@ornexus/neocortex 4.60.71 → 4.60.73

package/packages/client/dist/tier/tier-aware-client.js

@@ -1 +1,405 @@
-import{GENERATED_CLIENT_COMMANDS as p}from"../generated/command-registry.generated.js";const o="neocortex:tier",b="neocortex:quota:",d=300*1e3,m=3600*1e3,l=new Set(["free","pro","enterprise"]),s="free",g={status:"free","create-epic":"free","idea-diagnose":"free","idea-research":"free","generate-epic":"free",exec:"pro",yolo:"pro",epic:"pro","setup-branch":"free",diagnose:"free",research:"free","write-spec":"free","create-tasks":"free",implement:"free","update-memory":"free",commit:"free",sync:"free","create-pr":"free",review:"pro",merge:"free","fix-blocked":"free","finalize-epic":"free",cleanup:"free","resolve-conflicts":"free",audit:"free",menu:"free",plans:"free",billing:"free",subscribe:"free","arch-plan":"free","arch-prd":"free","arch-architecture":"free","arch-api-contracts":"free","arch-api-integrations":"free","arch-database":"free","arch-security":"free","arch-design-system":"free","arch-ux-design":"free","arch-review":"free","arch-fitness-functions":"pro","arch-performance":"pro","arch-testing":"pro","arch-infrastructure":"pro",refactor:"pro","tech-debt":"free","tech-debt-scan":"pro","qa-scan":"pro","mutation-test":"pro",yoloop:"pro","migrate-state":"free","policy-audit":"pro","sync-openapi":"free","generate-pacts":"pro","verify-pacts":"free","property-test":"pro","chaos-plan":"pro","ui-ux-review":"pro","solyd-system":"enterprise",goal:"enterprise","goal-tick":"enterprise",loop:"enterprise","loop-tick":"enterprise",jobs:"enterprise",runner:"enterprise"},y=Object.freeze(Object.fromEntries(p.map(r=>[r.id,r.policy.minimumTier]))),T=[{id:"status",number:1,aliases:["st"]},{id:"arch-plan",number:3,aliases:["arquitetura","architecture","arch"]},{id:"arch-prd",number:4,aliases:["prd","product-requirements"]},{id:"arch-architecture",number:5,aliases:["arch-doc","tech-architecture"]},{id:"arch-api-contracts",number:6,aliases:["api-contracts","api-contract"]},{id:"arch-api-integrations",number:7,aliases:["api-integrations","api-int"]},{id:"arch-database",number:8,aliases:["database-schema","db-schema","db"]},{id:"arch-security",number:9,aliases:["cyber-security","security","sec"]},{id:"arch-design-system",number:10,aliases:["design-system","ds","atomic-design"]},{id:"arch-ux-design",number:11,aliases:["ux-design","ux","wireframes","wireframe","user-flows"]},{id:"arch-performance",number:12,aliases:["performance","perf","capacity-planning","capacity","arch-perf","performance-strategy"]},{id:"arch-testing",number:13,aliases:["testing-strategy","test-plan","test-strategy","arch-test"]},{id:"arch-infrastructure",number:14,aliases:["infrastructure","infra","deploy-plan","deployment","arch-infra","arch-deploy"]},{id:"arch-review",number:15,aliases:["review-consolidation","consolidation","architecture-review","arch-consolidation"]},{id:"arch-fitness-functions",number:16,aliases:["fitness","fitness-functions","archfit","arch-fit","fit-funcs"]},{id:"create-epic",number:17,aliases:["criar-epic","planejamento"]},{id:"idea-diagnose",number:18,aliases:["idea-diag"]},{id:"idea-research",number:19,aliases:["idea-pesq"]},{id:"generate-epic",number:20,aliases:["gerar-epic"]},{id:"exec",number:21,aliases:["executar","pipeline"]},{id:"yolo",number:22,aliases:[]},{id:"epic",number:23,aliases:["parallel-epic"]},{id:"setup-branch",number:24,aliases:["setup","branch"]},{id:"diagnose",number:25,aliases:["diag","diagnostico","c02"]},{id:"research",number:26,aliases:["pesquisar","pesq","research-fix","c03"]},{id:"write-spec",number:27,aliases:["spec","especificacao","c04"]},{id:"create-tasks",number:28,aliases:["tasks","tarefas","c05"]},{id:"implement",number:29,aliases:["impl","implementar","c06"]},{id:"commit",number:30,aliases:["push","commit-push","commit_push","cp","c07"]},{id:"sync",number:31,aliases:["sincronizar","c08"]},{id:"create-pr",number:32,aliases:["pr","c09"]},{id:"review",number:33,aliases:["revisar","c11"]},{id:"merge",number:34,aliases:["mesclar","c12"]},{id:"fix-blocked",number:35,aliases:["fix","corrigir"]},{id:"finalize-epic",number:36,aliases:["finalizar"]},{id:"resolve-conflicts",number:37,aliases:["conflitos"]},{id:"update-memory",number:38,aliases:["memoria"]},{id:"refactor",number:39,aliases:["refactoring","refact","refac","rf","cleanup-code","code-cleanup","code-quality","improve-code","modernize","modernization","legacy","legacy-code","debt-pay","pay-debt","debt-reduction","smell-fix","fix-smells","code-smells","strangler","strangler-fig"]},{id:"cleanup",number:40,aliases:["limpar","limpeza"]},{id:"audit",number:41,aliases:["auditar","auditoria"]},{id:"tech-debt",number:42,aliases:["debt","debts","debt-list","tech-debts","td"]},{id:"menu",number:43,aliases:["help","ajuda","?","commands","cmds"]},{id:"plans",number:44,aliases:["planos","pricing"]},{id:"billing",number:45,aliases:["bill","subscription","sub"]},{id:"subscribe",number