@productbrain/cli 0.1.0-beta.1131 → 0.1.0-beta.11318

package/dist/commands/outcome.d.ts

@@ -0,0 +1,90 @@
+import { type OutcomeObjectiveView } from '../lib/outcomeObjectiveLines.js';
+/** Mirrors the door's own `kind` union (`convex/outcomes/readings.ts`). Kept as a literal list so
+ *  a bad value is refused HERE, naming the legal set, rather than as an opaque validator error. */
+declare const READING_KINDS: readonly ["measurement", "estimate", "correction"];
+type ReadingKind = (typeof READING_KINDS)[number];
+export interface OutcomeRecordOptions {
+    asOf?: string;
+    kind?: string;
+    corrects?: string;
+    byRole?: string;
+    note?: string;
+    source?: string;
+    valueText?: string;
+    json?: boolean;
+}
+export interface OutcomeListOptions {
+    limit?: string;
+    json?: boolean;
+}
+export interface ReadingRow {
+    /** Non-underscore twin of the row's `_id` (TEN-340: the CLI's JSON envelope unconditionally
+     *  strips any `_id`-keyed field via `stripConvexInternals`) — this is the field
+     *  `pb outcome record --corrects <READING-ID>` targets. Same twin `pb conflicts` (`id`) already
+     *  carries, for the same reason. */
+    readingId: string;
+    value: number;
+    valueText?: string;
+    asOf: number;
+    recordedAt: number;
+    kind: ReadingKind;
+    actorKind: string;
+    note?: string;
+    source?: string;
+    supersededByReadingId?: string;
+}
+interface ListReadingsResult {
+    entryDocId: string;
+    pageExhausted: boolean;
+    readings: ReadingRow[];
+}
+export declare function runOutcomeRecord(entryId: string, value: string, options: OutcomeRecordOptions): Promise<void>;
+export declare function formatReadingsList(entryId: string, result: ListReadingsResult | null): string;
+export declare function runOutcomeList(entryId: string, options: OutcomeListOptions): Promise<void>;
+interface OutcomeShowResult extends OutcomeObjectiveView {
+    entryId: string;
+    name: string;
+    readyToCloseInstruction: string | null;
+    outcome: {
+        current?: {
+            value: number;
+            asOf: number;
+        };
+        currentResolution: string;
+        hasNoReadings: boolean;
+        direction: string;
+        progressPct?: number;
+        pacePct?: number;
+        nextDueAt?: number;
+        state: string;
+        overdueByMs?: number;
+        completion: string;
+        completionProvenance: string;
+        readyToClose: 'achieved' | 'missed' | null;
+        ownerRole: {
+            id: string;
+            name: string | null;
+        } | null;
+        reporterRole: {
+            id: string;
+            name: string | null;
+        } | null;
+        readingCount: number;
+        unit: string | null;
+    };
+}
+/**
+ * Pretty rendering for `pb outcome show`. Exported for the same reason `formatReadingsList` is:
+ * the honesty rules here are assertable claims, not styling.
+ *
+ * Two of them are load-bearing. **A blank is never printed as a zero** — `progressPct` is
+ * `undefined` for a never-measured key result and `—` says that, where `0%` would read as a
+ * measurement. And **the recorded completion is never called "confirmed" or "verified"** — it
+ * reports what was recorded and where that came from, because nothing in this run verifies a
+ * close, and a surface that implies otherwise is the failure the whole provenance field exists to
+ * prevent.
+ */
+export declare function formatOutcomeShow(result: OutcomeShowResult | null): string;
+export declare function runOutcomeShow(entryId: string): Promise<void>;
+export {};
+//# sourceMappingURL=outcome.d.ts.map

package/dist/commands/outcome.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"outcome.d.ts","sourceRoot":"","sources":["../../src/commands/outcome.ts"],"names":[],"mappings":"AAkCA,OAAO,EAA+B,KAAK,oBAAoB,EAAE,MAAM,iCAAiC,CAAC;AAEzG;mGACmG;AACnG,QAAA,MAAM,aAAa,oDAAqD,CAAC;AACzE,KAAK,WAAW,GAAG,CAAC,OAAO,aAAa,CAAC,CAAC,MAAM,CAAC,CAAC;AAElD,MAAM,WAAW,oBAAoB;IACpC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,OAAO,CAAC;CACf;AAED,MAAM,WAAW,kBAAkB;IAClC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,OAAO,CAAC;CACf;AAED,MAAM,WAAW,UAAU;IAC1B;;;wCAGoC;IACpC,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,WAAW,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,qBAAqB,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,UAAU,kBAAkB;IAC3B,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,OAAO,CAAC;IACvB,QAAQ,EAAE,UAAU,EAAE,CAAC;CACvB;AAsBD,wBAAsB,gBAAgB,CACrC,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,oBAAoB,GAC3B,OAAO,CAAC,IAAI,CAAC,CAqEf;AAuCD,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,kBAAkB,GAAG,IAAI,GAAG,MAAM,CAa7F;AAED,wBAAsB,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAchG;AAED,UAAU,iBAAkB,SAAQ,oBAAoB;IACvD,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,uBAAuB,EAAE,MAAM,GAAG,IAAI,CAAC;IACvC,OAAO,EAAE;QACR,OAAO,CAAC,EAAE;YAAE,KAAK,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAA;SAAE,CAAC;QAC1C,iBAAiB,EAAE,MAAM,CAAC;QAC1B,aAAa,EAAE,OAAO,CAAC;QACvB,SAAS,EAAE,MAAM,CAAC;QAClB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,KAAK,EAAE,MAAM,CAAC;QACd,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,UAAU,EAAE,MAAM,CAAC;QACnB,oBAAoB,EAAE,MAAM,CAAC;QAC7B,YAAY,EAAE,UAAU,GAAG,QAAQ,GAAG,IAAI,CAAC;QAC3C,SAAS,EAAE;YAAE,EAAE,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;SAAE,GAAG,IAAI,CAAC;QACtD,YAAY,EAAE;YAAE,EAAE,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;SAAE,GAAG,IAAI,CAAC;QACzD,YAAY,EAAE,MAAM,CAAC;QACrB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;KACpB,CAAC;CACF;AAUD;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,iBAAiB,GAAG,IAAI,GAAG,MAAM,CA4B1E;AAED,wBAAsB,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAOnE"}

package/dist/commands/outcome.js

@@ -0,0 +1,201 @@
