHY.
+ *   1. The whole request is checked against the route's own schema
+ *      (`openReviewRequestSchema`, the one home of its shape, INV-003) BEFORE anything
+ *      is sent — a request this machine refuses sends nothing, not even the counts.
+ *   2. The commit HEAD points at is read (`readHeadCommit`), so the statements carry
+ *      the commit the review starts from.
+ *   3. A fresh count of what changed under each part is sent through the runner's
+ *      `observe` verb (`what-halfcycle-saw` AC3, the unthrottled sender), so the review
+ *      starts from the commit the walk saw. The runner is SPAWNED as a child process,
+ *      never imported: this package may import only the two shared packages
+ *      (INV-001), and counting keeps one home, the runner's. The project credential
+ *      this verb already read travels through the child's environment under the names
+ *      the runner's own configuration reader reads. Whatever the child answers, the
+ *      open goes ahead: a count that could not be sent is said once by the open
+ *      answer's `counted`, never by a line of this verb's own.
+ *   4. The open request is posted, and the answer is parsed through
+ *      `openReviewAnswerSchema`. Each outcome prints its own sentence (CL1–CL6, CL12,
+ *      and the typed review's H1), written out below exactly as the spec words them.
  *
- * **This verb names no capability only Studio has.** No GitHub installation, no
- * portal session, no operator picking anything up, and it never touches
- * `delivering`. It is the same call in both topologies (`acceptPhase` is legal from
- * `active` AND from `delivering`), which is what makes it safe to print in a refusal
- * that both topologies can read — see `PhaseEntryConditionError`.
+ * `override` IS GONE FROM THE CLOSE (W1-3). There is no way through an unfinished step:
+ * the remedy is to finish it, decline it or pass its review again. The method version
+ * does not move at the close either (W1-5); only `open-phase` moves it, so this verb
+ * never touches the committed pin.
  *
- * WIRING, NOT MACHINERY — the same posture as `open-phase.ts`. The verdict is the
- * caller's (INV-009: SOURCED from the acceptance walk, never inferred from "no guard
- * fired"), the findings/detail consistency rule is the control plane's, and the
- * derive-then-transition ordering is the orchestrator's. This module builds the
- * request, sends it, and reports what came back.
+ * TOPOLOGY. This verb names no capability only Studio has: the open route takes the
+ * engagement credential alone, needs no GitHub installation, no portal session and no
+ * `delivering` status (INV-022).
  *
- * INV-001: this file imports the global `fetch` (Node 20), Node builtins, and
- * `@halfcycle/events` — one of the exactly two workspace packages a shippable may
- * import. `acceptPhaseRequestSchema` is the ONE home for the request's shape
- * (INV-003), so the CLI validates the whole body it builds against the same schema
- * the route parses with. It never imports the control service.
+ * INV-001: this file imports the global `fetch`, Node builtins, `@halfcycle/events`
+ * and `@halfcycle/core`. It never imports the control service or the runner.
  *
- * SINCE CONNECT PHASE 4 (`close-produces-the-record`) the close carries the
- * client's statements and the full commit it closed at, and writes no local close
- * note. The service freezes both into the phase's Build Record; the caller fetches
- * that record afterwards (`build-record/obtain.ts`).
+ * SHIPS TO CLIENT DISK inside the CLI: every string here is a sentence a person reads,
+ * and no comment sits beside an object member.
  */
-import { type AcceptanceOutcome, type MethodUpdate, type PhaseCloseDecision } from '@halfcycle/events';
-import { type PhaseStampFailure, type RepoCredential } from './open-phase.js';
+import { unfinishedStepLine, type AcceptanceOutcome, type ObserveRunResult, type OpenReviewAnswer } from '@halfcycle/events';
+import type { RepoCredential } from './open-phase.js';
 /**
  * Whether the commit this phase closed at could be read, and if so the full hash
  * that travelled with the close. When it could not, `reason` says why in words a
@@ -63,121 +70,195 @@ export interface StatedStatements {
 }
 /** Nothing stated — what a close sends when no statement flag was given. */
 export declare const NO_STATEMENTS: StatedStatements;
-/** What `POST /engagements/:id/accept` returns on 200 (the fields the CLI reports). */
-export interface ClosedPhase {
-    engagementId: string;
-    /** The lifecycle status after the close — `closed`. */
-    status: string;
-    /**
-     * Set when the phase closed but this machine's record of it could not be
-     * cleared. `null` on every ordinary success. Until it is cleared, work on this
-     * machine is still filed under a phase that is no longer open.
-     */
-    stampFailure: PhaseStampFailure | null;
-    /** The commit sent with the close, or why none could be read. */
-    closeCommit: CloseCommitOutcome;
-    /**
-     * The method version this close moved the project to (`existing-projects-carry-on`
-     * AC2), or `null` when it did not move. An older control's answer carries no
-     * field at all, which reads the same as `null` here — this CLI then prints
-     * and writes nothing about a move, exactly as it did before this field existed.
-     */
-    methodUpdated: MethodUpdate | null;
-}
 /**
- * Read the full HEAD commit of the NAMED repository, before the close is sent.
+ * Why the full HEAD commit of a named repository could not be read, in one place
+ * both `open-phase` and `close-phase` read (`what-halfcycle-saw` AC1):
+ *   - `no-repository` — no folder was named for the read, or the named folder is not
+ *     a git repository at all.
+ *   - `no-commit` — the folder IS a repository, with no commit on it yet.
+ *   - `unreadable` — git could not be run at all, or its answer was not a full
+ *     commit hash. `missingGit` tells those two apart: `close-phase` has always
+ *     printed them as two separate sentences (`readCloseCommit`, below), so the
+ *     detail travels on the cause rather than being thrown away here.