:46,aliases:["upgrade","checkout"]},{id:"qa-scan",number:47,aliases:["qa","qa-test","visual-qa","e2e-scan","troubleshoot","debug-ui","scan","a11y","accessibility","wcag"]},{id:"yoloop",number:48,aliases:["auto-yolo","epic-runner","story-runner","loop-yolo","auto-epic"]},{id:"migrate-state",number:49,aliases:["migrate","state-migrate","schema-migrate"]},{id:"policy-audit",number:50,aliases:["policy","audit-policy","policy-history","policies"]},{id:"mutation-test",number:51,aliases:["mutation","stryker","kill-mutants"]},{id:"sync-openapi",number:52,aliases:["openapi-sync","api-sync","spec-sync","regen-openapi"]},{id:"generate-pacts",number:53,aliases:["pacts","gen-pacts","regen-pacts","create-pacts"]},{id:"verify-pacts",number:54,aliases:["verify-pact","pact-verify","check-pacts","pact-check"]},{id:"property-test",number:55,aliases:["property","pbt","proptest","property-tests","invariant-test"]},{id:"chaos-plan",number:56,aliases:["chaos","gameday","resilience-test"]},{id:"ui-ux-review",number:57,aliases:["ux-review","design-review","visual-review","product-polish"]},{id:"solyd-system",number:58,aliases:["security-system","authorized-security","sec-system"]},{id:"goal",number:59,aliases:["goals","durable-goal","continuity-goal"]},{id:"loop",number:60,aliases:["loops","durable-loop","continuity-loop"]},{id:"jobs",number:61,aliases:["job","continuity-jobs"]},{id:"runner",number:62,aliases:["neocortex-runner","continuity-runner"]}],u=Object.freeze(p.map(r=>Object.freeze({id:r.id,number:r.number,aliases:r.aliases}))),w=new Map(u.map(r=>[r.id,r])),C=new Map(u.map(r=>[r.number,r])),v=new Map(u.flatMap(r=>r.aliases.map(a=>[h(a),r.id])));function h(r){if(/[^\x20-\x7e]/.test(r))return"";const a=r.replace(/^[\t\n\r ]+|[\t\n\r ]+$/g,"");if(!a||a.startsWith("**"))return"";const e=(a.startsWith("*")?a.slice(1):a).replace(/[A-Z]/g,i=>i.toLowerCase());return/^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$/.test(e)||e==="?"?e:""}function _(r){const a=r.trim();if(/^@?epic-[a-z0-9][a-z0-9._-]*$/i.test(a))return"epic";const e=a.split(/\s+/,1)[0]??"",i=e.trim().replace(/^\*/,"");if(/^\d+$/.test(i))return C.get(Number.parseInt(i,10))?.id??null;const t=h(e);return t?t==="goal-tick"?"goal":t==="loop-tick"?"loop":w.has(t)?t:v.get(t)??null:null}const f={free:0,pro:1,enterprise:2};class R{cache;licenseClient;cachedTier=null;constructor(a){this.cache=a.cacheProvider,this.licenseClient=a.licenseClient}async getCachedTier(){try{if(this.cachedTier)return this.cachedTier;const a=await this.cache.get(o);if(a&&l.has(a))return this.cachedTier=a,this.cachedTier;const e=await this.licenseClient.getToken();if(e){const i=this.extractTierFromJwt(e);return this.cachedTier=i,await this.cache.set(o,i,m).catch(()=>{}),i}return s}catch{return s}}async updateTier(a){try{if(!l.has(a))return;this.cachedTier=a,await this.cache.set(o,a,m).catch(()=>{})}catch{}}async invalidateTierCache(){try{this.cachedTier=null,await this.cache.clear().catch(()=>{})}catch{}}async preFlightCheck(a,e){try{const i=e??await this.getCachedTier(),t=_(a)??a,n=y[t]??"free";return f[i]>=f[n]?{allowed:!0}:{allowed:!1,message:this.buildUpgradeMessage(t,i,n)}}catch{return{allowed:!0}}}async updateQuotaFromResponse(a){try{const e=a.quotaRemaining;if(!e)return;const i={stepsRemaining:e.stepsRemaining??0,invocationsRemaining:e.invocationsRemaining??0,stepsLimit:e.stepsLimit??0,invocationsLimit:e.invocationsLimit??0,cachedAt:Date.now()},t=this.getQuotaCacheKey();await this.cache.set(t,JSON.stringify(i),d).catch(()=>{})}catch{}}async getCachedQuota(){try{const a=this.getQuotaCacheKey(),e=await this.cache.get(a);if(!e)return null;const i=JSON.parse(e);return Date.now()-i.cachedAt>d?null:i}catch{return null}}async offlineQuotaCheck(a=!1){try{if(!a)return{allowed:!0};const e=await this.getCachedQuota();return e?e.stepsRemaining<=0&&e.stepsLimit>0?{allowed:!1,message:`Daily step limit reached (${e.stepsLimit}/${e.stepsLimit}). Resets at 00:00 UTC.`}:e.invocationsRemaining<=0&&e.invocationsLimit>0?{allowed:!1,message:`Daily invocation limit reached (${e.invocationsLimit}/${e.invocationsLimit}). Resets at 00:00 UTC.`}:{allowed:!0}:{allowed:!0}}catch{return{allowed:!0}}}extractTierFromJwt(a){try{const e=a.split(".");if(e.length!==3)return s;const i=e[1],t=Buffer.from(i,"base64url").toString("utf8"),c=JSON.parse(t).tier;return c&&l.has(c)?c:s}catch{return s}}buildUpgradeMessage(a,e,i){return`The *${a} command requires ${i.toUpperCase()} plan. Your current plan: ${e.toUpperCase()}. Upgrade: https://neocortex.sh/portal/dashboard/plans`}getQuotaCacheKey(){const e=new Date().toISOString().slice(0,10);return`${b}${e}`}}export{u as CLIENT_PREFLIGHT_COMMAND_REGISTRY,R as TierAwareClient,h as normalizeCommandToken,_ as resolveClientPreFlightTrigger};
+/**
+ * @license FSL-1.1
+ * Copyright (c) 2026 OrNexus AI
+ *
+ * This file is part of Neocortex CLI, licensed under the
+ * Functional Source License, Version 1.1 (FSL-1.1).
