@pareto4/pp-core 1.6.0 → 1.7.0

package/pp-core/bin/lib/git-base-branch.cjs

@@ -208,9 +208,9 @@ function gitWorktreeInfoInternal(cwd) {
 }
 // ─── CLI entry point ──────────────────────────────────────────────────────────
 /**
- * CLI command: `gsd-tools git base-branch`
+ * CLI command: `pp-tools git base-branch`
  * Resolves the default branch and writes it to stdout (raw string, newline-terminated).
- * Called by workflows via `gsd_run query git.base-branch`.
+ * Called by workflows via `pp_run query git.base-branch`.
  */
 function cmdGitBaseBranch(cwd, _args, deps) {
     const branch = resolveBaseBranch(cwd, deps);

package/pp-core/bin/lib/graphify-command-router.cjs

@@ -1,9 +1,9 @@
 'use strict';
 /**
- * Graphify command router — CLI subcommand dispatcher for `gsd-tools graphify`.
+ * Graphify command router — CLI subcommand dispatcher for `pp-tools graphify`.
  *
  * ADR-959 (phase 4d-impl-2) pilot: first real capability command cutover.
- * Extracted from the hardcoded `case 'graphify':` arm in gsd-tools.cjs.
+ * Extracted from the hardcoded `case 'graphify':` arm in pp-tools.cjs.
  * Behaviour is preserved byte-for-behaviour from the prior inline case;
  * the dispatch path now flows: default → dispatchCapabilityCommand →
  * require(graphify-command-router.cjs) → routeGraphifyCommand.
@@ -34,7 +34,7 @@ function routeGraphifyCommand({ args, cwd, raw, error, _graphify }) {
     if (subcommand === 'query') {
         const term = args[2];
         if (!term) {
-            error('Usage: gsd-tools graphify query <term>', ERROR_REASON.USAGE);
+            error('Usage: pp-tools graphify query <term>', ERROR_REASON.USAGE);
             return;
         }
         const budgetIdx = args.indexOf('--budget');
@@ -42,7 +42,7 @@ function routeGraphifyCommand({ args, cwd, raw, error, _graphify }) {
         if (budgetIdx !== -1) {
             const rawBudget = args[budgetIdx + 1];
             if (rawBudget === undefined || Number.isNaN(parseInt(rawBudget, 10))) {
-                error('Usage: gsd-tools graphify query <term> [--budget <N>]', ERROR_REASON.USAGE);
+                error('Usage: pp-tools graphify query <term> [--budget <N>]', ERROR_REASON.USAGE);
                 return;
             }
             budget = parseInt(rawBudget, 10);

package/pp-core/bin/lib/graphify.cjs

@@ -20,7 +20,7 @@ const { isCapabilityActive } = capabilityStateMod;
  * Return the standard disabled response object.
  */
 function disabledResponse() {
-    return { disabled: true, message: 'graphify is not enabled. Enable with: gsd-tools config-set graphify.enabled true' };
+    return { disabled: true, message: 'graphify is not enabled. Enable with: pp-tools config-set graphify.enabled true' };
 }
 // ─── Subprocess Helper ───────────────────────────────────────────────────────
 /**

package/pp-core/bin/lib/gsd2-import.cjs

@@ -392,7 +392,7 @@ function writePlanningDir(artifacts, planningRoot) {
 }
 // ─── Command Handler ──────────────────────────────────────────────────────────
 /**
- * Entry point called from gsd-tools.cjs.
+ * Entry point called from pp-tools.cjs.
  * Supports: --force, --dry-run, --path <dir>
  */
 function cmdFromGsd2(args, cwd, raw) {

package/pp-core/bin/lib/init-command-router.cjs

@@ -1,7 +1,7 @@
 "use strict";
 /**
  * Manifest-backed init subcommand router.
- * Keeps gsd-tools.cjs thin while preserving existing command semantics.
+ * Keeps pp-tools.cjs thin while preserving existing command semantics.
  *
  * Phase 6: all init.* subcommands have SDK equivalents and are dispatched
  * via executeForCjs (the sync bridge). CJS fallback retained when:

package/pp-core/bin/lib/init.cjs

@@ -1218,7 +1218,7 @@ function cmdInitManager(cwd, raw) {
         const safe = tokens.every((t) => /^--[a-zA-Z0-9][-a-zA-Z0-9]*$/.test(t) ||
             /^[a-zA-Z0-9][-a-zA-Z0-9_.]*$/.test(t));
         if (!safe) {
-            process.stderr.write(`gsd-tools: warning: manager.flags contains invalid tokens, ignoring: ${val}\n`);
+            process.stderr.write(`pp-tools: warning: manager.flags contains invalid tokens, ignoring: ${val}\n`);
             return '';
         }
         return val;

package/pp-core/bin/lib/intel-command-router.cjs

@@ -1,10 +1,10 @@
 'use strict';
 /**
- * Intel command router — CLI subcommand dispatcher for `gsd-tools intel`.
+ * Intel command router — CLI subcommand dispatcher for `pp-tools intel`.
  *
  * ADR-959 (phase 4d-impl-4): intel command family cutover — last first-party
  * command cutover in the initial capability rollout.
- * Extracted from the hardcoded `case 'intel':` arm in gsd-tools.cjs.
+ * Extracted from the hardcoded `case 'intel':` arm in pp-tools.cjs.
  * Behaviour is preserved byte-for-behaviour from the prior inline case;
  * the dispatch path now flows: default → dispatchCapabilityCommand →
  * require(intel-command-router.cjs) → routeIntelCommand.
@@ -56,7 +56,7 @@ function routeIntelCommand({ args, cwd, raw, error, _intel, _core }) {
     if (subcommand === 'query') {
         const term = args[2];
         if (!term) {
-            error('Usage: gsd-tools intel query <term>', ERROR_REASON.USAGE);
+            error('Usage: pp-tools intel query <term>', ERROR_REASON.USAGE);
             return;
         }
         const planningDir = path.join(cwd, '.planning');
@@ -85,7 +85,7 @@ function routeIntelCommand({ args, cwd, raw, error, _intel, _core }) {
     else if (subcommand === 'patch-meta') {
         const filePath = args[2];
         if (!filePath) {
-            error('Usage: gsd-tools intel patch-meta <file-path>', ERROR_REASON.USAGE);
+            error('Usage: pp-tools intel patch-meta <file-path>', ERROR_REASON.USAGE);
             return;
         }
         c.output(intel.intelPatchMeta(path.resolve(cwd, filePath)), raw);
@@ -97,7 +97,7 @@ function routeIntelCommand({ args, cwd, raw, error, _intel, _core }) {
     else if (subcommand === 'extract-exports') {
         const filePath = args[2];
         if (!filePath) {
-            error('Usage: gsd-tools intel extract-exports <file-path>', ERROR_REASON.USAGE);
+            error('Usage: pp-tools intel extract-exports <file-path>', ERROR_REASON.USAGE);
             return;
         }
         c.output(intel.intelExtractExports(path.resolve(cwd, filePath)), raw);

package/pp-core/bin/lib/intel.cjs

@@ -240,7 +240,7 @@ function intelUpdate(planningDir) {
         return disabledResponse();
     return {
         action: 'spawn_agent',
-        message: 'Run gsd-tools intel update or spawn gsd-intel-updater agent for full refresh',
+        message: 'Run pp-tools intel update or spawn gsd-intel-updater agent for full refresh',
     };
 }
 /**

package/pp-core/bin/lib/io.cjs

@@ -161,7 +161,7 @@ const ERROR_REASON = Object.freeze({
     CONFIG_NO_FILE: 'config_no_file',
     CONFIG_PARSE_FAILED: 'config_parse_failed',
     CONFIG_INVALID_KEY: 'config_invalid_key',
-    // SDK / gsd-tools dispatch
+    // SDK / pp-tools dispatch
     SDK_FAIL_FAST: 'sdk_fail_fast',
     SDK_UNKNOWN_COMMAND: 'sdk_unknown_command',
     SDK_MISSING_ARG: 'sdk_missing_arg',
@@ -183,7 +183,7 @@ const ERROR_REASON = Object.freeze({
 });
 /**
  * Process-level flag: when true, error() emits structured JSON to stderr
- * instead of plain "Error: <message>" text. Set by gsd-tools.cjs when the
+ * instead of plain "Error: <message>" text. Set by pp-tools.cjs when the
  * CLI is invoked with `--json-errors`. Tests opt in to typed-IR error
  * assertions by passing that flag and parsing the JSON.
  *