+ */
+export type HeadCommitCause = 'no-repository' | 'no-commit' | 'unreadable';
+/** Whether the full HEAD commit of a named repository could be read, and why not. */
+export type HeadCommitOutcome = {
+    read: true;
+    commit: string;
+} | {
+    read: false;
+    cause: 'no-repository' | 'no-commit';
+} | {
+    read: false;
+    cause: 'unreadable';
+    missingGit: boolean;
+};
+/**
+ * Read the full HEAD commit of the NAMED repository.
+ *
+ * ONE READER FOR BOTH VERBS. `close-phase` reads HEAD to send where a phase ends
+ * (`readCloseCommit`, below, is this function's body under the name that verb has
+ * always used); `open-phase` reads it to send where a phase starts
+ * (`what-halfcycle-saw` AC1). One way to read a commit off the person's disk, not two
+ * that could disagree about what "unreadable" means.
  *
  * `gitEnvForNamedRepo` strips the variables that tell git which repository to use,
  * so an absolute `GIT_DIR` inherited from a hook cannot substitute another
- * repository's HEAD for this one's. git's own stderr is discarded: a failure here
- * is expected, the close still goes ahead, and the caller says why in plain words.
- * The hash is checked by the contract's own `closeCommitSchema`, so a short or
- * malformed answer is never sent.
+ * repository's HEAD for this one's. git's own stderr is discarded throughout: a
+ * failure here is expected, the caller still proceeds, and it says why in this
+ * product's own words, never git's. The hash is checked by the contract's own
+ * `closeCommitSchema`, so a short or malformed answer is never treated as read.
+ *
+ * `no-repository` and `no-commit` are told apart by a second call
+ * (`rev-parse --git-dir`), made only when the first failed for a reason other than
+ * git being missing: if the folder IS a repository, that first failure can only mean
+ * it has no commit yet.
  */
-export declare function readCloseCommit(repoRoot: string | undefined): CloseCommitOutcome;
+export declare function readHeadCommit(repoRoot: string | undefined): HeadCommitOutcome;
 /**
- * A refusal from the control plane, carried as an error the CLI can print whole.
+ * Read the full HEAD commit of the NAMED repository, before the close is sent.
  *
- * The two that matter and what they mean, because a status code alone sends people
- * to the wrong fix:
- *   - `409` — a refusal. THREE different ones now share this code (already closed;
- *     outstanding work; the phase is not the one open), which is why `code` below
- *     exists: the status alone stopped being enough to say what happened.
- *   - `422` — the outcome is not a valid INV-009 outcome (most often the findings
- *     count disagreeing with the number of `--finding` summaries). Nothing was
- *     written: the derivation validates before any write.
- */
-export declare class ClosePhaseRefused extends Error {
-    readonly status: number;
-    /**
-     * What the control plane's own store found outstanding in this phase, when the
-     * refusal was a `PhaseCloseConditionUnmet` (walk 7 `F-4`). Absent on every other
-     * refusal. Carried separately from `message` so the CLI can print the finding on
-     * its own line, the way `open-phase` prints a crossed entry finding.
-     */
-    readonly finding?: string | undefined;
-    /**
-     * The plane's own name for the refusal (`error` on the body) — e.g.
-     * `PhaseAlreadyClosed`, `PhaseCloseConditionUnmet`, `PhaseNotOpen`.
-     *
-     * WHY IT IS CARRIED (walk 8 `F-1`). The CLI used to read a bare `409` as "this
-     * phase is already closed" and print that as advice. Once a wrong phase NAME
-     * became its own 409, that line printed underneath a refusal saying the opposite
-     * — the plane said *phase 1 is open, close that one* and the CLI said *it is
-     * already closed*. Guessing a cause from a status code is how a remedy string
-     * comes to contradict the refusal above it; the code is read, not inferred.
-     */
-    readonly code?: string | undefined;
-    constructor(status: number, message: string, 
-    /**
-     * What the control plane's own store found outstanding in this phase, when the
-     * refusal was a `PhaseCloseConditionUnmet` (walk 7 `F-4`). Absent on every other
-     * refusal. Carried separately from `message` so the CLI can print the finding on
-     * its own line, the way `open-phase` prints a crossed entry finding.
-     */
-    finding?: string | undefined, 
-    /**
-     * The plane's own name for the refusal (`error` on the body) — e.g.
-     * `PhaseAlreadyClosed`, `PhaseCloseConditionUnmet`, `PhaseNotOpen`.
-     *
-     * WHY IT IS CARRIED (walk 8 `F-1`). The CLI used to read a bare `409` as "this
-     * phase is already closed" and print that as advice. Once a wrong phase NAME
-     * became its own 409, that line printed underneath a refusal saying the opposite
-     * — the plane said *phase 1 is open, close that one* and the CLI said *it is
-     * already closed*. Guessing a cause from a status code is how a remedy string
-     * comes to contradict the refusal above it; the code is read, not inferred.
-     */
-    code?: string | undefined);
-}
+ * `readHeadCommit`'s body, mapped to the two sentences this verb has always
+ * printed for `unreadable` — git being missing on this machine, and git running
+ * but not answering with a full hash, read differently by whoever hits them, so
+ * they stay two sentences rather than merging into one that explains neither.
+ */
+export declare function readCloseCommit(repoRoot: string | undefined): CloseCommitOutcome;
+/**
+ * The longest the `observe` child may run before it is stopped and the open goes ahead
+ * without it. The child makes two requests with a 1.5 s deadline each and a handful of
+ * git calls with their own caps; this is a backstop for a child that hangs, not a
+ * budget it is expected to use.
+ */
+export declare const OBSERVE_CHILD_DEADLINE_MS = 30000;
+/**
+ * The environment names the runner's configuration reader takes the project
+ * credential from: the token, the project id, and the service address. Named once,
+ * here, because the runner cannot be imported to read them (INV-001); the spawn test
+ * proves the child reads exactly these.