+ *
+ * Change Date: February 20, 2029
+ * Change License: MIT
+ *
+ * See the LICENSE file in the project root for full license text.
+ */
+import { GENERATED_CLIENT_COMMANDS } from '../generated/command-registry.generated.js';
+// ── Constants ────────────────────────────────────────────────────────────
+const TIER_CACHE_KEY = 'neocortex:tier';
+const QUOTA_CACHE_KEY_PREFIX = 'neocortex:quota:';
+const QUOTA_TTL_MS = 5 * 60 * 1000; // 5 minutes
+const TIER_CACHE_TTL_MS = 60 * 60 * 1000; // 1 hour (Story 31.05: reduced from 24h to align with short-lived JWTs)
+const VALID_TIERS = new Set(['free', 'pro', 'enterprise']);
+const DEFAULT_TIER = 'free';
+// ── Trigger Gates (inlined from shared tier-config to avoid import issues) ─
+const LEGACY_TRIGGER_GATES = {
+    'status': 'free',
+    'create-epic': 'free',
+    'idea-diagnose': 'free',
+    'idea-research': 'free',
+    'generate-epic': 'free',
+    'exec': 'pro',
+    'yolo': 'pro',
+    'epic': 'pro',
+    'setup-branch': 'free',
+    'diagnose': 'free',
+    'research': 'free',
+    'write-spec': 'free',
+    'create-tasks': 'free',
+    'implement': 'free',
+    'update-memory': 'free',
+    'commit': 'free',
+    'sync': 'free',
+    'create-pr': 'free',
+    'review': 'pro',
+    'merge': 'free',
+    'fix-blocked': 'free',
+    'finalize-epic': 'free',
+    'cleanup': 'free',
+    'resolve-conflicts': 'free',
+    'audit': 'free',
+    'menu': 'free',
+    'plans': 'free',
+    'billing': 'free',
+    'subscribe': 'free',
+    'arch-plan': 'free',
+    'arch-prd': 'free',
+    'arch-architecture': 'free',
+    'arch-api-contracts': 'free',
+    'arch-api-integrations': 'free',
+    'arch-database': 'free',
+    'arch-security': 'free',
+    'arch-design-system': 'free',
+    'arch-ux-design': 'free',
+    'arch-review': 'free',
+    'arch-fitness-functions': 'pro',
+    'arch-performance': 'pro',
+    'arch-testing': 'pro',
+    'arch-infrastructure': 'pro',
+    'refactor': 'pro',
+    'tech-debt': 'free',
+    'tech-debt-scan': 'pro',
+    'qa-scan': 'pro',
+    'mutation-test': 'pro',
+    'yoloop': 'pro',
+    'migrate-state': 'free',
+    'policy-audit': 'pro',
+    'sync-openapi': 'free',
+    'generate-pacts': 'pro',
+    'verify-pacts': 'free',
+    'property-test': 'pro',
+    'chaos-plan': 'pro',
+    'ui-ux-review': 'pro',
+    'solyd-system': 'enterprise',
+    'goal': 'enterprise',
+    'goal-tick': 'enterprise',
+    'loop': 'enterprise',
+    'loop-tick': 'enterprise',
+    'jobs': 'enterprise',
+    'runner': 'enterprise',
+};
+const TRIGGER_GATES = Object.freeze(Object.fromEntries(GENERATED_CLIENT_COMMANDS.map((entry) => [entry.id, entry.policy.minimumTier])));
+void LEGACY_TRIGGER_GATES;
+// P126.07: runtime mirror of shared COMMAND_REGISTRY command identity only.
+// Keep this small to avoid a runtime @neocortex/shared dependency in the
+// standalone client package; flexible-preflight.test.ts validates drift.
+const LEGACY_CLIENT_PREFLIGHT_COMMAND_REGISTRY = [
+    { id: 'status', number: 1, aliases: ['st'] },
+    { id: 'arch-plan', number: 3, aliases: ['arquitetura', 'architecture', 'arch'] },
+    { id: 'arch-prd', number: 4, aliases: ['prd', 'product-requirements'] },
+    { id: 'arch-architecture', number: 5, aliases: ['arch-doc', 'tech-architecture'] },
+    { id: 'arch-api-contracts', number: 6, aliases: ['api-contracts', 'api-contract'] },
+    { id: 'arch-api-integrations', number: 7, aliases: ['api-integrations', 'api-int'] },
+    { id: 'arch-database', number: 8, aliases: ['database-schema', 'db-schema', 'db'] },
+    { id: 'arch-security', number: 9, aliases: ['cyber-security', 'security', 'sec'] },
+    { id: 'arch-design-system', number: 10, aliases: ['design-system', 'ds', 'atomic-design'] },
+    { id: 'arch-ux-design', number: 11, aliases: ['ux-design', 'ux', 'wireframes', 'wireframe', 'user-flows'] },
+    { id: 'arch-performance', number: 12, aliases: ['performance', 'perf', 'capacity-planning', 'capacity', 'arch-perf', 'performance-strategy'] },
+    { id: 'arch-testing', number: 13, aliases: ['testing-strategy', 'test-plan', 'test-strategy', 'arch-test'] },
+    { id: 'arch-infrastructure', number: 14, aliases: ['infrastructure', 'infra', 'deploy-plan', 'deployment', 'arch-infra', 'arch-deploy'] },
+    { id: 'arch-review', number: 15, aliases: ['review-consolidation', 'consolidation', 'architecture-review', 'arch-consolidation'] },
+    { id: 'arch-fitness-functions', number: 16, aliases: ['fitness', 'fitness-functions', 'archfit', 'arch-fit', 'fit-funcs'] },
+    { id: 'create-epic', number: 17, aliases: ['criar-epic', 'planejamento'] },
+    { id: 'idea-diagnose', number: 18, aliases: ['idea-diag'] },
+    { id: 'idea-research', number: 19, aliases: ['idea-pesq'] },
+    { id: 'generate-epic', number: 20, aliases: ['gerar-epic'] },
+    { id: 'exec', number: 21, aliases: ['executar', 'pipeline'] },
+    { id: 'yolo', number: 22, aliases: [] },
+    { id: 'epic', number: 23, aliases: ['parallel-epic'] },
+    { id: 'setup-branch', number: 24, aliases: ['setup', 'branch'] },