+import { getConfigOrGuide } from '../lib/config.js';
+import { kernelCall, kernelCallWithSession } from '../lib/client.js';
+import { CLIError, ErrorCode } from '../lib/errors.js';
+import { runCliCommand } from '../lib/runner.js';
+import { sanitizeSingleLineField } from '../lib/strip.js';
+import { formatOutcomeObjectiveLines } from '../lib/outcomeObjectiveLines.js';
+/** Mirrors the door's own `kind` union (`convex/outcomes/readings.ts`). Kept as a literal list so
+ *  a bad value is refused HERE, naming the legal set, rather than as an opaque validator error. */
+const READING_KINDS = ['measurement', 'estimate', 'correction'];
+const validation = (message, guidance) => new CLIError(message, { code: ErrorCode.VALIDATION_FAILED, category: 'validation', guidance });
+/** argv is strings; the door wants a number. `Number('')` is 0 and `Number(' ')` is 0, so the
+ *  blank cases are rejected explicitly rather than silently recorded as a reading of zero — which
+ *  would be a wrong MEASUREMENT, the one thing this table exists to get right. */
+function requireNumber(raw, flag) {
+    const trimmed = raw.trim();
+    const parsed = Number(trimmed);
+    if (trimmed === '' || !Number.isFinite(parsed)) {
+        throw validation(`${flag} must be a number (got "${raw}").`, 
+        // Placeholder, not a concrete id: a real-looking entry id in a user-facing string is a
+        // Chain-id leak (the pre-commit guard refuses it) and reads as a live reference.
+        `Example: pb outcome record <ENTRY-ID> 62${flag === '--limit' ? '' : ' --note "from the weekly dashboard"'}`);
+    }
+    return parsed;
+}
+export async function runOutcomeRecord(entryId, value, options) {
+    // Refuse everything refusable BEFORE the network call, so a malformed invocation costs no
+    // round trip and reports in the caller's own vocabulary rather than the validator's.
+    const numericValue = requireNumber(value, 'value');
+    if (options.kind !== undefined && !READING_KINDS.includes(options.kind)) {
+        throw validation(`--kind must be one of ${READING_KINDS.join(', ')} (got "${options.kind}").`, 'Use --kind estimate for a figure that is not directly measured, or --kind correction with --corrects to replace an earlier reading.');
+    }
+    // Both directions: the door refuses each, and a CLI that guards only one still sends a
+    // request it already knows will fail.
+    if (options.corrects !== undefined && options.kind !== 'correction') {
+        throw validation('--corrects is only meaningful with --kind correction.', 'Add --kind correction, or drop --corrects to record an ordinary reading.');
+    }
+    if (options.kind === 'correction' && options.corrects === undefined) {
+        throw validation('--kind correction requires --corrects <READING-ID>.', 'A correction must name the reading it replaces — find it with `pb outcome list <ENTRY-ID>`.');
+    }
+    let asOf;
+    if (options.asOf !== undefined) {
+        const parsed = Date.parse(options.asOf);
+        if (Number.isNaN(parsed)) {
+            throw validation(`--as-of must be a parseable date (got "${options.asOf}").`, 'Example: --as-of 2026-03-01. Back-dating is legitimate — a backfill shows up as asOf earlier than recordedAt.');
+        }
+        asOf = parsed;
+    }
+    const config = await getConfigOrGuide(() => runOutcomeRecord(entryId, value, options));
+    if (!config)
+        return;
+    await runCliCommand({
+        // Session-attributed on purpose: a reading's provenance is the point, and the plain caller
+        // would drop the session the reading is attributed to.
+        // Every optional is spread conditionally — a key present-but-undefined is not the same as
+        // absent to the validator, and the door's own defaults must win when the caller is silent.
+        fn: () => kernelCallWithSession('outcomes.recordReading', {
+            entryId,
+            value: numericValue,
+            ...(asOf !== undefined ? { asOf } : {}),
+            ...(options.kind ? { kind: options.kind } : {}),
+            ...(options.corrects ? { correctsReadingId: options.corrects } : {}),
+            ...(options.byRole ? { recordedByRoleId: options.byRole } : {}),
+            ...(options.note ? { note: options.note } : {}),
+            ...(options.source ? { source: options.source } : {}),
+            ...(options.valueText ? { valueText: options.valueText } : {}),
+        }),
+        formatPretty: (value_) => {
+            const receipt = value_;
+            const lines = [
+                // Same sanitiser, same reason — this line is echoed straight to the terminal.
+                `Recorded ${numericValue}${options.valueText ? ` ("${sanitizeSingleLineField(options.valueText)}")` : ''} on ${sanitizeSingleLineField(entryId)}.`,
+                // The actor is DERIVED server-side from the credential — printed here so the caller
+                // sees what was actually attributed, never what they might have assumed.
+                `  attributed: ${receipt?.actorKind ?? 'unknown'}`,
+            ];
+            return lines.join('\n');
+        },
+    });
+}
+/**
+ * Pretty rendering for `pb outcome list`. Exported so the spec'd behaviours here are asserted
+ * directly rather than only through a live walk: superseded rows are SHOWN (the ledger is
+ * append-only and the correction chain is the audit trail) and marked with the id that replaced
+ * them, and `pageExhausted: false` is reported rather than letting a bounded page read as the
+ * whole history.
+ *
+ * **Every value that did not originate in this file is sanitised** (PR #840 security review).
+ * `note` and `valueText` are free text written by ANY connector that can call
+ * `outcomes.recordReading` — agents included — and this rendering is the operator's AUDIT VIEW.