+ */
+export declare const OBSERVE_CHILD_CREDENTIAL_ENV: {
+    readonly token: "GUARD_SERVICE_TOKEN";
+    readonly engagementId: "GUARD_ENGAGEMENT_ID";
+    readonly serviceUrl: "HALFCYCLE_SERVICE_URL";
+};
+/**
+ * The child's environment: this process's, without the variables that tell git which
+ * repository to use (an absolute `GIT_DIR` inherited from a hook would otherwise count
+ * another repository), and with the project credential this verb already read set
+ * under the runner's own names — so the child counts for the same project, against the
+ * same service, that the open is sent to.
+ */
+export declare function observeChildEnv(credential: RepoCredential): NodeJS.ProcessEnv;
+/**
+ * The one line the `observe` child printed, read through `observeRunResultSchema`, or
+ * `unreachable` when stdout holds no such line.
+ */
+export declare function readObserveLine(stdout: string): ObserveRunResult;
 /**
- * A close refused on this machine, before anything was sent: the request failed the
- * shared request schema. The CLI prints the message and exits as a usage error.
+ * Send a fresh count by running the runner binary this package ships, as a child
+ * process, in the named repository: `node <binary> observe`. Never throws, never
+ * prints: a binary that cannot be found (`binary` is the error that said so), a child
+ * that cannot start, runs past `OBSERVE_CHILD_DEADLINE_MS` or prints no result line
+ * all read `unreachable`, and the open goes ahead.
+ */
+export declare function runObserveChild(binary: string | Error, credential: RepoCredential, repoRoot: string): Promise<ObserveRunResult>;
+/**
+ * A close step refused on this machine, before anything was sent: the request failed
+ * the shared request schema. The CLI prints the message and exits as a usage error.
  */
 export declare class CloseRequestInvalid extends Error {
     constructor(message: string);
 }
 /**
- * Record a phase's acceptance and close it.
+ * What came back from the open route:
+ * - `answered`: a body the open route's own answer schema accepts — one of its
+ *   outcomes, or the not-open body;
+ * - `refused`: any other answer that was not a success, with its status and the
+ *   service's own sentence when it gave one;
+ * - `unreadable`: a success whose body is not an answer this CLI can read;
+ * - `unreachable`: the service could not be reached at all.
+ */
+export type ReviewOpenAnswer = {
+    kind: 'answered';
+    answer: OpenReviewAnswer;
+} | {
+    kind: 'refused';
+    status: number;
+    message: string | null;
+} | {
+    kind: 'unreadable';
+    status: number;
+} | {
+    kind: 'unreachable';
+    why: string;
+};
+/** What one run of the close step did: the count it sent, the commit it read, the answer. */
+export interface ReviewOpenAttempt {
+    observe: ObserveRunResult;
+    closeCommit: CloseCommitOutcome;
+    open: ReviewOpenAnswer;
+}
+/** What the close step sends: who ran it, the walk's outcome, and the client's statements. */
+export interface CloseStepRequest {
+    actor: string;
+    acceptanceOutcome: AcceptanceOutcome;
+    stated: StatedStatements;
+}
+/** The address of a phase's open route: the phase is one path segment, encoded once. */
+export declare function reviewOpenUrl(credential: RepoCredential, phase: string): string;
+/**
+ * Run the close step: check the request, read HEAD, send a fresh count through
+ * `observe`, then ask the service to open the review of `phase`.
  *
- * @param phase   the phase being closed, named explicitly — the lifecycle row has no
- *                phase column (PM-E4-DEC-7), so the caller names what closed.
- * @param outcome the SOURCED INV-009 verdict + findings.
- * @param close   WHO is closing it and on what basis (walk 7 `F-4`). Required here
- *                for the same reason `openPhase` requires its entry decision: there
- *                is no argument-less way to move the phase axis, so an unattributed
- *                close is unreachable from any caller that compiles.
- * @param repoRoot the repository whose HEAD this close is sent with.
- *                Optional so that a caller with no repository in hand — a test
- *                harness, a future non-repo surface — is not forced to invent one;
- *                omitting it sends no commit rather than silently resolving the
+ * @param observe the fresh count, run after the request is checked and before the open
+ *                is sent. The CLI passes `runObserveChild` over the shipped runner
+ *                binary; it is a parameter so this function holds no path to a binary
+ *                of its own.
+ * @param repoRoot the repository whose HEAD the statements carry. Optional so a caller
+ *                with no repository in hand sends no commit rather than resolving the
  *                process's working directory, which would send a stranger's HEAD.
- * @param stated  the client's own statements; each absent one is sent as not
- *                stated (`null`, or no deviations).
  *
- * @throws ClosePhaseRefused on a 4xx the plane explained, so the CLI prints the
- *         plane's own sentence and exits non-zero.
- * @throws Error before anything is sent when the request fails the shared schema;
- *         on transport failure; or on a body that is not the expected shape.
+ * @throws CloseRequestInvalid before anything is sent — no count and no open — when the
+ *         request fails the shared schema or the phase is not a phase name (the one
+ *         rule, `phaseNameSchema`); nothing else is thrown — every answer is an outcome.
+ */
+export declare function openPhaseReview(credential: RepoCredential, phase: string, request: CloseStepRequest, observe: () => Promise<ObserveRunResult>, repoRoot?: string): Promise<ReviewOpenAttempt>;
+/** CL1 — the review is open. */
+export declare function reviewOpenedLine(phase: string): string;
+/** CL2 — Halfcycle could not count what the phase changed. */
+export declare const COULD_NOT_COUNT_LINE = "[halfcycle] Halfcycle could not count what this phase changed, so the owner judges each part on what the agents reported alone.";
+/** H1 (`typed-close-review`) — how the owner reviews, or that typing is switched off. */
+export declare function typedReviewHintLine(offered: boolean): string;
+/** CL3 — tasks of the phase are not finished, named by title, at most ten. */
+export declare function tasksOpenLine(phase: string, open: readonly string[], more: number): string;
+/** CL4 — no build of the phase has been reported. */
+export declare function noBuildLine(phase: string): string;
+/** CL5 — a round is already open and waiting for the owner. */
+export declare function reviewAlreadyOpenLine(phase: string): string;
+/**
+ * CL6 — steps of the phase are unfinished: the first line names each with its state,
+ * then one line per step from `unfinishedStepLine` (the one composer the typed review
+ * prints too), then what to run after.
