@hraness/peopleblade 0.1.0 → 0.1.2

package/README.md

@@ -10,10 +10,12 @@ and sync are optional.
 - macOS or Linux for the currently tested local workflows
 - Provider-specific setup only for live sources you choose to import
 
+Installation includes the pinned runtime dependencies Zod 4.4.3 and Effect 3.22.1.
+
 ## Install
 
 ```bash
-bun add --global @hraness/peopleblade@0.1.0
+bun add --global @hraness/peopleblade@0.1.2
 peopleblade --version
 peopleblade init
 peopleblade stats --json
@@ -41,13 +43,27 @@ The package does not install Wrench, browser automation, KB, native model runtim
 or provider credentials. Beeper, Google, and WhatsApp live sync commands delegate
 through a separately reviewed `wrench` executable on `PATH` (or the absolute
 `PEOPLEBLADE_WRENCH_EXECUTABLE` path). PeopleBlade bundles only the pinned Wrench
-0.15.0 client validators needed to fence requests and receipts; it does not bundle
+0.16.8 client validators needed to fence requests and receipts; it does not bundle
 or silently download Wrench's execution runtime.
 
-Existing reviewed Wrench 0.15.0 environments remain supported. A fresh public
-Wrench setup is intentionally not prescribed here until Wrench publishes a narrow,
-immutable runtime graph. Archive imports, Apple Contacts, iMessage, notes, identity
-review, backups, and optional PeopleBlade cloud commands do not require Wrench.
+PeopleBlade 0.1.2 contains the reviewed Wrench-backed Beeper, Google, and WhatsApp
+live sync commands. Running them requires the separately installed public
+`@hraness/wrench` 0.16.8 package. Beeper support is bounded to account-aware
+`contacts.list@3` reads, `contacts.search@1`, `messaging.search@2`, and the separate
+body-free interaction exporter. `contacts.search@1` executes the official Beeper
+CLI 0.6.2 executable pinned by Wrench; `contacts.list@3` and `messaging.search@2`
+use Wrench's bounded Desktop-loopback read paths. The exporter is macOS arm64 only
+and reports lower-bound interaction counts from complete one-to-one conversations
+only. See
+[peopleblade.com/sources](https://peopleblade.com/sources) for the complete provider
+guide. A database previously synced by PeopleBlade 0.1.1 through Wrench 0.16.7
+must run `peopleblade beeper rebind --auth beeper-main --confirm --json` once after
+installing Wrench 0.16.8. The command appends reviewed metadata for the same source
+identity only after both complete account inventories match. Do not force-bind
+Wrench unless its authenticated Desktop target changed. PeopleBlade calls no
+Beeper interface directly and exposes none of Wrench's Beeper send or action
+operations. Archive imports, Apple Contacts, iMessage, notes, identity review,
+backups, and optional PeopleBlade cloud commands do not require Wrench.
 
 ## Privacy boundary
 

package/THIRD_PARTY_NOTICES.md

@@ -1,9 +1,9 @@
 # Third-party notices
 
 The PeopleBlade CLI bundle includes reviewed client-boundary code from
-`@hraness/wrench` 0.15.0 (commit
-`41b16fcbf9ed0e8d8a332aa380b7187642aac2e3`) and message-bundle contract code
-from `@hraness/message-like-me` 0.4.0. Those portions are provided under the
+`@hraness/wrench` 0.16.8 (commit
+`b0cf2ecbc1113fcc8ef673a824be475c3d7bbb46`) and message-bundle contract code
+from `@hraness/message-like-me` 0.7.0. Those portions are provided under the
 following license. The PeopleBlade CLI package has its own MIT grant in
 `LICENSE`; this notice preserves the attribution for the bundled portions.
 

package/dist/cli.ts

@@ -3,6 +3,7 @@
 import { accessSync, constants, realpathSync } from "node:fs";
 import { isAbsolute, resolve } from "node:path";
 
+const reviewedWrenchVersion = "0.16.8";
 const configured = process.env.PEOPLEBLADE_WRENCH_EXECUTABLE;
 const executable = configured === undefined
   ? Bun.which("wrench")
@@ -32,6 +33,36 @@ if (process.argv[1] !== undefined && canonicalExecutable === realpathSync(proces
   process.exit(127);
 }
 
+let versionProbe: ReturnType<typeof Bun.spawnSync> | null = null;
+try {
+  versionProbe = Bun.spawnSync([canonicalExecutable, "--version"], {
+    cwd: process.cwd(),
+    env: process.env,
+    stdin: "ignore",
+    stdout: "pipe",
+    stderr: "pipe",
+    timeout: 5_000,
+    killSignal: "SIGKILL",
+    maxBuffer: 1_024,
+  });
+} catch {
+  // Collapse process, timeout, and output-limit failures into one public error.
+}
+if (
+  versionProbe === null
+  || versionProbe.exitCode !== 0
+  || versionProbe.signalCode !== undefined
+  || versionProbe.exitedDueToTimeout === true
+  || versionProbe.exitedDueToMaxBuffer === true
+  || versionProbe.stdout?.toString() !== `${reviewedWrenchVersion}\n`
+  || versionProbe.stderr?.byteLength !== 0
+) {
+  console.error(
+    `PeopleBlade Wrench-backed sources require the exact reviewed Wrench ${reviewedWrenchVersion} executable.`,
+  );
+  process.exit(126);
+}
+
 const child = Bun.spawn([canonicalExecutable, ...process.argv.slice(2)], {
   cwd: process.cwd(),
   env: process.env,