+ * An embedded newline would inject extra, unprefixed lines that look exactly like additional
+ * readings: forged evidence in the one surface someone would use to check evidence. `\r` can
+ * overwrite the line that was already drawn, and CSI/OSC sequences can retitle or clear the
+ * operator's terminal. `sanitizeSingleLineField` (`lib/strip.js`) is the package's shared,
+ * single-line-safe sanitiser — the same one `shape`, `conflicts`, `feedback`, `direction` and
+ * `questions` use — and its own docblock exists for precisely this case, because
+ * `stripControlChars` deliberately keeps `\n`. Not hand-rolled here on purpose.
+ *
+ * `entryId` is echoed from argv rather than stored, so it is self-inflicted — sanitised anyway,
+ * since it costs nothing and a pasted command is a real way to reach it. The remaining
+ * interpolations need no sanitising and it would obscure the reasoning to add it: `kind` is a
+ * Convex union literal the validator constrains, `readingId` and
+ * `supersededByReadingId` are Convex document ids, `value` is a number, and `when` is derived
+ * from a number through `toISOString`.
+ */
+/** PR #872 review round 3 (Codex P2): mirrors `packages/mcp-server/src/tools/outcome.ts`'s
+ *  `safeDateSlice` — a reading written through the existing API route is validated only with
+ *  `v.number()`, so a finite-but-Date-invalid `asOf`/`nextDueAt` (e.g. `1e100`) can be persisted.
+ *  `new Date(x).toISOString()` throws `RangeError` for such a value, which would otherwise take
+ *  down the whole `pb outcome list`/`show` command over one malformed legacy row. Not shared code
+ *  with the MCP tool (the two packages do not cross-import, same door-parity precedent every
+ *  other CLI/MCP formatter pair in this codebase follows) — content-equal by construction. */
+function safeDateSlice(ms) {
+    const d = new Date(ms);
+    return Number.isNaN(d.getTime()) ? 'invalid-date' : d.toISOString().slice(0, 10);
+}
+export function formatReadingsList(entryId, result) {
+    const safeEntryId = sanitizeSingleLineField(entryId);
+    const rows = result?.readings ?? [];
+    if (rows.length === 0)
+        return `No readings recorded on ${safeEntryId} yet.`;
+    const lines = rows.map((row) => {
+        const when = safeDateSlice(row.asOf);
+        const superseded = row.supersededByReadingId ? `  <- superseded by ${row.supersededByReadingId}` : '';
+        const text = row.valueText ? ` ("${sanitizeSingleLineField(row.valueText)}")` : '';
+        const note = row.note ? `  - ${sanitizeSingleLineField(row.note)}` : '';
+        return `  ${when}  ${String(row.value).padStart(8)}${text}  [${row.kind}]  ${row.readingId}${note}${superseded}`;
+    });
+    const tail = result?.pageExhausted === false ? '\n  (older readings not loaded - raise --limit)' : '';
+    return `${rows.length} reading(s) on ${safeEntryId}, newest first:\n${lines.join('\n')}${tail}`;
+}
+export async function runOutcomeList(entryId, options) {
+    const limit = options.limit !== undefined ? requireNumber(options.limit, '--limit') : undefined;
+    const config = await getConfigOrGuide(() => runOutcomeList(entryId, options));
+    if (!config)
+        return;
+    await runCliCommand({
+        // A read: no session required. Demanding one would break `pb outcome list` for a caller
+        // holding a valid key who simply has not started a session.
+        fn: () => kernelCall('outcomes.listReadings', {
+            entryId,
+            ...(limit !== undefined ? { limit } : {}),
+        }),
+        formatPretty: (value_) => formatReadingsList(entryId, value_),
+    });
+}
+const pct = (v, unit = '%') => (v === undefined ? '—' : `${Math.round(v * 10) / 10}${unit}`);
+/** `role.name` is an `entries.name` resolved server-side, so it is stored content written by any
+ *  connector that can update entries — agents included — and reaches the operator's terminal
+ *  through this line. Same sink class as `note`/`valueText`, and it must be sanitised for the same
+ *  reason: an embedded newline injects an unprefixed line into the audit view. */
+const roleLabel = (role) => role === null ? 'not set' : role.name === null ? 'a role that no longer exists' : sanitizeSingleLineField(role.name);
+/**
+ * Pretty rendering for `pb outcome show`. Exported for the same reason `formatReadingsList` is:
+ * the honesty rules here are assertable claims, not styling.
+ *
+ * Two of them are load-bearing. **A blank is never printed as a zero** — `progressPct` is
+ * `undefined` for a never-measured key result and `—` says that, where `0%` would read as a
+ * measurement. And **the recorded completion is never called "confirmed" or "verified"** — it
+ * reports what was recorded and where that came from, because nothing in this run verifies a
+ * close, and a surface that implies otherwise is the failure the whole provenance field exists to
+ * prevent.
+ */
+export function formatOutcomeShow(result) {
+    if (!result)
+        return 'No outcome found.';
+    const o = result.outcome;
+    const unit = o.unit ? ` ${sanitizeSingleLineField(o.unit)}` : '';
+    const lines = [
+        // N2 (TASK-367): the metric line is retired — the entry's own name (above) already states
+        // what is measured.
+        `${sanitizeSingleLineField(result.entryId)} — ${sanitizeSingleLineField(result.name)}`,
+        // The honest blank: undefined is "never measured", which is not zero.
+        `  current     ${o.current ? `${o.current.value}${unit}` : 'no readings yet'}   (${o.readingCount} reading(s))`,
+        `  progress    ${pct(o.progressPct)}   direction ${o.direction}`,
+        `  pace        ${pct(o.pacePct)}   ${o.pacePct === undefined ? '(no cycle end set)' : o.pacePct >= 0 ? '(ahead of pace)' : '(behind pace)'}`,
+        `  state       ${o.state}${o.hasNoReadings ? ' — never read' : ''}${o.overdueByMs ? ` (by ${Math.floor(o.overdueByMs / 86400000)}d)` : ''}`,
+        `  next due    ${o.nextDueAt ? safeDateSlice(o.nextDueAt) : 'no cadence set'}`,
+        `  owner       ${roleLabel(o.ownerRole)}`,
+        `  reporter    ${roleLabel(o.reporterRole)}`,
+        // Recorded, with its provenance. Never "confirmed", never "verified".