+    { id: 'diagnose', number: 25, aliases: ['diag', 'diagnostico', 'c02'] },
+    { id: 'research', number: 26, aliases: ['pesquisar', 'pesq', 'research-fix', 'c03'] },
+    { id: 'write-spec', number: 27, aliases: ['spec', 'especificacao', 'c04'] },
+    { id: 'create-tasks', number: 28, aliases: ['tasks', 'tarefas', 'c05'] },
+    { id: 'implement', number: 29, aliases: ['impl', 'implementar', 'c06'] },
+    { id: 'commit', number: 30, aliases: ['push', 'commit-push', 'commit_push', 'cp', 'c07'] },
+    { id: 'sync', number: 31, aliases: ['sincronizar', 'c08'] },
+    { id: 'create-pr', number: 32, aliases: ['pr', 'c09'] },
+    { id: 'review', number: 33, aliases: ['revisar', 'c11'] },
+    { id: 'merge', number: 34, aliases: ['mesclar', 'c12'] },
+    { id: 'fix-blocked', number: 35, aliases: ['fix', 'corrigir'] },
+    { id: 'finalize-epic', number: 36, aliases: ['finalizar'] },
+    { id: 'resolve-conflicts', number: 37, aliases: ['conflitos'] },
+    { id: 'update-memory', number: 38, aliases: ['memoria'] },
+    { id: 'refactor', number: 39, aliases: ['refactoring', 'refact', 'refac', 'rf', 'cleanup-code', 'code-cleanup', 'code-quality', 'improve-code', 'modernize', 'modernization', 'legacy', 'legacy-code', 'debt-pay', 'pay-debt', 'debt-reduction', 'smell-fix', 'fix-smells', 'code-smells', 'strangler', 'strangler-fig'] },
+    { id: 'cleanup', number: 40, aliases: ['limpar', 'limpeza'] },
+    { id: 'audit', number: 41, aliases: ['auditar', 'auditoria'] },
+    { id: 'tech-debt', number: 42, aliases: ['debt', 'debts', 'debt-list', 'tech-debts', 'td'] },
+    { id: 'menu', number: 43, aliases: ['help', 'ajuda', '?', 'commands', 'cmds'] },
+    { id: 'plans', number: 44, aliases: ['planos', 'pricing'] },
+    { id: 'billing', number: 45, aliases: ['bill', 'subscription', 'sub'] },
+    { id: 'subscribe', number: 46, aliases: ['upgrade', 'checkout'] },
+    { id: 'qa-scan', number: 47, aliases: ['qa', 'qa-test', 'visual-qa', 'e2e-scan', 'troubleshoot', 'debug-ui', 'scan', 'a11y', 'accessibility', 'wcag'] },
+    { id: 'yoloop', number: 48, aliases: ['auto-yolo', 'epic-runner', 'story-runner', 'loop-yolo', 'auto-epic'] },
+    { id: 'migrate-state', number: 49, aliases: ['migrate', 'state-migrate', 'schema-migrate'] },
+    { id: 'policy-audit', number: 50, aliases: ['policy', 'audit-policy', 'policy-history', 'policies'] },
+    { id: 'mutation-test', number: 51, aliases: ['mutation', 'stryker', 'kill-mutants'] },
+    { id: 'sync-openapi', number: 52, aliases: ['openapi-sync', 'api-sync', 'spec-sync', 'regen-openapi'] },
+    { id: 'generate-pacts', number: 53, aliases: ['pacts', 'gen-pacts', 'regen-pacts', 'create-pacts'] },
+    { id: 'verify-pacts', number: 54, aliases: ['verify-pact', 'pact-verify', 'check-pacts', 'pact-check'] },
+    { id: 'property-test', number: 55, aliases: ['property', 'pbt', 'proptest', 'property-tests', 'invariant-test'] },
+    { id: 'chaos-plan', number: 56, aliases: ['chaos', 'gameday', 'resilience-test'] },
+    { id: 'ui-ux-review', number: 57, aliases: ['ux-review', 'design-review', 'visual-review', 'product-polish'] },
+    { id: 'solyd-system', number: 58, aliases: ['security-system', 'authorized-security', 'sec-system'] },
+    { id: 'goal', number: 59, aliases: ['goals', 'durable-goal', 'continuity-goal'] },
+    { id: 'loop', number: 60, aliases: ['loops', 'durable-loop', 'continuity-loop'] },
+    { id: 'jobs', number: 61, aliases: ['job', 'continuity-jobs'] },
+    { id: 'runner', number: 62, aliases: ['neocortex-runner', 'continuity-runner'] },
+];
+export const CLIENT_PREFLIGHT_COMMAND_REGISTRY = Object.freeze(GENERATED_CLIENT_COMMANDS.map((entry) => Object.freeze({
+    id: entry.id,
+    number: entry.number,
+    aliases: entry.aliases,
+})));
+void LEGACY_CLIENT_PREFLIGHT_COMMAND_REGISTRY;
+const CLIENT_COMMAND_BY_ID = new Map(CLIENT_PREFLIGHT_COMMAND_REGISTRY.map((entry) => [entry.id, entry]));
+const CLIENT_COMMAND_BY_NUMBER = new Map(CLIENT_PREFLIGHT_COMMAND_REGISTRY.map((entry) => [entry.number, entry]));
+const CLIENT_COMMAND_ALIAS_MAP = new Map(CLIENT_PREFLIGHT_COMMAND_REGISTRY.flatMap((entry) => entry.aliases.map((alias) => [normalizeCommandToken(alias), entry.id])));
+export function normalizeCommandToken(input) {
+    if (/[^\x20-\x7e]/.test(input))
+        return '';
+    const trimmed = input.replace(/^[\t\n\r ]+|[\t\n\r ]+$/g, '');
+    if (!trimmed || trimmed.startsWith('**'))
+        return '';
+    const token = (trimmed.startsWith('*') ? trimmed.slice(1) : trimmed)
+        .replace(/[A-Z]/g, (letter) => letter.toLowerCase());
+    return /^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$/.test(token) || token === '?' ? token : '';
+}
+export function resolveClientPreFlightTrigger(input) {
+    const trimmed = input.trim();
+    if (/^@?epic-[a-z0-9][a-z0-9._-]*$/i.test(trimmed))
+        return 'epic';
+    // P179.02: local pre-flight mirrors invoke's leading-token command contract
+    // so Free/Pro users are gated before remote invocation for `58 plan` and
+    // Solyd alias-with-mode forms. Only the first public token is considered.
