@productbrain/cli 0.1.0-beta.14 → 0.1.0-beta.14010

package/README.md

@@ -1,167 +1,139 @@
 # Product Brain CLI (`pb`)
 
-CLI for Chain knowledge: read, search, gather context, and **write back**. Uses your Product Brain API key (same as MCP). Write commands require a readwrite key.
+Chain knowledge + write-back in the terminal. Read, search, capture, and update your product knowledge graph.
 
-**Requirements:** Node 18+, API key from Product Brain → Settings → API Keys (`pb_sk_*`).
-
----
+**Requirements:** Node 18+, and an API key from Product Brain Settings, API Keys.
 
 ## Install
 
-### From npm (beta)
-
 ```bash
 npm install -g @productbrain/cli@beta
 ```
 
-Updates require a new publish to npm (and, if you use 2FA, a one-time password). Use this when you want a stable beta from the registry.
-
-### From main (no publish needed)
-
-If you have the repo and want **latest from `main`** without publishing to npm:
+From source (latest main):
 
 ```bash
 git clone https://github.com/synergyai-os/Product-OS.git
-cd Product-OS
-npm ci
+cd Product-OS && npm ci
 cd packages/cli && npm run build && npm install -g .
 ```
 
-After that, `pb` runs from your global path. Pull and re-run the last two commands to update:
+## Login
 
 ```bash
-cd Product-OS && git pull && cd packages/cli && npm run build && npm install -g .
+pb login
 ```
 
-See [Deployment strategy — CLI vs MCP](../../docs/deployment-strategy.md#cli-vs-mcp-distribution) for why this avoids `cli:publish` / OTP.
-
----
-
-## First run
-
-- **No key yet:** Run any command (e.g. `pb orient -b`). You’ll get a short guided flow: “Do you have an API key? (y/n)” → paste key → saved to `~/.config/productbrain/.env`. Your command then runs.
-- **Or:** Run `pb login` to paste and save your key once. Get a key: Product Brain app → Settings → API Keys.
-
-Config is read from (in order): env vars → `~/.config/productbrain/.env` → `.env.mcp` in the current directory.
+Paste your API key (it starts pb_sk_, or pb_agent_ for an AI agent). Saved to `~/.config/productbrain/.env`.
 
----
+Or run any command without a key and follow the guided flow.
 
-## Commands
-
-### Read (no session required)
-
-| Command | Description |
-|--------|-------------|
-| `pb orient` | Workspace stage, bets, governance, tensions. Use `-b` for a brief view. |
-| `pb search <query>` | Full-text search across the Chain. |
-| `pb get <entry-id>` | Full entry (data, relations, last 10 history events). |
-| `pb context <entry-id>` | Constellation context (pipe-friendly markdown when not a TTY). |
-| `pb handshake` | Generate context files for AI developer tools. See below. |
-| `pb login` | Save your API key to `~/.config/productbrain/.env`. |
+### Onboarding link (`pb connect`)
 
-**Internal (Product-OS repo only):** `pb brand-pack` forwards to `scripts/brand-pack.mjs` — structured community marketing JSON via **OpenRouter** (`OPENROUTER_API_KEY`, not the Product Brain API key). Use `npm run brand-pack -- --help` from repo root for script options. Not published behavior for global npm installs unless built from this monorepo.
+If you received a connect token (`pb_ct_...`) from Product Brain:
 
-### Write (session required — DEC-9)
+```bash
+pb connect pb_ct_...
+```
 
-| Command | Description |
-|--------|-------------|
-| `pb session start` | Open a tracked write session. Refreshes context files. |
-| `pb capture "<text>"` | Capture a decision, tension, insight, or any knowledge to the Chain. Auto-classifies. |
-| `pb session close` | Close the session. Shows captured entries, runs wrapup, refreshes context. |
+Redemption always targets a cloud Convex deployment (HTTP Actions are cloud-hosted, even during local dev). Resolution order: `--gateway` → `PB_CONNECT_GATEWAY_URL` → `CONVEX_SITE_URL` → production default (`gateway.productbrain.io`).
 