+ */
+export declare function unfinishedStepsLines(phase: string, steps: Parameters<typeof unfinishedStepLine>[0][]): string[];
+/** CL12 — a clean verdict over defects recorded against the phase. */
+export declare function cleanOverFindingsLine(phase: string, findings: number): string;
+/** What the close step prints for one attempt, and the exit code it ends with. */
+export interface CloseStepReport {
+    stdout: string[];
+    stderr: string[];
+    exitCode: 0 | 1;
+}
+/**
+ * Every line the close step prints for one attempt. An open prints CL1, then CL2 when
+ * the answer says Halfcycle could not count, then H1, and closes nothing; a commit
+ * that could not be read is then said on stderr, with the reasons this verb has always
+ * given (git missing and git's bad answer stay two), because the statements carry the
+ * commit to the record. A refusal from the service names each field by its flag, as a
+ * refusal on this machine does (`describeIssuePath`). A refusal prints
+ * its own sentence and exits 1.
  */
-export declare function closePhase(credential: RepoCredential, phase: string, outcome: AcceptanceOutcome, close: PhaseCloseDecision, home?: string, repoRoot?: string, stated?: StatedStatements): Promise<ClosedPhase>;
+export declare function closeStepReport(phase: string, attempt: ReviewOpenAttempt): CloseStepReport;
 //# sourceMappingURL=close-phase.d.ts.map

package/dist/close-phase.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"close-phase.d.ts","sourceRoot":"","sources":["../src/close-phase.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAGH,OAAO,EAIL,KAAK,iBAAiB,EACtB,KAAK,YAAY,EACjB,KAAK,kBAAkB,EACxB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAmB,KAAK,iBAAiB,EAAE,KAAK,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAG/F;;;;GAIG;AACH,MAAM,MAAM,kBAAkB,GAAG;IAAE,IAAI,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAElG;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,UAAU,EAAE,MAAM,EAAE,CAAC;CACtB;AAED,4EAA4E;AAC5E,eAAO,MAAM,aAAa,EAAE,gBAAkE,CAAC;AAE/F,uFAAuF;AACvF,MAAM,WAAW,WAAW;IAC1B,YAAY,EAAE,MAAM,CAAC;IACrB,uDAAuD;IACvD,MAAM,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,YAAY,EAAE,iBAAiB,GAAG,IAAI,CAAC;IACvC,iEAAiE;IACjE,WAAW,EAAE,kBAAkB,CAAC;IAChC;;;;;OAKG;IACH,aAAa,EAAE,YAAY,GAAG,IAAI,CAAC;CACpC;AAcD;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,kBAAkB,CA4BhF;AAED;;;;;;;;;;;GAWG;AACH,qBAAa,iBAAkB,SAAQ,KAAK;aAExB,MAAM,EAAE,MAAM;IAE9B;;;;;OAKG;aACa,OAAO,CAAC,EAAE,MAAM;IAChC;;;;;;;;;;OAUG;aACa,IAAI,CAAC,EAAE,MAAM;gBApBb,MAAM,EAAE,MAAM,EAC9B,OAAO,EAAE,MAAM;IACf;;;;;OAKG;IACa,OAAO,CAAC,EAAE,MAAM,YAAA;IAChC;;;;;;;;;;OAUG;IACa,IAAI,CAAC,EAAE,MAAM,YAAA;CAKhC;AAED;;;GAGG;AACH,qBAAa,mBAAoB,SAAQ,KAAK;gBAChC,OAAO,EAAE,MAAM;CAI5B;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAsB,UAAU,CAC9B,UAAU,EAAE,cAAc,EAC1B,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,iBAAiB,EAC1B,KAAK,EAAE,kBAAkB,EACzB,IAAI,CAAC,EAAE,MAAM,EACb,QAAQ,CAAC,EAAE,MAAM,EACjB,MAAM,GAAE,gBAAgC,GACvC,OAAO,CAAC,WAAW,CAAC,CAiFtB"}
+{"version":3,"file":"close-phase.d.ts","sourceRoot":"","sources":["../src/close-phase.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AAGH,OAAO,EAQL,kBAAkB,EAClB,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,EACtB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAGtD;;;;GAIG;AACH,MAAM,MAAM,kBAAkB,GAAG;IAAE,IAAI,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAElG;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,UAAU,EAAE,MAAM,EAAE,CAAC;CACtB;AAED,4EAA4E;AAC5E,eAAO,MAAM,aAAa,EAAE,gBAAkE,CAAC;AAE/F;;;;;;;;;;GAUG;AACH,MAAM,MAAM,eAAe,GAAG,eAAe,GAAG,WAAW,GAAG,YAAY,CAAC;AAE3E,qFAAqF;AACrF,MAAM,MAAM,iBAAiB,GACzB;IAAE,IAAI,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC9B;IAAE,IAAI,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,eAAe,GAAG,WAAW,CAAA;CAAE,GACrD;IAAE,IAAI,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,YAAY,CAAC;IAAC,UAAU,EAAE,OAAO,CAAA;CAAE,CAAC;AAE9D;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,iBAAiB,CAgC9E;AAED;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,kBAAkB,CAkBhF;AAID;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB,QAAS,CAAC;AAEhD;;;;;GAKG;AACH,eAAO,MAAM,4BAA4B;;;;CAI/B,CAAC;AAKX;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,UAAU,EAAE,cAAc,GAAG,MAAM,CAAC,UAAU,CAM7E;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,gBAAgB,CAUhE;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAC7B,MAAM,EAAE,MAAM,GAAG,KAAK,EACtB,UAAU,EAAE,cAAc,EAC1B,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,gBAAgB,CAAC,CAuB3B;AAID;;;GAGG;AACH,qBAAa,mBAAoB,SAAQ,KAAK;gBAChC,OAAO,EAAE,MAAM;CAI5B;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,gBAAgB,GACxB;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,MAAM,EAAE,gBAAgB,CAAA;CAAE,GAC9C;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GAC3D;IAAE,IAAI,EAAE,YAAY,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACtC;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC;AAEzC,6FAA6F;AAC7F,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,gBAAgB,CAAC;IAC1B,WAAW,EAAE