+    const leadingToken = trimmed.split(/\s+/, 1)[0] ?? '';
+    const numericToken = leadingToken.trim().replace(/^\*/, '');
+    if (/^\d+$/.test(numericToken)) {
+        return CLIENT_COMMAND_BY_NUMBER.get(Number.parseInt(numericToken, 10))?.id ?? null;
+    }
+    const token = normalizeCommandToken(leadingToken);
+    if (!token)
+        return null;
+    if (token === 'goal-tick')
+        return 'goal';
+    if (token === 'loop-tick')
+        return 'loop';
+    if (CLIENT_COMMAND_BY_ID.has(token))
+        return token;
+    return CLIENT_COMMAND_ALIAS_MAP.get(token) ?? null;
+}
+const TIER_HIERARCHY = {
+    free: 0,
+    pro: 1,
+    enterprise: 2,
+};
+// ── TierAwareClient ──────────────────────────────────────────────────────
+export class TierAwareClient {
+    cache;
+    licenseClient;
+    cachedTier = null;
+    constructor(options) {
+        this.cache = options.cacheProvider;
+        this.licenseClient = options.licenseClient;
+    }
+    // ── Story 60.1: Tier Extraction from JWT + Cache ────────────────────
+    /**
+     * Get the current tier. Checks in-memory, then cache, then JWT token.
+     * NEVER throws - returns 'free' on failure (fail-open).
+     */
+    async getCachedTier() {
+        try {
+            // 1. In-memory
+            if (this.cachedTier)
+                return this.cachedTier;
+            // 2. EncryptedCache
+            const cached = await this.cache.get(TIER_CACHE_KEY);
+            if (cached && VALID_TIERS.has(cached)) {
+                this.cachedTier = cached;
+                return this.cachedTier;
+            }
+            // 3. Extract from JWT
+            const token = await this.licenseClient.getToken();
+            if (token) {
+                const tier = this.extractTierFromJwt(token);
+                this.cachedTier = tier;
+                await this.cache.set(TIER_CACHE_KEY, tier, TIER_CACHE_TTL_MS).catch(() => { });
+                return tier;
+            }
+            return DEFAULT_TIER;
+        }
+        catch {
+            return DEFAULT_TIER;
+        }
+    }
+    /**
+     * Update cached tier (called when server returns tier info).
+     */
+    async updateTier(tier) {
+        try {
+            if (!VALID_TIERS.has(tier))
+                return;
+            this.cachedTier = tier;
+            await this.cache.set(TIER_CACHE_KEY, tier, TIER_CACHE_TTL_MS).catch(() => { });
+        }
+        catch {
+            // Non-critical
+        }
+    }
+    // ── Story 18.8: Tier Cache Invalidation ──────────────────────────────
+    /**
+     * Invalidate all tier and quota caches.
+     * Called when a tier change is detected to ensure fresh data.
+     * NEVER throws.
+     */
+    async invalidateTierCache() {
+        try {
+            this.cachedTier = null;
+            await this.cache.clear().catch(() => { });
+        }
+        catch {
+            // Non-critical
+        }
+    }
+    // ── Story 60.2: Pre-flight Trigger Check ────────────────────────────
+    /**
+     * Check if a trigger is allowed for the current tier WITHOUT calling the server.
+     * Returns immediately (in-memory lookup).
+     * NEVER throws - returns { allowed: true } on failure (fail-open).
+     */
+    async preFlightCheck(trigger, tier) {
+        try {
+            const userTier = tier ?? await this.getCachedTier();
+            const canonicalTrigger = resolveClientPreFlightTrigger(trigger) ?? trigger;
+            const requiredTier = TRIGGER_GATES[canonicalTrigger] ?? 'free';
+            if (TIER_HIERARCHY[userTier] >= TIER_HIERARCHY[requiredTier]) {
+                return { allowed: true };
+            }
+            const message = this.buildUpgradeMessage(canonicalTrigger, userTier, requiredTier);
+            return { allowed: false, message };
+        }
+        catch {
+            // Fail-open: allow on error
+            return { allowed: true };
+        }
+    }
+    // ── Story 60.3: Quota Cache from Response ───────────────────────────
+    /**
+     * Update cached quota from server response metadata.
+     * Called after each successful invoke.