-`pb --help` for options.
+- **Dev deployments:** Set `CONVEX_SITE_URL` to your `*.convex.site` URL, or use `--gateway`.
+- If a token fails, the CLI hints about setting `CONVEX_SITE_URL` or using `--gateway`.
 
-### Delivery + Chain (when you ship code in Product-OS)
+## Quick Start
 
-Progressive delivery and deploy ordering are documented in the monorepo — not inside the `pb` binary:
+```bash
+# 1. Check your setup
+pb doctor
 
-| SSOT | Purpose |
-|------|---------|
-| [`docs/system/design/progressive-delivery-thesis.md`](../../docs/system/design/progressive-delivery-thesis.md) | Ladder (dark launch → GA), rollback (**STA-10**), flags, edge/Cloudflare notes |
-| **MAP-13** on the Chain | Map entry pointing at the thesis — `pb get MAP-13` / `pb context MAP-13` |
-| [`docs/deployment-strategy.md`](../../docs/deployment-strategy.md) | CI target, Convex vs Railway, CLI vs MCP distribution |
+# 2. Orient — see where things stand
+pb orient -b
 
-**BR-157:** If your push includes changes under `convex/`, run **`npx convex deploy`** (correct deployment) **before** `git push origin main` so Railway never serves a frontend that calls missing Convex functions.
+# 3. Read an entry
+pb get BET-123
 
-**Typical ship loop with `pb`:**
+# 4. Search the Chain
+pb search "onboarding flow"
 
-```bash
+# 5. Start a write session and capture knowledge
 pb session start
-# … commit, merge, push per .productbrain/skills/commit-to-main …
-pb capture "DEC: Shipped <short>. Rollback: <flag OFF | Railway revert | …>. Convex deploy before push: <yes | N/A>."
+pb capture "DEC: chose X because Y"
+pb capture "TEN: blocked by missing API"
 pb session close
-# If you changed .productbrain rules or skills:
-cd ../.. && pb handshake   # from repo root
-```
-
----
-
-## `pb handshake` — AI Developer Onboarding
-
-One command generates context files for every major AI coding tool:
-
-```bash
-pb handshake
 ```
 
-**What it generates:**
+Running `pb` with no arguments shows contextual guidance based on your setup state.
 
-| File | Purpose |
-|------|---------|
-| `.productbrain/context.md` | Workspace briefing — stage, bets, governance, architecture, tensions |
-| `.productbrain/briefing.md` | Chain entries matched to this specific repo |
-| `CLAUDE.md` | Adapter for Claude Code |
-| `.cursor/rules/chain.mdc` | Adapter for Cursor |
-| `.github/copilot-instructions.md` | Adapter for GitHub Copilot |
-
-**Options:**
-
-- `--force` — Overwrite adapter files even if they have custom content
-- `--dry-run` — Preview what would be generated without writing files
+## Commands
 
-**Safety:** Adapter files are marked with `auto-generated by pb handshake`. If you customize one and remove the marker, future runs skip it (unless `--force`). The `.productbrain/` directory contains workspace-specific context and should be in `.gitignore`.
+### Read (no session required)
 
-**Governance:** Context export surface per DEC-161 and GLO-63. Architecture: ARCH-63 (surfaces are peers consuming the kernel).
+| Command | Description |
+|---------|-------------|
+| `pb orient [-b]` | Workspace overview. `-b` for brief, `--task` for task-grounded context. |
+| `pb get <id>` | Full entry: data, relations, history. |
+| `pb search <query>` | Full-text search across all collections. |
+| `pb context <id>` | Constellation context for an entry. |
+| `pb fields <collection>` | Field definitions for a collection. |
+| `pb constellation <id>` | Entry + all related entries grouped by relation type. |
+| `pb collections list` | All collections with field counts. |
+| `pb glossary` | Key Product Brain CLI terms. |
+| `pb scoreboard [--json]` | Flywheel health board: M3/M4 metrics, coherence and diagnosis. `--json` for the structured agent shape. |
+| `pb doctor` | Check configuration and connectivity. |
+
+### Write (session required)
 
----
+| Command | Description |
+|---------|-------------|
+| `pb session start` | Open a tracked write session. |
+| `pb capture "<text>"` | Capture knowledge. Auto-classifies to the right collection. |
+| `pb update <id>` | Update fields on an existing entry. |
+| `pb relate <from> <type> <to>` | Add a typed relation between entries. |
+| `pb entry accept <id>` | Accept a draft entry onto the Chain. With `--replaces <old-id>` it replaces that accepted entry, and `--reason` is required: one line, at most 200 characters. |
+| `pb entry discard <id> [--reason <text>]` | Discard a draft or current entry; `--reason` is free text in its history note. |
+| `pb entry resolve <id> [--reason <text>]` | Resolve a current entry (moves to Past); `--reason` goes in its history note and is required for an accepted decision or rule: one line, at most 200 characters. |
+| `pb entry replace <old-id> <new-id> --reason <text>` | Replace an accepted entry with another accepted one of its kind; the old one is archived and reads Replaced by the new one. `--reason` is required: one line, at most 200 characters. |
+| `pb session close` | Close session, show summary. |
 
-## `pb session` + `pb capture` — Close the Loop
+A checklist field (for example `doneWhen`) takes one item per flag: `pb capture "WP: title" -f doneWhen="first" -f doneWhen="second"`. The server mints the item ids. On `pb update` the flags replace the list; an item whose text is unchanged keeps its tick.
 
-The Chain compounds from every AI coding session. Instead of knowledge dying in chat transcripts (TEN-27), capture it as you work.
+### Profile Management
 
-### Flow
+Config is read from (in order): environment variables, `~/.config/productbrain/.env`, `.env.mcp` in the current directory.
 