+        `  completion  recorded as ${o.completion} (source: ${o.completionProvenance})`,
+        ...formatOutcomeObjectiveLines(result, sanitizeSingleLineField), // TASK-817: its objective and sibling key results
+    ];
+    if (o.currentResolution === 'page-exhausted') {
+        lines.push('  note        every loaded reading is superseded and more remain — this is not "never read"');
+    }
+    if (result.readyToCloseInstruction) {
+        lines.push('', `  ${result.readyToCloseInstruction}`);
+    }
+    return lines.join('\n');
+}
+export async function runOutcomeShow(entryId) {
+    const config = await getConfigOrGuide(() => runOutcomeShow(entryId));
+    if (!config)
+        return;
+    await runCliCommand({
+        fn: () => kernelCall('outcomes.showOutcome', { entryId }),
+        formatPretty: (value_) => formatOutcomeShow(value_),
+    });
+}
+//# sourceMappingURL=outcome.js.map

package/dist/commands/outcome.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"outcome.js","sourceRoot":"","sources":["../../src/commands/outcome.ts"],"names":[],"mappings":"AA6BA,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,UAAU,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AACrE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,uBAAuB,EAAE,MAAM,iBAAiB,CAAC;AAC1D,OAAO,EAAE,2BAA2B,EAA6B,MAAM,iCAAiC,CAAC;AAEzG;mGACmG;AACnG,MAAM,aAAa,GAAG,CAAC,aAAa,EAAE,UAAU,EAAE,YAAY,CAAU,CAAC;AA0CzE,MAAM,UAAU,GAAG,CAAC,OAAe,EAAE,QAAgB,EAAY,EAAE,CAClE,IAAI,QAAQ,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,CAAC,iBAAiB,EAAE,QAAQ,EAAE,YAAY,EAAE,QAAQ,EAAE,CAAC,CAAC;AAEhG;;kFAEkF;AAClF,SAAS,aAAa,CAAC,GAAW,EAAE,IAAY;IAC/C,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3B,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;IAC/B,IAAI,OAAO,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAChD,MAAM,UAAU,CACf,GAAG,IAAI,2BAA2B,GAAG,KAAK;QAC1C,uFAAuF;QACvF,iFAAiF;QACjF,2CAA2C,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,qCAAqC,EAAE,CAC5G,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AACf,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACrC,OAAe,EACf,KAAa,EACb,OAA6B;IAE7B,0FAA0F;IAC1F,qFAAqF;IACrF,MAAM,YAAY,GAAG,aAAa,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAEnD,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,IAAI,CAAE,aAAmC,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAChG,MAAM,UAAU,CACf,yBAAyB,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,OAAO,CAAC,IAAI,KAAK,EAC5E,qIAAqI,CACrI,CAAC;IACH,CAAC;IACD,uFAAuF;IACvF,sCAAsC;IACtC,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS,IAAI,OAAO,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;QACrE,MAAM,UAAU,CACf,uDAAuD,EACvD,0EAA0E,CAC1E,CAAC;IACH,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,KAAK,YAAY,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QACrE,MAAM,UAAU,CACf,qDAAqD,EACrD,6FAA6F,CAC7F,CAAC;IACH,CAAC;IAED,IAAI,IAAwB,CAAC;IAC7B,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAChC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1B,MAAM,UAAU,CACf,0CAA0C,OAAO,CAAC,IAAI,KAAK,EAC3D,+GAA+G,CAC/G,CAAC;QACH,CAAC;QACD,IAAI,GAAG,MAAM,CAAC;IACf,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,CAAC,gBAAgB,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;IACvF,IAAI,CAAC,MAAM;QAAE,OAAO;IAEpB,MAAM,aAAa,CAAC;QACnB,2FAA2F;QAC3F,uDAAuD;QACvD,0FAA0F;QAC1F,2FAA2F;QAC3F,EAAE,EAAE,GAAG,EAAE,CAAC,qBAAqB,CAAqD,wBAAwB,EAAE;YAC7G,OAAO;YACP,KAAK,EAAE,YAAY;YACnB,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAmB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9D,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACpE,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/D,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/C,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrD,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9D,CAAC;QACF,YAAY,EAAE,CAAC,MAAM,EAAE,EAAE;YACxB,MAAM,OAAO,GAAG,MAAsD,CAAC;YACvE,MAAM,KAAK,GAAG;gBACb,8EAA8E;gBAC9E,YAAY,YAAY,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,uBAAuB,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,uBAAuB,CAAC,OAAO,CAAC,GAAG;gBAClJ,oFAAoF;gBACpF,yEAAyE;gBACzE,iBAAiB,OAAO,EAAE,SAAS,IAAI,SAAS,EAAE;aAClD,CAAC;YACF,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACzB,CAAC;KACD,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH;;;;;;8FAM8F;AAC9F,SAAS,aAAa,CAAC,EAAU;IAChC,MAAM,CAAC,GAAG,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC;IACvB,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAClF,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,OAAe,EAAE,MAAiC;IACpF,MAAM,WAAW,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAC;IACrD,MAAM,IAAI,GAAG,MAAM,EAAE,QAAQ,IAAI,EAAE,CAAC;IACpC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,2BAA2B,WAAW,OAAO,CAAC;IAC5E,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;QAC9B,MAAM,IAAI,GAAG,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACrC,MAAM,UAAU,GAAG,GAAG,CAAC,qBAAqB,CAAC,CAAC,CAAC,sBAAsB,GAAG,CAAC,qBAAqB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtG,MAAM,IAAI,GAAG,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,uBAAuB,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QACnF,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,uBAAuB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxE,OAAO,KAAK,IAAI,KAAK,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,IAAI,MAAM,GAAG,CAAC,IAAI,MAAM,GAAG,CAAC,SAAS,GAAG,IAAI,GAAG,UAAU,EAAE,CAAC;IAClH,CAAC,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,MAAM,EAAE,aAAa,KAAK,KAAK,CAAC,CAAC,CAAC,iDAAiD,CAAC,CAAC,CAAC,EAAE,CAAC;IACtG,OAAO,GAAG,IAAI,CAAC,MAAM,kBAAkB,WAAW,oBAAoB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,EAAE,CAAC;AACjG,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,OAAe,EAAE,OAA2B;IAChF,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,OAAO,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAChG,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,CAAC,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;IAC9E,IAAI,CAAC,MAAM;QAAE,OAAO;IAEpB,MAAM,aAAa,CAAC;QACnB,wFAAwF;QACxF,4DAA4D;QAC5D,EAAE,EAAE,GAAG,EAAE,CAAC,UAAU,CAAoD,uBAAuB,EAAE;YAChG,OAAO;YACP,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACzC,CAAC;QACF,YAAY,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,kBAAkB,CAAC,OAAO,EAAE,MAAmC,CAAC;KAC1F,CAAC,CAAC;AACJ,CAAC;AA0BD,MAAM,GAAG,GAAG,CAAC,CAAqB,EAAE,IAAI,GAAG,GAAG,EAAU,EAAE,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,CAAC,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC;AACzH;;;kFAGkF;AAClF,MAAM,SAAS,GAAG,CAAC,IAAgD,EAAU,EAAE,CAC9E,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,8BAA8B,CAAC,CAAC,CAAC,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAEtH;;;;;;;;;;GAUG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAgC;IACjE,IAAI,CAAC,MAAM;QAAE,OAAO,mBAAmB,CAAC;IACxC,MAAM,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC;IACzB,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,uBAAuB,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACjE,MAAM,KAAK,GAAa;QACvB,0FAA0F;QAC1F,oBAAoB;QACpB,GAAG,uBAAuB,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,uBAAuB,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE;QACtF,sEAAsE;QACtE,iBAAiB,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC,iBAAiB,OAAO,CAAC,CAAC,YAAY,cAAc;QAC/G,iBAAiB,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,gBAAgB,CAAC,CAAC,SAAS,EAAE;QAChE,iBAAiB,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,eAAe,EAAE;QAC5I,iBAAiB,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,WAAW,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;QAC3I,iBAAiB,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,gBAAgB,EAAE;QAC9E,iBAAiB,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE;QACzC,iBAAiB,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE;QAC5C,sEAAsE;QACtE,6BAA6B,CAAC,CAAC,UAAU,aAAa,CAAC,CAAC,oBAAoB,GAAG;QAE/E,GAAG,2BAA2B,CAAC,MAAM,EAAE,uBAAuB,CAAC,EAAE,kDAAkD;KACnH,CAAC;IACF,IAAI,CAAC,CAAC,iBAAiB,KAAK,gBAAgB,EAAE,CAAC;QAC9C,KAAK,CAAC,IAAI,CAAC,6FAA6F,CAAC,CAAC;IAC3G,CAAC;IACD,IAAI,MAAM,CAAC,uBAAuB,EAAE,CAAC;QACpC,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,MAAM,CAAC,uBAAuB,EAAE,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACzB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,OAAe;IACnD,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC;IACrE,IAAI,CAAC,MAAM;QAAE,OAAO;IACpB,MAAM,aAAa,CAAC;QACnB,EAAE,EAAE,GAAG,EAAE,CAAC,UAAU,CAAmD,sBAAsB,EAAE,EAAE,OAAO,EAAE,CAAC;QAC3G,YAAY,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,iBAAiB,CAAC,MAAkC,CAAC;KAC/E,CAAC,CAAC;AACJ,CAAC"}

package/dist/commands/outcome.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=outcome.test.d.ts.map

package/dist/commands/outcome.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"outcome.test.d.ts","sourceRoot":"","sources":["../../src/commands/outcome.test.ts"],"names":[],"mappings":""}

package/dist/commands/outcome.test.js

@@ -0,0 +1,320 @@
+/**
+ * WP-722 S2 — `pb outcome record | list`.
+ *
+ * The surface is thin on purpose: every rule that matters (credential-derived actor, session
+ * ownership, role validation) lives behind the gateway and was proven in S1. What THIS slice can
+ * get wrong is the surface — sending a string where the door wants a number, silently dropping a
+ * flag, or inventing a client-side default that contradicts the server's. So these tests assert
+ * the exact args crossing the wire, and the refusals that never reach it.
+ */
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+const { getConfigOrGuide, kernelCall, kernelCallWithSession, readSession, runCliCommand } = vi.hoisted(() => ({
+    getConfigOrGuide: vi.fn(),
+    kernelCall: vi.fn(),
+    kernelCallWithSession: vi.fn(),
+    readSession: vi.fn(),
+    runCliCommand: vi.fn(async ({ fn }) => fn()),
+}));
+vi.mock('../lib/config.js', () => ({ getConfigOrGuide }));
+vi.mock('../lib/client.js', () => ({ kernelCall, kernelCallWithSession }));
+vi.mock('../lib/runner.js', () => ({ runCliCommand }));
+vi.mock('../lib/session.js', () => ({ readSession }));
+import { runOutcomeRecord, runOutcomeList, formatReadingsList, formatOutcomeShow } from './outcome.js';
+describe('pb outcome record', () => {
+    beforeEach(() => {
+        vi.clearAllMocks();
+        getConfigOrGuide.mockResolvedValue({ apiKey: 'pb_sk_test', siteUrl: 'https://example.test' });
+        kernelCallWithSession.mockResolvedValue({ readingId: 'r1', actorKind: 'agent', recordedAt: 1, asOf: 1 });
+        readSession.mockReturnValue({ sessionId: 's1' });
+    });
+    it('sends value as a NUMBER, not the raw argv string', async () => {
+        // The door declares `value: v.number()`. Forwarding argv verbatim would be refused by the
+        // validator at runtime, which is a wire-shape bug no server-side test can catch.