+     */
+    async updateQuotaFromResponse(metadata) {
+        try {
+            const quotaRemaining = metadata.quotaRemaining;
+            if (!quotaRemaining)
+                return;
+            const snapshot = {
+                stepsRemaining: quotaRemaining.stepsRemaining ?? 0,
+                invocationsRemaining: quotaRemaining.invocationsRemaining ?? 0,
+                stepsLimit: quotaRemaining.stepsLimit ?? 0,
+                invocationsLimit: quotaRemaining.invocationsLimit ?? 0,
+                cachedAt: Date.now(),
+            };
+            const dateKey = this.getQuotaCacheKey();
+            await this.cache.set(dateKey, JSON.stringify(snapshot), QUOTA_TTL_MS).catch(() => { });
+        }
+        catch {
+            // Non-critical
+        }
+    }
+    /**
+     * Get cached quota for today.
+     * NEVER throws - returns null if cache empty or expired.
+     */
+    async getCachedQuota() {
+        try {
+            const dateKey = this.getQuotaCacheKey();
+            const raw = await this.cache.get(dateKey);
+            if (!raw)
+                return null;
+            const snapshot = JSON.parse(raw);
+            // Validate TTL (EncryptedCache already handles this, but double-check)
+            if (Date.now() - snapshot.cachedAt > QUOTA_TTL_MS)
+                return null;
+            return snapshot;
+        }
+        catch {
+            return null;
+        }
+    }
+    // ── Story 60.4: Offline Enforcement ─────────────────────────────────
+    /**
+     * Check quota in offline mode using cached data.
+     * NEVER throws - returns { allowed: true } on failure (fail-open).
+     *
+     * @param isOffline - Whether the circuit breaker is in L2+ degradation
+     */
+    async offlineQuotaCheck(isOffline = false) {
+        try {
+            if (!isOffline)
+                return { allowed: true };
+            const quota = await this.getCachedQuota();
+            // Fail-open: if no cached quota, allow
+            if (!quota)
+                return { allowed: true };
+            // Check steps
+            if (quota.stepsRemaining <= 0 && quota.stepsLimit > 0) {
+                return {
+                    allowed: false,
+                    message: `Daily step limit reached (${quota.stepsLimit}/${quota.stepsLimit}). Resets at 00:00 UTC.`,
+                };
+            }
+            // Check invocations
+            if (quota.invocationsRemaining <= 0 && quota.invocationsLimit > 0) {
+                return {
+                    allowed: false,
+                    message: `Daily invocation limit reached (${quota.invocationsLimit}/${quota.invocationsLimit}). Resets at 00:00 UTC.`,
+                };
+            }
+            return { allowed: true };
+        }
+        catch {
+            // Fail-open
+            return { allowed: true };
+        }
+    }
+    // ── Private Helpers ─────────────────────────────────────────────────
+    /**
+     * Extract tier from JWT payload via base64url decode.
+     * No cryptographic verification - client-side is UX only.
+     */
+    extractTierFromJwt(token) {
+        try {
+            const parts = token.split('.');
+            if (parts.length !== 3)
+                return DEFAULT_TIER;
+            // Decode base64url payload
+            const payload = parts[1];
+            const decoded = Buffer.from(payload, 'base64url').toString('utf8');
+            const claims = JSON.parse(decoded);
+            const tier = claims.tier;
+            if (tier && VALID_TIERS.has(tier)) {
+                return tier;
+            }
+            return DEFAULT_TIER;
+        }
+        catch {
+            return DEFAULT_TIER;
+        }
+    }
+    buildUpgradeMessage(trigger, currentTier, requiredTier) {
+        return `The *${trigger} command requires ${requiredTier.toUpperCase()} plan. Your current plan: ${currentTier.toUpperCase()}. Upgrade: https://neocortex.sh/portal/dashboard/plans`;
+    }
+    getQuotaCacheKey() {
+        const now = new Date();
+        const dateStr = now.toISOString().slice(0, 10); // YYYY-MM-DD UTC
+        return `${QUOTA_CACHE_KEY_PREFIX}${dateStr}`;
+    }
+}

package/packages/client/dist/types/index.js

@@ -1 +1,38 @@
-var a;(function(e){e.LOCAL="local",e.REMOTE="remote"})(a||(a={}));class c{async get(){return null}async set(){}async clear(){}}export{c as NoOpCache,a as ResolverMode};
+/**
+ * @license FSL-1.1
+ * Copyright (c) 2026 OrNexus AI
+ *
+ * This file is part of Neocortex CLI, licensed under the
+ * Functional Source License, Version 1.1 (FSL-1.1).
+ *
+ * Change Date: February 20, 2029
+ * Change License: MIT
+ *
+ * See the LICENSE file in the project root for full license text.
+ */
+/**
+ * @neocortex/client - Type Definitions
+ *
+ * All types for the asset resolution abstraction layer.
+ */
+// ── Resolver Mode ────────────────────────────────────────────────────────
+/** Mode of asset resolution */
+export var ResolverMode;
+(function (ResolverMode) {
+    /** Read assets from local filesystem (development) */
+    ResolverMode["LOCAL"] = "local";
+    /** Fetch assets from remote IP Protection Server (production) */
+    ResolverMode["REMOTE"] = "remote";
+})(ResolverMode || (ResolverMode = {}));
+/** No-op cache implementation for development/fallback */
+export class NoOpCache {
+    async get() {
+        return null;
+    }
+    async set() {
+        // No-op: cache disabled
+    }
+    async clear() {
+        // No-op: nothing to clear
+    }
+}

package/packages/client/dist/version.js

@@ -1 +1,27 @@
-import{readFileSync as i}from"node:fs";import{fileURLToPath as c}from"node:url";import{dirname as o,join as a}from"node:path";function m(n=import.meta.url){try{let t=o(c(n));for(let r=0;r<6;r+=1){try{const e=JSON.parse(i(a(t,"package.json"),"utf8"));if((e.name==="@ornexus/neocortex"||e.name==="@neocortex/client")&&typeof e.version=="string"&&/^\d+\.\d+\.\d+(?:[-+][A-Za-z0-9.-]+)?$/.test(e.version))return e.version}catch{}t=o(t)}}catch{}return"0.0.0"}const d=m();export{d as CLIENT_VERSION,m as getClientVersion};
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { dirname, join } from 'node:path';
+/** Resolve the installed package version for both source and packed runtimes. */
+export function getClientVersion(fromUrl = import.meta.url) {
+    try {
+        let directory = dirname(fileURLToPath(fromUrl));
+        for (let depth = 0; depth < 6; depth += 1) {
+            try {
+                const pkg = JSON.parse(readFileSync(join(directory, 'package.json'), 'utf8'));
+                if ((pkg.name === '@ornexus/neocortex' || pkg.name === '@neocortex/client') &&
+                    typeof pkg.version === 'string' &&
+                    /^\d+\.\d+\.\d+(?:[-+][A-Za-z0-9.-]+)?$/.test(pkg.version))
+                    return pkg.version;
+            }
+            catch {
+                // Continue toward the package root.