 ```bash
-# Start of session
-pb session start          # opens session, refreshes context
+pb login          # Save API key
+pb doctor         # Verify configuration
+pb setup          # Guided first-time setup
+```
 
-# During work — capture what you learn
-pb capture "TEN: topology query returns stale containers when initiatives are archived"
-pb capture "DEC: excluded archived initiatives at the query level, not the UI filter"
-pb capture "INS: learned that the containerIds array references soft-deleted entries"
+### AI Developer Onboarding
 
-# End of session
-pb session close          # shows summary, runs wrapup, refreshes context
+```bash
+pb init             # Install the Claude Code session hooks in this repo
+pb init --dry-run   # Print what it would add, write nothing
+pb init --client codex   # Also write this tool's hook (claude, codex or cursor) in a folder without its files
 ```
 
-### How capture works
+Merges a SessionStart hook (`pb session start`), a SessionEnd hook (`pb session close`) and the `Bash(pb:*)` permission into `.claude/settings.json`, so each Claude Code session opens with your workspace briefing. Running it again adds nothing. Other agents read the Chain live through `pb` or the MCP server; no context files are generated.
 
-1. Text is sent to the Chain's classification pipeline — auto-assigns collection
-2. Entry is created as a **draft** (nothing auto-commits)
-3. Receipt shows: entry ID, collection, confidence, reasoning, alternatives
-4. You review and commit drafts in Product Brain Studio
+## Output Modes
 
-### Options
+WP-744 / 1e-B: piping alone no longer switches modes — the human-readable card is the default
+in every shell, TTY or not. Ask for JSON explicitly.
 
-- `pb capture --collection tensions "text"` — skip auto-classification, use explicit collection
-- `pb capture --name "Short title" --description "Full explanation"` — separate name and description
-- `pb session close --force` — clear local session state even if server close fails
+| Context | Output |
+|---------|--------|
+| TTY (terminal) | Human-readable formatting |
+| Piped / non-TTY (no flag, `PB_JSON` unset) | Human-readable formatting |
+| `PB_JSON=1` | JSON |
+| `--json` | Force JSON |
+| `--pretty` | Force human-readable |
 
-### Governance
+## Reference
 
-- Write access requires a tracked session (DEC-9, BR-8)
-- Session attribution via API key; `clientKind: 'cli'` discriminator per DEC-184 (pending schema extension)
-- All captures are drafts — human reviews and commits (TEN-374)
-- Solves TEN-264 (CLI write access session attribution) with explicit session token in `.productbrain/session.json`
-- Addresses TEN-27 (strategic conversations generate decisions that never reach the Chain)
-- Implements INS-80 (proactive capture during coding)
+- `pb --help` for full command list
+- `pb <command> --help` for command-specific options
+- `pb glossary` for key terms
+- Chain: WP-302 (CLI Maturity)

package/dist/__tests__/adminConfig.test.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Tests for resolveAdminConfig() — WP-681 (WP-679).
+ *