,kBAAkB,CAAC;IAChC,IAAI,EAAE,gBAAgB,CAAC;CACxB;AAED,8FAA8F;AAC9F,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,iBAAiB,EAAE,iBAAiB,CAAC;IACrC,MAAM,EAAE,gBAAgB,CAAC;CAC1B;AAED,wFAAwF;AACxF,wBAAgB,aAAa,CAAC,UAAU,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAK/E;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,eAAe,CACnC,UAAU,EAAE,cAAc,EAC1B,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,gBAAgB,EACzB,OAAO,EAAE,MAAM,OAAO,CAAC,gBAAgB,CAAC,EACxC,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,iBAAiB,CAAC,CAkE5B;AA6BD,gCAAgC;AAChC,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAMtD;AAED,8DAA8D;AAC9D,eAAO,MAAM,oBAAoB,oIACkG,CAAC;AAEpI,yFAAyF;AACzF,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,CAI5D;AAED,8EAA8E;AAC9E,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAe1F;AAED,qDAAqD;AACrD,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAKjD;AAED,+DAA+D;AAC/D,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAK3D;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,UAAU,CAAC,OAAO,kBAAkB,CAAC,CAAC,CAAC,CAAC,EAAE,GAChD,MAAM,EAAE,CAOV;AAED,sEAAsE;AACtE,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAI7E;AAED,kFAAkF;AAClF,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,QAAQ,EAAE,CAAC,GAAG,CAAC,CAAC;CACjB;AAED;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,iBAAiB,GAAG,eAAe,CA2E1F"}

package/dist/draw/index.d.ts

@@ -18,6 +18,17 @@
  * just before writing, so a refusal this command can make locally never costs a
  * request, and a change made while it waited is still seen.
  *
+ * THE CLOSED ARM COMES FIRST, for a phase (`part-state-and-builds` AC5, #1742's forward
+ * close half). After the identity and flight-deck checks, `localRefusal` is asked once
+ * and the credential is read (`readCredentialOrLine`, `../system-report.ts`) before
+ * anything is sent — no description, no plan. `{ picture: 'closed-phase', phase }`
+ * is then sent alone. `drawn` is checked and written exactly as steps (4) and (5) above,
+ * and nothing else is sent: a closed phase needs no plan file and no fresh description.
+ * `refused` stops the verb with the service's reason. Anything else — `not-closed`, a
+ * missing route, or the service unavailable — runs the order above unchanged, from (1):
+ * a server that does not yet know this phase as closed, or does not know the arm at
+ * all, draws the phase exactly as it did before this spec.
+ *
  * A PHASE'S FILES. The base name is `phaseDiagramBase(phase)`, `renderPhaseSegment`'s
  * segment. A phase that is not a valid identity is refused naming it, before anything
  * is read; so is one whose base name ends in the Flight Deck word, in any case, whose
@@ -32,15 +43,20 @@
  * For a phase, the plan route and the draw route's phase arm ship in one service
  * release, so a missing plan route is the one signal that this service cannot draw
  * phase pictures, and the draw route is then never asked. Anything else is reported by
- * its status and the service's own sentence.
+ * its status and the service's own sentence. The answer-parsing switch is exhaustive
+ * over `systemDrawResultSchema`'s four outcomes, with a `never` default (`assertNever`):
+ * a fifth outcome added to the wire without a matching case here is a compile error.
  *
  * NO BYTE OF THE RESPONSE DECIDES A PATH (INV-023): the response gives contents only;
  * where they go is `./write.ts`'s constants and the base name this module chose from
  * the arguments.
  *
- * WHAT LEAVES THE MACHINE. The checked description (through the shared stage); for a
- * phase, the checked plan (through `plan`'s request); then only the draw request,
- * `{ version, picture: 'architecture' }` or `{ picture: 'phase', phase, planVersion }`.
+ * WHAT LEAVES THE MACHINE. For the architecture, the checked description (through the
+ * shared stage), then `{ version, picture: 'architecture' }`. For a phase, first
+ * `{ picture: 'closed-phase', phase }` alone; only once that answers `not-closed` (or a
+ * missing route, or the service is unavailable) does the checked description and the
+ * checked plan (through `plan`'s request) go out, then `{ picture: 'phase', phase,
+ * planVersion }`.
  *
  * INV-001: Node builtins, the global `fetch`, `@halfcycle/events` and `@halfcycle/core`
  * only. SHIPS TO CLIENT DISK inside the CLI: every string here is a sentence a person
@@ -81,7 +97,9 @@ export declare function parseDrawArgs(argv: readonly string[]): DrawArgs;
  * What came of asking for the drawing. `drawn`: the Mermaid and every look's picture,
  * parsed under the strict result schema (so no look is missing and none is extra) but
  * not yet checked. `refused`: the service's reason. `no-route`: this service cannot draw yet.
- * `unavailable`: it could not be drawn, and `why` says so.
+ * `unavailable`: it could not be drawn, and `why` says so. `not-closed`: the answer to
+ * the closed arm alone (`part-state-and-builds` AC5) — the phase has not closed, or was
+ * opened again since, so the caller draws it as it stands now with the `phase` arm.