+            }
+            directory = dirname(directory);
+        }
+    }
+    catch {
+        // Fall through to the explicit unavailable value.
+    }
+    return '0.0.0';
+}
+export const CLIENT_VERSION = getClientVersion();

package/packages/client/dist/yolo/change-evidence-collector.js

@@ -1 +1,126 @@
-import{execFileSync as p}from"node:child_process";import{realpathSync as f}from"node:fs";import{createYoloChangeEvidence as w}from"../../../shared/dist/yolo/change-evidence.js";import{readGitLifecycleRuntimeSync as u}from"../git/git-lifecycle-store.js";async function j(e){let r;try{r=u(e.projectRoot,{required:!0}).epics[e.epicId]?.branch_lease}catch(c){if(c instanceof Error&&c.message==="git-lifecycle-runtime-missing")return;throw new Error("yolo-change-evidence-unavailable")}if(r==null)return;if(typeof r!="object"||Array.isArray(r)||r.ownerStoryId!==e.storyId||typeof r.expiresAt!="string")throw new Error("yolo-change-evidence-unavailable");const n=Date.parse(r.expiresAt);if(!Number.isFinite(n))throw new Error("yolo-change-evidence-unavailable");if(n>Date.now())return;if(typeof r.sessionId!="string"||!/^setup-[a-f0-9]{64}$/.test(r.sessionId)||r.idempotencyKey!==r.sessionId)throw new Error("yolo-change-evidence-unavailable");const{prepareDirectYoloSetup:o}=await import("../git/direct-yolo-checkpoint.js"),i=await o(e);if(!i.ok||i.value.storyId!==e.storyId||i.value.epicId!==e.epicId||Date.parse(i.value.leaseExpiresAt)<=Date.now())throw new Error("yolo-change-evidence-unavailable")}function t(e,r){try{return p("git",["-C",e,...r],{encoding:"utf8",timeout:3e3,maxBuffer:1024*1024,stdio:["ignore","pipe","ignore"]})}catch{throw new Error("yolo-change-evidence-unavailable")}}function x(e){if(!/^[A-Za-z0-9][A-Za-z0-9_./-]{0,119}$/.test(e.defaultBranch)||e.defaultBranch.includes(".."))throw new Error("yolo-change-evidence-unavailable");const r=t(e.projectRoot,["rev-parse","--show-toplevel"]).trim();if(f(r)!==f(e.projectRoot))throw new Error("yolo-change-evidence-unavailable");const n=t(e.projectRoot,["rev-parse","HEAD"]).trim();if(n!==e.expectedHeadSha)throw new Error("yolo-change-evidence-stale");let o,i=!1,c=null;if(e.storyId&&e.epicId)try{const a=u(e.projectRoot).epics[e.epicId],l=a?.branch_lease,h=t(e.projectRoot,["symbolic-ref","--quiet","--short","HEAD"]).trim();if(a?.branch_mode==="epic"&&a.execution_branch===h&&(c=h),l&&typeof l=="object"&&!Array.isArray(l)){const d=l;if(d.ownerStoryId!==e.storyId||typeof d.expiresAt!="string"||Date.parse(d.expiresAt)<=Date.now()||c===null)throw new Error("yolo-change-evidence-unavailable");i=!0}}catch{throw new Error("yolo-change-evidence-unavailable")}if(i)o=n;else{const s=c===null?"":t(e.projectRoot,["ls-remote","--heads","origin",`refs/heads/${c}`]).trim();if(s){const a=/^([a-f0-9]{40})\trefs\/heads\/([^\n]+)$/.exec(s);if(!a||a[2]!==c||t(e.projectRoot,["merge-base","HEAD",a[1]]).trim()!==a[1])throw new Error("yolo-change-evidence-unavailable");o=a[1]}else try{o=t(e.projectRoot,["merge-base","HEAD",e.defaultBranch]).trim()}catch{o=t(e.projectRoot,["merge-base","HEAD",`refs/remotes/origin/${e.defaultBranch}`]).trim()}}const y=t(e.projectRoot,["diff","--name-only","-z",o,"--"]).split("\0").filter(Boolean),m=t(e.projectRoot,["ls-files","--others","--exclude-standard","-z"]).split("\0").filter(Boolean),v=w({baseSha:o,headSha:n,changedPaths:[...y,...m]});if(t(e.projectRoot,["rev-parse","HEAD"]).trim()!==n)throw new Error("yolo-change-evidence-stale");return v}export{x as collectYoloChangeEvidence,j as reconcileYoloChangeEvidenceLease};
+import { execFileSync } from 'node:child_process';
+import { realpathSync } from 'node:fs';
+import { createYoloChangeEvidence } from '../../../shared/dist/yolo/change-evidence.js';
+import { readGitLifecycleRuntimeSync } from '../git/git-lifecycle-store.js';
+/** Reacquire only an expired setup lease for this exact story through P207's CAS boundary. */
+export async function reconcileYoloChangeEvidenceLease(options) {
+    let lease;
+    try {
+        lease = readGitLifecycleRuntimeSync(options.projectRoot, { required: true })
+            .epics[options.epicId]?.branch_lease;
+    }
+    catch (error) {
+        // C01 can legitimately precede first-use sidecar materialization. Only
+        // that exact absence falls through to the existing remote/base evidence.