package/pp-core/bin/lib/loop-resolver.cjs

@@ -10,7 +10,7 @@
  * at plan:pre (ui-phase) and autonomous.md at verify:post (ui-review). Further per-feature
  * cutovers are ongoing.
  *
- * Command surface: gsd-tools loop render-hooks <point>
+ * Command surface: pp-tools loop render-hooks <point>
  *
  * Exports (three things):
  *   resolveLoopHooks({ point, registry, config }) → { point, activeHooks }

package/pp-core/bin/lib/phase-command-router.cjs

@@ -1,7 +1,7 @@
 "use strict";
 /**
  * Manifest-backed phase subcommand router.
- * Keeps gsd-tools.cjs thin while preserving existing command semantics.
+ * Keeps pp-tools.cjs thin while preserving existing command semantics.
  *
  * Unsupported in this router:
  * - scaffold: routed through top-level scaffold command.

package/pp-core/bin/lib/phases-command-router.cjs

@@ -1,7 +1,7 @@
 "use strict";
 /**
  * Manifest-backed phases subcommand router.
- * Keeps gsd-tools.cjs thin while preserving current CJS semantics.
+ * Keeps pp-tools.cjs thin while preserving current CJS semantics.
  *
  * Unsupported in this router (treated as unknown):
  * - archive: `phases archive` is excluded from the subcommands list so it

package/pp-core/bin/lib/plan-drift-guard.cjs

@@ -8,7 +8,7 @@
  * Design constraints:
  *   - Pure module: no I/O, no require() calls, no side effects.
  *   - All inputs are validated; unknown values throw a TypeError.
- *   - Consumed by the `gsd-tools drift-guard` CLI seam and by tests.
+ *   - Consumed by the `pp-tools drift-guard` CLI seam and by tests.
  *
  * Authority ladder (rung values determine MISSING severity):
  *   grep=0  intel=1  treesitter=2  lsp=3  scip=4

package/pp-core/bin/lib/platform-bindings.cjs

@@ -48,6 +48,12 @@ const PLATFORM_REPO_RE = /^[\w.-]+\/[\w.-]+$/;
 const PLATFORM_TAG_RE = /^v\d+\.\d+\.\d+/;
 // Provisional namespace pattern (lenient): only enforced if client.slug is present.
 const SLUG_RE = /^[a-z0-9][a-z0-9-]*$/;
+// Provisional vault repo pattern (lenient): only enforced if client.vaultRepo is present.
+// MUST mirror schemas/platform-bindings.schema.json vaultRepo.pattern byte-for-byte —
+// the schema↔validator coupling test machine-enforces this so neither side can drift.
+// ReDoS note (T-11-01): anchored at both ends; single non-overlapping + quantifiers over
+// disjoint character classes — no nested/ambiguous quantifier, linear complexity only.
+const VAULT_REPO_RE = /^[\w.-]+(\/[\w.-]+)+$/;
 function isObject(v) {
     return typeof v === 'object' && v !== null && !Array.isArray(v);
 }
@@ -87,6 +93,13 @@ function validateBindings(o) {
             errors.push('client.slug: present but not a url-safe lowercase slug');
         }
     }
+    // client.vaultRepo — lenient present-only check, mirrors client.slug pattern.
+    // Only fires when vaultRepo is actually present; absent vault fields are fully valid (D-03).
+    if (isObject(o.client) && o.client.vaultRepo !== undefined) {
+        if (typeof o.client.vaultRepo !== 'string' || !VAULT_REPO_RE.test(o.client.vaultRepo)) {
+            errors.push('client.vaultRepo: present but not a valid nested group/project path (e.g. pareto4-clients/acme/acme-vault)');
+        }
+    }
     // IN-03: project.slug — symmetric lenient check matching client.slug behaviour.
     // The schema defines the same ^[a-z0-9][a-z0-9-]*$ pattern for both fields.
     if (isObject(o.project) && o.project.slug !== undefined) {