  */
 export type DrawOutcome = {
     kind: 'drawn';
@@ -94,6 +112,8 @@ export type DrawOutcome = {
 } | {
     kind: 'unavailable';
     why: string;
+} | {
+    kind: 'not-closed';
 };
 /** The address the drawing is asked of: the engagement is one path segment, encoded once. */
 export declare function systemDrawUrl(credential: RepoCredential): string;

package/dist/draw/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/draw/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AAEH,OAAO,EAIL,KAAK,eAAe,EACpB,KAAK,iBAAiB,EACvB,MAAM,mBAAmB,CAAC;AAG3B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,EAAyD,KAAK,QAAQ,EAAE,MAAM,YAAY,CAAC;AAClG,OAAO,EAA8C,KAAK,UAAU,EAAE,KAAK,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAClH,OAAO,EAcL,KAAK,eAAe,EACpB,KAAK,UAAU,EACf,KAAK,kBAAkB,EACvB,KAAK,YAAY,EAClB,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,eAAe,EACf,aAAa,EACb,mBAAmB,EACnB,aAAa,EACb,wBAAwB,EACxB,aAAa,EACb,UAAU,EACV,cAAc,EACd,cAAc,EACd,gBAAgB,EAChB,gBAAgB,EAChB,YAAY,EACZ,KAAK,EACL,KAAK,EACL,YAAY,EACZ,eAAe,EACf,KAAK,eAAe,GACrB,MAAM,YAAY,CAAC;AAEpB,kFAAkF;AAClF,eAAO,MAAM,UAAU,6EAA6E,CAAC;AAErG,oEAAoE;AACpE,MAAM,MAAM,WAAW,GAAG;IAAE,IAAI,EAAE,cAAc,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEtF;;;;;;GAMG;AACH,MAAM,MAAM,QAAQ,GAAG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,WAAW,CAAC;IAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAA;CAAE,CAAC;AAExG,wBAAgB,aAAa,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,QAAQ,CAsB/D;AAED;;;;;GAKG;AACH,MAAM,MAAM,WAAW,GACnB;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,eAAe,CAAA;CAAE,GACzC;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACnC;IAAE,IAAI,EAAE,UAAU,CAAA;CAAE,GACpB;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC;AAEzC,6FAA6F;AAC7F,wBAAgB,aAAa,CAAC,UAAU,EAAE,cAAc,GAAG,MAAM,CAEhE;AAUD;;;GAGG;AACH,wBAAsB,cAAc,CAAC,UAAU,EAAE,cAAc,EAAE,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,WAAW,CAAC,CAkDjH;AAED;;;GAGG;AACH,MAAM,WAAW,QAAS,SAAQ,UAAU;IAC1C,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,YAAY,CAAC,CAAC;IAC5C,QAAQ,CAAC,IAAI,EAAE,CAAC,UAAU,EAAE,cAAc,EAAE,OAAO,EAAE,iBAAiB,KAAK,OAAO,CAAC,WAAW,CAAC,CAAC;IAChG,QAAQ,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,EAAE,GAAG,EAAE,UAAU,KAAK,kBAAkB,CAAC;CAClG;AAaD;;;;GAIG;AACH,MAAM,MAAM,WAAW,GAAG;IAAE,GAAG,EAAE,YAAY,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,eAAe,CAAA;CAAE,CAAC;AAEpF,uCAAuC;AACvC,eAAO,MAAM,kBAAkB,EAAE,WAA2E,CAAC;AAE7G,iEAAiE;AACjE,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,WAAW,CAErD;AAED,sFAAsF;AACtF,wBAAgB,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,GAAG,MAAM,CAWvE;AAYD;;;GAGG;AACH,wBAAsB,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,GAAG,OAAO,CAAC,SAAS,CAAC,CA4DxG"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/draw/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgEG;AAEH,OAAO,EAIL,KAAK,eAAe,EACpB,KAAK,iBAAiB,EACvB,MAAM,mBAAmB,CAAC;AAG3B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,EAA2E,KAAK,QAAQ,EAAE,MAAM,YAAY,CAAC;AACpH,OAAO,EAIL,KAAK,UAAU,EACf,KAAK,SAAS,EACf,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAcL,KAAK,eAAe,EACpB,KAAK,UAAU,EACf,KAAK,kBAAkB,EACvB,KAAK,YAAY,EAClB,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,eAAe,EACf,aAAa,EACb,mBAAmB,EACnB,aAAa,EACb,wBAAwB,EACxB,aAAa,EACb,UAAU,EACV,cAAc,EACd,cAAc,EACd,gBAAgB,EAChB,gBAAgB,EAChB,YAAY,EACZ,KAAK,EACL,KAAK,EACL,YAAY,EACZ,eAAe,EACf,KAAK,eAAe,GACrB,MAAM,YAAY,CAAC;AAEpB,kFAAkF;AAClF,eAAO,MAAM,UAAU,6EAA6E,CAAC;AAErG,oEAAoE;AACpE,MAAM,MAAM,WAAW,GAAG;IAAE,IAAI,EAAE,cAAc,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEtF;;;;;;GAMG;AACH,MAAM,MAAM,QAAQ,GAAG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,WAAW,CAAC;IAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAA;CAAE,CAAC;AAExG,wBAAgB,aAAa,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,QAAQ,CAsB/D;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,WAAW,GACnB;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,eAAe,CAAA;CAAE,GACzC;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACnC;IAAE,IAAI,EAAE,UAAU,CAAA;CAAE,GACpB;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GACpC;IAAE,IAAI,EAAE,YAAY,CAAA;CAAE,CAAC;AAO3B,6FAA6F;AAC7F,wBAAgB,aAAa,CAAC,UAAU,EAAE,cAAc,GAAG,MAAM,CAEhE;AAUD;;;GAGG;AACH,wBAAsB,cAAc,CAAC,UAAU,EAAE,cAAc,EAAE,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,WAAW,CAAC,CA2DjH;AAED;;;GAGG;AACH,MAAM,WAAW,QAAS,SAAQ,UAAU;IAC1C,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,YAAY,CAAC,CAAC;IAC5C,QAAQ,CAAC,IAAI,EAAE,CAAC,UAAU,EAAE,cAAc,EAAE,OAAO,EAAE,iBAAiB,KAAK,OAAO,CAAC,WAAW,CAAC,CAAC;IAChG,QAAQ,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,EAAE,GAAG,EAAE,UAAU,KAAK,kBAAkB,CAAC;CAClG;AAaD;;;;GAIG;AACH,MAAM,MAAM,WAAW,GAAG;IAAE,GAAG,EAAE,YAAY,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,eAAe,CAAA;CAAE,CAAC;AAEpF,uCAAuC;AACvC,eAAO,MAAM,kBAAkB,EAAE,WAA2E,CAAC;AAE7G,iEAAiE;AACjE,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,WAAW,CAErD;AAED,sFAAsF;AACtF,wBAAgB,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,GAAG,MAAM,CAWvE;AAYD;;;GAGG;AACH,wBAAsB,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,GAAG,OAAO,CAAC,SAAS,CAAC,CA2ExG"}