+        await runOutcomeRecord('KR-1', '62', {});
+        const [route, args] = kernelCallWithSession.mock.calls[0];
+        expect(route).toBe('outcomes.recordReading');
+        expect(args.value).toBe(62);
+        expect(args.value).not.toBe('62');
+        expect(args.entryId).toBe('KR-1');
+    });
+    it('refuses a non-numeric value BEFORE any network call', async () => {
+        await expect(runOutcomeRecord('KR-1', 'sixty-two', {})).rejects.toThrow(/number/i);
+        expect(kernelCallWithSession).not.toHaveBeenCalled();
+    });
+    it('accepts a negative and a decimal value (a reading is not always a positive integer)', async () => {
+        await runOutcomeRecord('KR-1', '-3.5', {});
+        expect(kernelCallWithSession.mock.calls[0][1].value).toBe(-3.5);
+    });
+    it('sends --as-of as an epoch-ms NUMBER, and refuses an unparseable date', async () => {
+        await runOutcomeRecord('KR-1', '1', { asOf: '2026-03-01' });
+        const args = kernelCallWithSession.mock.calls[0][1];
+        expect(typeof args.asOf).toBe('number');
+        expect(args.asOf).toBe(Date.parse('2026-03-01'));
+        vi.clearAllMocks();
+        getConfigOrGuide.mockResolvedValue({ apiKey: 'k', siteUrl: 's' });
+        await expect(runOutcomeRecord('KR-1', '1', { asOf: 'not-a-date' })).rejects.toThrow(/as-of/i);
+        expect(kernelCallWithSession).not.toHaveBeenCalled();
+    });
+    it('omits every optional it was not given — never sends undefined keys', async () => {
+        // A key present-but-undefined is not the same as absent to a Convex validator, and the
+        // door's own defaults (kind, asOf, recordedByRoleId) must win when the caller is silent.
+        await runOutcomeRecord('KR-1', '5', {});
+        const args = kernelCallWithSession.mock.calls[0][1];
+        expect(Object.keys(args).sort()).toEqual(['entryId', 'value']);
+    });
+    it('forwards note, source, value-text and by-role verbatim', async () => {
+        await runOutcomeRecord('KR-1', '5', { note: 'n', source: 'dashboard', valueText: '~5', byRole: 'ROL-2' });
+        expect(kernelCallWithSession.mock.calls[0][1]).toMatchObject({
+            note: 'n', source: 'dashboard', valueText: '~5', recordedByRoleId: 'ROL-2',
+        });
+    });
+    it('refuses --corrects without --kind correction, and --kind correction without --corrects', async () => {
+        // Both directions, because the door refuses both and a CLI that only guards one sends a
+        // request it already knows will fail.
+        await expect(runOutcomeRecord('KR-1', '5', { corrects: 'x' })).rejects.toThrow(/correction/i);
+        await expect(runOutcomeRecord('KR-1', '5', { kind: 'correction' })).rejects.toThrow(/corrects/i);
+        expect(kernelCallWithSession).not.toHaveBeenCalled();
+    });
+    it('sends a well-formed correction', async () => {
+        await runOutcomeRecord('KR-1', '5', { kind: 'correction', corrects: 'abc123' });
+        expect(kernelCallWithSession.mock.calls[0][1]).toMatchObject({ kind: 'correction', correctsReadingId: 'abc123' });
+    });
+    it('refuses an unknown --kind, naming the legal set', async () => {
+        await expect(runOutcomeRecord('KR-1', '5', { kind: 'guess' })).rejects.toThrow(/measurement/);
+        expect(kernelCallWithSession).not.toHaveBeenCalled();
+    });
+    it('records through the SESSION-attributed caller, not the plain one', async () => {
+        // A reading is a workspace write whose provenance is the whole point; `kernelCall` would
+        // drop the session the reading is attributed to.
+        await runOutcomeRecord('KR-1', '5', {});
+        expect(kernelCallWithSession).toHaveBeenCalledTimes(1);
+        expect(kernelCall).not.toHaveBeenCalled();
+    });
+});
+describe('pb outcome list', () => {
+    beforeEach(() => {
+        vi.clearAllMocks();
+        getConfigOrGuide.mockResolvedValue({ apiKey: 'pb_sk_test', siteUrl: 'https://example.test' });
+        kernelCall.mockResolvedValue({ entryDocId: 'e1', pageExhausted: true, readings: [] });
+        readSession.mockReturnValue(null);
+    });
+    it('reads through the plain caller and sends the entry id', async () => {
+        await runOutcomeList('KR-1', {});
+        const [route, args] = kernelCall.mock.calls[0];
+        expect(route).toBe('outcomes.listReadings');
+        expect(args.entryId).toBe('KR-1');
+        // A read needs no session — requiring one would make `pb outcome list` fail for a caller
+        // who has a key but has not started a session.
+        expect(kernelCallWithSession).not.toHaveBeenCalled();
+    });
+    it('sends --limit as a NUMBER and refuses a non-numeric one', async () => {
+        await runOutcomeList('KR-1', { limit: '25' });
+        expect(kernelCall.mock.calls[0][1].limit).toBe(25);
+        vi.clearAllMocks();
+        getConfigOrGuide.mockResolvedValue({ apiKey: 'k', siteUrl: 's' });
+        await expect(runOutcomeList('KR-1', { limit: 'many' })).rejects.toThrow(/limit/i);
+        expect(kernelCall).not.toHaveBeenCalled();
+    });
+});
+describe('formatReadingsList — the rendering §8.2 specifies', () => {
+    const row = (over = {}) => ({
+        readingId: 'rd_1', value: 62, asOf: Date.parse('2026-03-01'), recordedAt: Date.parse('2026-03-01'),
+        kind: 'measurement', actorKind: 'person', ...over,
+    });
+    it('shows a superseded row AND names what replaced it', () => {
+        // The ledger is append-only and the correction chain IS the audit trail, so a superseded
+        // row is never hidden — it is marked, so a reader does not mistake it for the current value.