+        if (error instanceof Error && error.message === 'git-lifecycle-runtime-missing')
+            return;
+        throw new Error('yolo-change-evidence-unavailable');
+    }
+    if (lease === null || lease === undefined)
+        return;
+    if (typeof lease !== 'object' || Array.isArray(lease)
+        || lease.ownerStoryId !== options.storyId
+        || typeof lease.expiresAt !== 'string') {
+        throw new Error('yolo-change-evidence-unavailable');
+    }
+    const expiry = Date.parse(lease.expiresAt);
+    if (!Number.isFinite(expiry))
+        throw new Error('yolo-change-evidence-unavailable');
+    if (expiry > Date.now())
+        return;
+    if (typeof lease.sessionId !== 'string'
+        || !/^setup-[a-f0-9]{64}$/.test(lease.sessionId)
+        || lease.idempotencyKey !== lease.sessionId) {
+        throw new Error('yolo-change-evidence-unavailable');
+    }
+    const { prepareDirectYoloSetup } = await import('../git/direct-yolo-checkpoint.js');
+    const result = await prepareDirectYoloSetup(options);
+    if (!result.ok || result.value.storyId !== options.storyId
+        || result.value.epicId !== options.epicId
+        || Date.parse(result.value.leaseExpiresAt) <= Date.now()) {
+        throw new Error('yolo-change-evidence-unavailable');
+    }
+}
+function git(root, args) {
+    try {
+        return execFileSync('git', ['-C', root, ...args], {
+            encoding: 'utf8', timeout: 3_000, maxBuffer: 1024 * 1024, stdio: ['ignore', 'pipe', 'ignore'],
+        });
+    }
+    catch {
+        throw new Error('yolo-change-evidence-unavailable');
+    }
+}
+export function collectYoloChangeEvidence(options) {
+    if (!/^[A-Za-z0-9][A-Za-z0-9_./-]{0,119}$/.test(options.defaultBranch)
+        || options.defaultBranch.includes('..'))
+        throw new Error('yolo-change-evidence-unavailable');
+    const repositoryRoot = git(options.projectRoot, ['rev-parse', '--show-toplevel']).trim();
+    if (realpathSync(repositoryRoot) !== realpathSync(options.projectRoot))
+        throw new Error('yolo-change-evidence-unavailable');
+    const headSha = git(options.projectRoot, ['rev-parse', 'HEAD']).trim();
+    if (headSha !== options.expectedHeadSha)
+        throw new Error('yolo-change-evidence-stale');
+    let baseSha;
+    let activeStoryLease = false;
+    let executionBranch = null;
+    if (options.storyId && options.epicId) {
+        try {
+            const runtime = readGitLifecycleRuntimeSync(options.projectRoot);
+            const epic = runtime.epics[options.epicId];
+            const lease = epic?.branch_lease;
+            const currentBranch = git(options.projectRoot, ['symbolic-ref', '--quiet', '--short', 'HEAD']).trim();
+            if (epic?.branch_mode === 'epic' && epic.execution_branch === currentBranch) {
+                executionBranch = currentBranch;
+            }
+            if (lease && typeof lease === 'object' && !Array.isArray(lease)) {
+                const item = lease;
+                if (item.ownerStoryId !== options.storyId
+                    || typeof item.expiresAt !== 'string' || Date.parse(item.expiresAt) <= Date.now()
+                    || executionBranch === null) {
+                    throw new Error('yolo-change-evidence-unavailable');
+                }
+                activeStoryLease = true;
+            }
+        }
+        catch {
+            throw new Error('yolo-change-evidence-unavailable');
+        }
+    }
+    if (activeStoryLease) {
+        // Before the root C08 commit, the setup lease owns the current checkout.
+        // Earlier epic commits are not part of this story's implementation diff.
+        // A manually pre-committed change cannot satisfy the staged C08 checkpoint.
+        baseSha = headSha;
+    }
+    else {
+        // Before C01 has acquired a story lease, compare this epic checkout with
+        // its published tip. Historical epic commits are not new story changes,
+        // while local unpushed commits must remain visible to the evidence gate.
+        const remoteLine = executionBranch === null ? '' : git(options.projectRoot, [
+            'ls-remote', '--heads', 'origin', `refs/heads/${executionBranch}`,
+        ]).trim();
+        if (remoteLine) {
+            const match = /^([a-f0-9]{40})\trefs\/heads\/([^\n]+)$/.exec(remoteLine);
+            if (!match || match[2] !== executionBranch
+                || git(options.projectRoot, ['merge-base', 'HEAD', match[1]]).trim() !== match[1]) {
+                throw new Error('yolo-change-evidence-unavailable');
+            }
+            baseSha = match[1];
+        }
+        else {
+            try {
+                baseSha = git(options.projectRoot, ['merge-base', 'HEAD', options.defaultBranch]).trim();
+            }
+            catch {
+                baseSha = git(options.projectRoot, ['merge-base', 'HEAD', `refs/remotes/origin/${options.defaultBranch}`]).trim();
+            }
+        }
+    }
+    const tracked = git(options.projectRoot, ['diff', '--name-only', '-z', baseSha, '--']).split('\0').filter(Boolean);
+    const untracked = git(options.projectRoot, ['ls-files', '--others', '--exclude-standard', '-z']).split('\0').filter(Boolean);
+    const evidence = createYoloChangeEvidence({ baseSha, headSha, changedPaths: [...tracked, ...untracked] });
+    if (git(options.projectRoot, ['rev-parse', 'HEAD']).trim() !== headSha)
+        throw new Error('yolo-change-evidence-stale');
+    return evidence;
+}