package/dist/identity.d.ts

@@ -83,6 +83,38 @@ export declare function isGitWorkTree(targetRepoRoot: string): boolean;
 export declare function gitIsInstalled(): boolean;
 /** Read the `origin` remote URL. */
 export declare function readRemote(targetRepoRoot: string): string | null;
+/**
+ * Remove a password or token from a git remote, leaving the host and path
+ * (#1744: `project.json` is committed, so a remote embedding one — a common
+ * setup, our own clones have one — put it into the client's repository history
+ * and onto GitHub with the next push). `null` passes through unchanged.
+ *
+ * Both forms git itself accepts are covered, and they are NOT treated alike,
+ * because a bare user name means two different things in them:
+ *
+ *   - A URL (`scheme://[user[:pass]@]host[:port]/path` — this also covers
+ *     `ssh://`) is handed to the platform's own `URL` parser, which strips
+ *     BOTH username and password whenever either is present. A bare username
+ *     with no password is included on purpose: GitHub and most hosts accept a
+ *     personal access token AS the username on an `https://` remote (`https://
+ *     <token>@host/...`), which is exactly the shape that needs catching with
+ *     no password field to key off. **When `URL` refuses to parse the string
+ *     at all** (review R-34, F2 — a non-numeric port is a real remote `git`
+ *     accepts and `URL` does not), the userinfo is stripped TEXTUALLY instead
+ *     of leaving the input, credential and all, untouched.
+ *   - The scp-like syntax git also accepts, with no scheme
+ *     (`[user[:pass]@]host:path`, e.g. `git@github.com:org/repo.git`), has no
+ *     parser to borrow, so it is read directly. There a bare username is not a
+ *     secret — SSH carries no password in the URL at all, and `git@host:path`
+ *     (or any fixed service account name) is the ordinary, universal shape of
+ *     an SSH git remote, not a credential. So only a PASSWORD inside the
+ *     userinfo (`user:pass@host:path`) is stripped here; a bare `user@` is
+ *     left alone, or every ordinary SSH remote would be rewritten for nothing
+ *     it is hiding. Split on the LAST `@` before the host (review R-34, F3): a
+ *     password containing `@` (`user:p@ss@host:path`) made the first `@` leave
+ *     a password FRAGMENT (`ss@host:path`) in the stored value.
+ */
+export declare function redactRemoteCredential(remote: string | null): string | null;
 /**
  * How many commits are reachable from HEAD, or `null` when this is not a git repository
  * (or is one with no commits yet).
@@ -139,21 +171,58 @@ export declare function readIgnoredPaths(targetRepoRoot: string, paths: readonly
  * on both the mint and the read path, so an install from before this field
  * existed picks up the disambiguation text on its next install rather than
  * staying silent forever.
+ *
+ * `remote` gets a second exception (#1744, decided G1): a file written before this
+ * fix existed may hold a remote with a credential in it. `repairRemoteCredential`
+ * below is called first, so by the time this function does its own read the file
+ * is already clean on disk when that write could land; `redactRemoteCredential`
+ * is then applied to the in-memory value too, so what this function RETURNS is
+ * clean even on a folder the repair could not write to.
  */
 export declare function mintOrReadIdentity(targetRepoRoot: string): {
     identity: ProjectIdentity;
     minted: boolean;
 };
 /**
- * The ONE serializer for `project.json`, called from exactly one place:
- * `createProjectIdentityFile` below, to produce the bytes for a freshly minted
- * identity. `install()`'s `writeProjectIdentity` no longer calls this function
- * itself — until the onboarding fix wave (T-05, from review R-03) it did, to
- * reconcile an existing file's bytes against what it would have written and
- * rewrite one that differed. That reconciliation is retired: `writeProjectIdentity`
- * now only calls `createProjectIdentityFile`, which skips a file that is already
- * there, whatever its bytes (`project-identity-reuse` AC1). A file the pre-write
- * created is therefore read back as `skipped`, never compared or rewritten.
+ * If `.halfcycle/project.json` exists and its `remote` still carries a credential,
+ * rewrite the file with it stripped — ONCE; a file whose remote is already clean
+ * is never touched. This is the G1 repair (#1744), and it is the ONE exception to
+ * "an existing `project.json` is never rewritten" (`createProjectIdentityFile`,
+ * the `note` field on `mintOrReadIdentity` above): every other path in this
+ * module leaves a present file alone, whatever its bytes.
+ *
+ * **CALLED FROM EVERY REAL PATH THAT TOUCHES AN EXISTING `project.json`, NOT
+ * ONLY FROM `mintOrReadIdentity` (review R-34, F1).** The first version of this
+ * fix lived entirely inside `mintOrReadIdentity`, which no production code
+ * calls — `install.ts`'s `writeProjectIdentity` and `pre-create-checks.ts`'s
+ * `claimFolderId` both skip a `project.json` that is already there and neither
+ * read it back, so a real `npx halfcycle` run left the credential in place.