+        const out = formatReadingsList('KR-S1', {
+            entryDocId: 'e', pageExhausted: true,
+            readings: [row({ readingId: 'rd_2', value: 70 }), row({ supersededByReadingId: 'rd_2' })],
+        });
+        expect(out).toContain('superseded by rd_2');
+        expect(out).toContain('rd_1');
+        expect(out).toContain('2 reading(s)');
+    });
+    it('prints the readingId on every row — the id --corrects needs must be reachable from list', () => {
+        // This is the defect the S2 live walk found: without a printed id there is no way to name
+        // the reading a correction replaces, and --corrects is unusable.
+        const out = formatReadingsList('KR-S1', { entryDocId: 'e', pageExhausted: true, readings: [row()] });
+        expect(out).toContain('rd_1');
+    });
+    it('says so when the page is NOT exhausted, rather than reading as the whole history', () => {
+        const bounded = formatReadingsList('KR-S1', { entryDocId: 'e', pageExhausted: false, readings: [row()] });
+        expect(bounded).toContain('older readings not loaded');
+        const whole = formatReadingsList('KR-S1', { entryDocId: 'e', pageExhausted: true, readings: [row()] });
+        expect(whole).not.toContain('older readings not loaded');
+    });
+    it('renders the honest empty case, not an error', () => {
+        expect(formatReadingsList('KR-S2', { entryDocId: 'e', pageExhausted: true, readings: [] }))
+            .toBe('No readings recorded on KR-S2 yet.');
+    });
+    // PR #872 review round 3 (Codex P2): a legacy row written through the existing API route
+    // (validated only with v.number()) can carry a finite-but-Date-invalid asOf (e.g. 1e100).
+    // `new Date(x).toISOString()` throws RangeError for it — pre-fix, that propagated out of the
+    // `.map()` and killed `pb outcome list` entirely over one malformed row. Mirrors the MCP
+    // tool's own safeDateSlice fix (same PR).
+    it('renders a malformed out-of-range asOf as a fallback instead of throwing', () => {
+        const out = formatReadingsList('KR-S1', { entryDocId: 'e', pageExhausted: true, readings: [row({ asOf: 1e100 })] });
+        expect(out).toContain('invalid-date');
+    });
+});
+describe('formatReadingsList sanitises stored, agent-written content (PR #840 security review)', () => {
+    // The threat model is specific: an AGENT writes `note`/`valueText` through
+    // `outcomes.recordReading`, a HUMAN reads them in a terminal, and this rendering IS the audit
+    // view. Injected newlines do not just look untidy — they forge extra rows in the one surface
+    // someone would use to check the rows.
+    const row = (over = {}) => ({
+        readingId: 'rd_1', value: 62, asOf: Date.parse('2026-03-01'), recordedAt: Date.parse('2026-03-01'),
+        kind: 'measurement', actorKind: 'person', ...over,
+    });
+    const render = (over) => formatReadingsList('KR-S1', { entryDocId: 'e', pageExhausted: true, readings: [row(over)] });
+    it('a note with embedded newlines cannot forge extra reading lines', () => {
+        const out = render({ note: 'ok\n  2026-03-02      999  [measurement]  rd_FORGED' });
+        // One reading in, one rendered line out (plus the header) — the forged row is folded in.
+        expect(out.split('\n')).toHaveLength(2);
+        expect(out).not.toMatch(/\n\s+2026-03-02/);
+        expect(out).toContain('rd_FORGED'); // the TEXT survives; only its line-breaking power is removed
+    });
+    it('a carriage return cannot overwrite the rendered line', () => {
+        // \r alone redraws over what was printed — a note ending in \r plus spaces can blank the
+        // real value on a real terminal without adding a line at all.
+        const out = render({ note: 'benign\rSAFE — nothing to see' });
+        expect(out).not.toContain('\r');
+    });
+    it('CSI/OSC escape sequences are stripped, not passed to the terminal', () => {
+        const esc = String.fromCharCode(27);
+        const out = render({ note: `${esc}[31m${esc}[2Jred${esc}[0m`, valueText: `${esc}]0;pwned${esc}\\` });
+        expect(out).not.toContain(esc);
+    });
+    it('valueText is sanitised too — it is stored and agent-written, exactly like note', () => {
+        const out = render({ valueText: 'a\nb' });
+        expect(out.split('\n')).toHaveLength(2);
+    });
+    it('ordinary content still renders unchanged', () => {
+        // The sanitiser must not damage the normal case, or it will be removed by someone later.
+        expect(render({ note: 'from the weekly dashboard', valueText: '~62%' }))
+            .toContain('("~62%")');
+        expect(render({ note: 'from the weekly dashboard' })).toContain('from the weekly dashboard');
+    });
+});
+describe('formatOutcomeShow — the two honesty rules', () => {
+    const base = {
+        entryId: 'KR-S1', name: 'Weekly signups', readyToCloseInstruction: null,
+        outcome: {
+            currentResolution: 'no-rows', hasNoReadings: true, direction: 'up-is-good',
+            state: 'overdue', completion: 'open', completionProvenance: 'none',
+            readyToClose: null, ownerRole: null, reporterRole: null,
+            readingCount: 0, unit: null,
+        },
+        objective: null, objectiveLookup: 'none',
+    };
+    const show = (over = {}) => formatOutcomeShow({ ...base, outcome: { ...base.outcome, ...over } });
+    it('a never-measured key result shows a BLANK, never 0%', () => {
+        // `0%` reads as a measurement. The blank is the honest answer and the distinction is the
+        // whole reason progressPct is undefined rather than zero.
+        const out = show();
+        expect(out).toContain('no readings yet');
+        expect(out).not.toContain('0%');
+        expect(out).toContain('never read');
+    });
+    it('a genuine zero reading DOES render as 0% — the other half of that distinction', () => {
+        expect(show({ current: { value: 0, asOf: Date.now() }, currentResolution: 'found', hasNoReadings: false, progressPct: 0, readingCount: 1 }))
+            .toContain('0%');
+    });
+    // PR #872 review round 3 (Codex P2): mirrors formatReadingsList's own safeDateSlice fix — a
+    // malformed stored nextDueAt must render a fallback, never throw RangeError.