package/pp-core/bin/lib/prohibition-enforcement.cjs

@@ -1,7 +1,7 @@
 "use strict";
 /**
  * prohibition-enforcement — the deterministic PRODUCER for test-tier prohibition verification
- * (#1259, ADR-550 Decision 5d "heavy half"; the D1 seam — a NEW deterministic gsd-tools
+ * (#1259, ADR-550 Decision 5d "heavy half"; the D1 seam — a NEW deterministic pp-tools
  * sub-command, NOT free-form workflow prose).
  *
  * Today `dispositionForProhibition()` (src/probe-core.cts) already carries the POLICY seam: with
@@ -645,7 +645,7 @@ function parseRequest(args) {
     }
 }
 /**
- * CLI surface: `gsd_run check prohibition-enforcement <request.json>` (or `--json '<inline>'`).
+ * CLI surface: `pp_run check prohibition-enforcement <request.json>` (or `--json '<inline>'`).
  * Parses the request, runs the producer, and emits the result as JSON. Honors the no-throw
  * contract: malformed input -> structured `error(...)`, never an uncaught throw.
  */

package/pp-core/bin/lib/roadmap-command-router.cjs

@@ -1,7 +1,7 @@
 "use strict";
 /**
  * Manifest-backed roadmap subcommand router.
- * Keeps gsd-tools.cjs thin while preserving existing command semantics.
+ * Keeps pp-tools.cjs thin while preserving existing command semantics.
  *
  * ADR-457 build-at-publish: the hand-written bin/lib/roadmap-command-router.cjs
  * collapsed to a TypeScript source of truth. Behaviour is preserved byte-for-behaviour
@@ -40,7 +40,7 @@ function checkW021(content) {
     const warnings = [];
     // Sentinel milestone integers exempt from W021
     const SENTINELS = new Set([0, 999]);
-    const MIGRATION_CMD = 'gsd-tools roadmap upgrade --convention milestone-prefixed';
+    const MIGRATION_CMD = 'pp-tools roadmap upgrade --convention milestone-prefixed';
     // Milestone section heading: ## [GSD] v2.0 — Label  OR  ## v2.0: Label  OR  ## Roadmap v2.0
     //   OR  ## ✅ v2.0  OR  ## 🚧 v2.0  (emoji-prefixed variants used by roadmap templates)
     // Capture the major integer.

package/pp-core/bin/lib/roadmap-parser.cjs

@@ -346,7 +346,7 @@ function getMilestonePhaseFilter(cwd, versionOverride, phaseIdConvention) {
         if (!hasVersionedMilestonesGlobal && hasPhaseHeadings && phaseIdConvention === 'milestone-prefixed') {
             console.warn('[gsd] Deprecated: free-form ROADMAP.md detected (no versioned milestone headings). ' +
                 'The project has phase_id_convention set to "milestone-prefixed" in config.json but the ' +
-                'ROADMAP does not use versioned milestone headings. Run `gsd-tools roadmap upgrade --convention milestone-prefixed` to migrate (dry-run by default).');
+                'ROADMAP does not use versioned milestone headings. Run `pp-tools roadmap upgrade --convention milestone-prefixed` to migrate (dry-run by default).');
         }
         if (versionOverride) {
             const escapedVersion = escapeRegex(versionOverride);

package/pp-core/bin/lib/state-command-router.cjs

@@ -1,7 +1,7 @@
 "use strict";
 /**
  * Manifest-backed state subcommand router.
- * Keeps gsd-tools.cjs thin while preserving existing command semantics.
+ * Keeps pp-tools.cjs thin while preserving existing command semantics.
  *
  * Phase 5.1: handlers that have SDK equivalents are dispatched via
  * executeForCjs (the sync bridge). CJS fallback is retained for:

package/pp-core/bin/lib/state.cjs

@@ -50,7 +50,7 @@ function shouldResyncStateProgress(fields) {
 // ─── Cache ────────────────────────────────────────────────────────────────────
 // Cache disk scan results from buildStateFrontmatter per cwd per process (#1967).
 // Avoids re-reading N+1 directories on every state write when the phase structure
-// hasn't changed within the same gsd-tools invocation.
+// hasn't changed within the same pp-tools invocation.
 const _diskScanCache = new Map();
 // Track all lock files held by this process so they can be removed on exit.
 // process.on('exit') fires even on process.exit(1), unlike try/finally which is
@@ -250,7 +250,7 @@ function stateReplaceFieldWithFallback(content, primary, fallback, value) {
     }
     // Neither pattern matched — field may have been reformatted or removed.
     // Log diagnostic so template drift is detected early rather than silently swallowed.
-    process.stderr.write(`[gsd-tools] WARNING: STATE.md field "${primary}"${fallback ? ` (fallback: "${fallback}")` : ''} not found — update skipped. ` +
+    process.stderr.write(`[pp-tools] WARNING: STATE.md field "${primary}"${fallback ? ` (fallback: "${fallback}")` : ''} not found — update skipped. ` +
         `This may indicate STATE.md was externally modified or uses an unexpected format.\n`);
     return content;
 }

package/pp-core/bin/lib/validate-command-router.cjs

@@ -1,7 +1,7 @@
 "use strict";
 /**
  * Manifest-backed validate subcommand router.
- * Keeps gsd-tools.cjs thin while preserving existing command semantics.
+ * Keeps pp-tools.cjs thin while preserving existing command semantics.
  *
  * Phase 6: validate.consistency, validate.health, validate.agents are
  * dispatched via executeForCjs when the SDK is available. CJS fallback

package/pp-core/bin/lib/vault-command-router.cjs

@@ -0,0 +1,56 @@
+'use strict';
+/**
+ * Vault command router — CLI subcommand dispatcher for `pp-tools vault`.
+ *
+ * Milestone v1.7.0 Client Vault Load, Phase 12-03: wires the fetch/status/summary
+ * impl from Plans 12-01/12-02 (src/vault.cts) into the CLI as real verbs. The
+ * dispatch path flows: default → dispatchCapabilityCommand →
+ * require(vault-command-router.cjs) → routeVaultCommand, discovered by name via
+ * the capability registry (capabilities/vault/capability.json commands[]). No
+ * hardcoded `case 'vault':` arm in pp-tools.cjs (ADR-959 declarative registration).
+ *
+ * Router signature: { args, cwd, raw, error } — identical to the host routers
+ * (mirrors src/intel-command-router.cts exactly).
+ *
+ * Arg indexing:
+ *   args[0] = 'vault'      (family — matched by dispatchCapabilityCommand)
+ *   args[1] = subcommand   (fetch | status | summary)
+ *
+ * Test seams: pass `_vault` to inject a mock vault module; pass `_core` to inject
+ * a mock core module that captures `output()` calls instead of writing to real
+ * stdout. The `_`-prefix follows the repo's established seam convention (see
+ * intel-command-router.cts / audit-command-router.cts). Production callers omit
+ * both and the real ./vault.cjs is lazy-required INSIDE the route function so it
+ * only loads when a vault command is actually dispatched.
+ *
+ * ADR-457 build-at-publish: this TypeScript file is the SOURCE OF TRUTH. It
+ * compiles to the git-ignored `pp-core/bin/lib/vault-command-router.cjs`; do NOT
+ * hand-edit the compiled output.
+ */
+// eslint-disable-next-line @typescript-eslint/no-require-imports
+const io = require("./io.cjs");
+const { ERROR_REASON } = io;
+// Default CoreModule implementation. _core seam overrides this for test injection.
+const _defaultCore = { output: io.output };
+// ─── Implementation ───────────────────────────────────────────────────────────
+function routeVaultCommand({ args, cwd, raw, error, _vault, _core }) {
+    // eslint-disable-next-line @typescript-eslint/no-require-imports, @typescript-eslint/no-unsafe-assignment
+    const vault = _vault ?? require('./vault.cjs');
+    const c = _core ?? _defaultCore;
+    const subcommand = args[1];
+    if (subcommand === 'fetch') {
+        c.output(vault.vaultFetch(cwd), raw);
+    }
+    else if (subcommand === 'status') {
+        c.output(vault.vaultStatus(cwd), raw);
+    }
+    else if (subcommand === 'summary') {
+        c.output(vault.vaultSummary(cwd), raw);
+    }
+    else {
+        error('Unknown vault subcommand. Available: fetch, status, summary', ERROR_REASON.SDK_UNKNOWN_COMMAND);
+    }
+}
+module.exports = {
+    routeVaultCommand,
+};