+ * Those two call this function directly; `mintOrReadIdentity` calls it too, for
+ * every OTHER caller that reads the committed identity.
+ *
+ * Silently best-effort throughout: an unreadable file, one that is not valid
+ * JSON, or one that parses to something other than an object (`null`, an array,
+ * a bare string or number — `project-identity-reuse` AC2's "not an object" case,
+ * which this function must leave exactly as it was, same as its sibling
+ * refusal), or a folder this process cannot write to, is left exactly as it is
+ * for the next run to try again — a repair is not what the person asked this
+ * run to do, and must never be what makes it fail, let alone throw. Written to
+ * a temporary file beside the target first and renamed over it, so a reader
+ * never sees a half-written file.
+ */
+export declare function repairRemoteCredential(targetRepoRoot: string): void;
+/**
+ * The ONE serializer for `project.json`. `createProjectIdentityFile` below calls
+ * it to produce the bytes for a freshly minted identity; `repairRemoteCredential`
+ * above calls it for the one other case this module ever writes an identity's
+ * bytes, the G1 credential repair (#1744). `install()`'s `writeProjectIdentity`
+ * no longer reconciles bytes itself — until the onboarding fix wave (T-05, from
+ * review R-03) it did, rewriting any file that differed from what it would have
+ * written (an older file without `note`, CRLF, an extra field). That
+ * reconciliation is retired: an existing file is skipped, whatever its bytes
+ * (`project-identity-reuse` AC1), with exactly one exception now — a credential
+ * in `remote`, which `writeProjectIdentity` repairs through the function below
+ * before reporting `skipped`.
  */
 export declare function serializeProjectIdentity(identity: ProjectIdentity): string;
 /**

package/dist/identity.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../src/identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAOH;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,eAAO,MAAM,qBAAqB,QAGF,CAAC;AAEjC,uFAAuF;AACvF,eAAO,MAAM,oBAAoB,4BAA4B,CAAC;AAE9D,kFAAkF;AAClF,MAAM,WAAW,eAAe;IAC9B,2EAA2E;IAC3E,SAAS,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,gEAAgE;IAChE,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB;;;;;;OAMG;IACH,IAAI,EAAE,MAAM,CAAC;CACd;AA6BD,gFAAgF;AAChF,wBAAgB,kBAAkB,IAAI,MAAM,CAAC,UAAU,CAItD;AAqBD,sFAAsF;AACtF,wBAAgB,cAAc,CAAC,cAAc,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAMpE;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAE7D;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,IAAI,OAAO,CAOxC;AAED,oCAAoC;AACpC,wBAAgB,UAAU,CAAC,cAAc,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAEhE;AAED;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,cAAc,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAKrE;AAED,2DAA2D;AAC3D,MAAM,WAAW,WAAW;IAC1B,oFAAoF;IACpF,IAAI,EAAE,MAAM,CAAC;IACb,0DAA0D;IAC1D,OAAO,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,MAAM,EAAE,MAAM,CAAC;IACf,6CAA6C;IAC7C,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,gBAAgB,CAAC,cAAc,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,WAAW,EAAE,GAAG,IAAI,CAyBvG;AAED;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAAC,cAAc,EAAE,MAAM,GAAG;IAAE,QAAQ,EAAE,eAAe,CAAC;IAAC,MAAM,EAAE,OAAO,CAAA;CAAE,CAazG;AAYD;;;;;;;;;;GAUG;AACH,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,eAAe,GAAG,MAAM,CAE1E;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,yBAAyB,CAAC,cAAc,EAAE,MAAM,GAAG,IAAI,CAiBtE"}
+{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../src/identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAeH;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,eAAO,MAAM,qBAAqB,QAGF,CAAC;AAEjC,uFAAuF;AACvF,eAAO,MAAM,oBAAoB,4BAA4B,CAAC;AAE9D,kFAAkF;AAClF,MAAM,WAAW,eAAe;IAC9B,2EAA2E;IAC3E,SAAS,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,gEAAgE;IAChE,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB;;;;;;OAMG;IACH,IAAI,EAAE,MAAM,CAAC;CACd;AA6BD,gFAAgF;AAChF,wBAAgB,kBAAkB,IAAI,MAAM,CAAC,UAAU,CAItD;AAqBD,sFAAsF;AACtF,wBAAgB,cAAc,CAAC,cAAc,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAMpE;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAE7D;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,IAAI,OAAO,CAOxC;AAED,oCAAoC;AACpC,wBAAgB,UAAU,CAAC,cAAc,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAEhE;AA0BD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,GAAG,IAAI,CAmB3E;AAED;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,cAAc,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAKrE;AAED,2DAA2D;AAC3D,MAAM,WAAW,WAAW;IAC1B,oFAAoF;IACpF,IAAI,EAAE,MAAM,CAAC;IACb,0DAA0D;IAC1D,OAAO,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,MAAM,EAAE,MAAM,CAAC;IACf,6CAA6C;IAC7C,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,gBAAgB,CAAC,cAAc,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,WAAW,EAAE,GAAG,IAAI,CAyBvG;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,kBAAkB,CAAC,cAAc,EAAE,MAAM,GAAG;IAAE,QAAQ,EAAE,eAAe,CAAC;IAAC,MAAM,EAAE,OAAO,CAAA;CAAE,CAczG;AAYD;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAgB,sBAAsB,CAAC,cAAc,EAAE,MAAM,GAAG,IAAI,CA4BnE;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,eAAe,GAAG,MAAM,CAE1E;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,yBAAyB,CAAC,cAAc,EAAE,MAAM,GAAG,IAAI,CAiBtE"}