+    it('renders a malformed out-of-range nextDueAt as a fallback instead of throwing', () => {
+        expect(show({ nextDueAt: 1e100 })).toContain('invalid-date');
+    });
+    it('the recorded completion is never called confirmed or verified', () => {
+        // Nothing in this run verifies a close. A surface implying otherwise is the failure the
+        // provenance field exists to prevent.
+        const out = show({ completion: 'achieved', completionProvenance: 'legacy-data-status' });
+        expect(out).toContain('recorded as achieved');
+        expect(out).toContain('legacy-data-status');
+        expect(out.toLowerCase()).not.toContain('confirmed');
+        expect(out.toLowerCase()).not.toContain('verified');
+    });
+    it('TASK-754: prints no attestation tier line', () => {
+        const out = show({});
+        expect(out).not.toMatch(/attestation|weakest|role_click|agent_same_session|agent_cross_session|provenance_unknown/);
+    });
+    it('a deleted role renders as gone, not as a blank and not as an id', () => {
+        const out = show({ ownerRole: { id: 'q97abc', name: null }, reporterRole: { id: 'q97def', name: 'Data Steward' } });
+        expect(out).toContain('a role that no longer exists');
+        expect(out).toContain('Data Steward');
+    });
+    it('carries the close instruction verbatim when there is a proposal', () => {
+        const out = formatOutcomeShow({
+            ...base, readyToCloseInstruction: 'The readings say this is achieved. Surface this to the founder; do not write the status yourself.',
+            outcome: { ...base.outcome, readyToClose: 'achieved' },
+        });
+        expect(out).toContain('do not write the status yourself');
+    });
+    // TASK-817 (WP-818): the same lines the MCP context action=outcome prints (one generated renderer).
+    it('names its objective and sibling key results, and how many more are hidden', () => {
+        const out = formatOutcomeShow({
+            ...base,
+            objective: { entryId: 'OBJ-3', name: 'Make the product trustworthy', hiddenSiblings: 1, truncated: true, siblings: [{ entryId: 'KR-7', name: 'Automated checks', currentValue: 12, targetValue: 40, readingUnresolved: false }] },
+            objectiveLookup: 'found',
+        });
+        expect(out).toContain('  objective   OBJ-3 — Make the product trustworthy');
+        expect(out).toContain('  siblings    KR-7 — Automated checks (current 12, target 40)');
+        expect(out).toContain('              and at least 1 more not shown');
+        expect(show()).toContain('  objective   none: no accepted objective holds this entry');
+    });
+    it('page-exhausted is called out rather than passing as never-read', () => {
+        expect(show({ currentResolution: 'page-exhausted', hasNoReadings: false }))
+            .toContain('this is not "never read"');
+    });
+});
+describe('formatOutcomeShow sanitises EVERY stored string sink (PR #840 review round 2)', () => {
+    // Round 1 I sanitised the fields I interpolated directly and missed `role.name`, which sits
+    // behind a helper. So this guard is STRUCTURAL rather than per-field: it drives control
+    // characters through every string-typed input at once and asserts on the SHAPE of the output,
+    // which means the next stored field someone adds is covered without anyone remembering to
+    // extend this test.
+    const ESC = String.fromCharCode(27);
+    const NASTY = `x${ESC}[31m\n  FORGED LINE\rover`;
+    it('no control characters and no injected lines, whatever the stored content says', () => {
+        const out = formatOutcomeShow({
+            entryId: NASTY, name: NASTY,
+            readyToCloseInstruction: null,
+            outcome: {
+                current: { value: 1, asOf: Date.now() }, currentResolution: 'found', hasNoReadings: false,
+                direction: 'up-is-good', progressPct: 10, state: 'on-time',
+                completion: 'open', completionProvenance: 'none', readyToClose: null,
+                ownerRole: { id: 'q1', name: NASTY },
+                reporterRole: { id: 'q2', name: NASTY },
+                readingCount: 1, unit: NASTY,
+            },
+            objective: { entryId: NASTY, name: NASTY, hiddenSiblings: 0, truncated: false, siblings: [{ entryId: NASTY, name: NASTY, currentValue: 1, targetValue: 2, readingUnresolved: false }] },
+            objectiveLookup: 'found',
+        });
+        expect(out).not.toContain(ESC);
+        expect(out).not.toContain('\r');
+        // The renderer emits a fixed number of lines; injected newlines would add more.
+        const lineCount = out.split('\n').length;
+        expect(lineCount).toBe(11); // 9 + the objective and one sibling (TASK-817); TASK-754 dropped the attestation line
+        // And no line may begin with the injected text — that is what "looks like another field" means.
+        expect(out.split('\n').every((l) => !l.startsWith('FORGED'))).toBe(true);
+    });
+    it('a role name specifically cannot inject a line — the round-2 miss', () => {
+        const out = formatOutcomeShow({
+            entryId: 'KR-S1', name: 'ok', readyToCloseInstruction: null,
+            outcome: {
+                currentResolution: 'no-rows', hasNoReadings: true, direction: 'undetermined',
+                state: 'overdue', completion: 'open', completionProvenance: 'none', readyToClose: null,
+                ownerRole: { id: 'q1', name: 'Data Steward\n  reporter    Someone Else' },
+                reporterRole: null, readingCount: 0, unit: null,
+            },
+            objective: null, objectiveLookup: 'none',
+        });
+        // Exactly one line that IS the reporter field, not two. The forged text survives as text on
+        // the owner line (which is correct — nothing is censored) but has lost its line-breaking
+        // power, so it can no longer masquerade as a field of its own.
+        expect(out.split('\n').filter((l) => l.trim().startsWith('reporter')).length).toBe(1);
+        expect(out).toContain('Someone Else'); // the content is preserved, only its framing is removed
+    });
+});
+//# sourceMappingURL=outcome.test.js.map