+ * Live-reproduced bug: `pb admin run` (and every other `pb admin ...` command) resolved via
+ * resolveAdminConfig(), which read ONLY shell env vars then the GLOBAL active profile —
+ * skipping the repo's own `.productbrain/config.local.json` `profile` pin entirely. A repo
+ * explicitly pinned to a dev-scoped profile (`pb profile use --local <dev-profile>`) still
+ * silently dispatched every admin command through the operator's global profile instead — which
+ * defaults to production — sending a dev-only workspace id to prod and surfacing an opaque
+ * Convex ArgumentValidationError instead of an actionable "wrong deployment" signal.
+ *
+ * Mirrors config.test.ts's mocking pattern (mocked ../lib/profiles.js + mocked os.homedir) —
+ * kept in its own file because config.test.ts is already grandfathered over the 500-LOC
+ * module-health budget and resolveAdminConfig() itself lives in its own leaf module
+ * (adminConfig.ts) for the same reason.
+ */
+export {};
+//# sourceMappingURL=adminConfig.test.d.ts.map

package/dist/__tests__/adminConfig.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"adminConfig.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/adminConfig.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG"}

package/dist/__tests__/adminConfig.test.js

@@ -0,0 +1,221 @@
+/**
+ * Tests for resolveAdminConfig() — WP-681 (WP-679).
+ *
+ * Live-reproduced bug: `pb admin run` (and every other `pb admin ...` command) resolved via
+ * resolveAdminConfig(), which read ONLY shell env vars then the GLOBAL active profile —
+ * skipping the repo's own `.productbrain/config.local.json` `profile` pin entirely. A repo
+ * explicitly pinned to a dev-scoped profile (`pb profile use --local <dev-profile>`) still
+ * silently dispatched every admin command through the operator's global profile instead — which
+ * defaults to production — sending a dev-only workspace id to prod and surfacing an opaque
+ * Convex ArgumentValidationError instead of an actionable "wrong deployment" signal.
+ *
+ * Mirrors config.test.ts's mocking pattern (mocked ../lib/profiles.js + mocked os.homedir) —
+ * kept in its own file because config.test.ts is already grandfathered over the 500-LOC
+ * module-health budget and resolveAdminConfig() itself lives in its own leaf module
+ * (adminConfig.ts) for the same reason.
+ */
+import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest';
+import { mkdirSync, writeFileSync } from 'fs';
+import { resolve } from 'path';
+import { tmpdir } from 'os';
+import { randomUUID } from 'crypto';
+vi.mock('../lib/profiles.js', () => ({
+    resolveProfileConfig: vi.fn(() => null),
+    resolveNamedProfileConfig: vi.fn(() => null),
+    getGlobalActiveProfile: vi.fn(() => null),
+}));
+vi.mock('os', async (importOriginal) => {
+    const actual = await importOriginal();
+    return {
+        ...actual,
+        homedir: vi.fn(() => '/tmp/pb-test-fake-home-' + process.pid),
+    };
+});
+describe('resolveAdminConfig()', () => {
+    let tempDir;
+    const originalCwd = process.cwd;
+    const savedEnv = {};
+    const envKeys = ['PRODUCTBRAIN_API_KEY', 'CONVEX_SITE_URL', 'PB_PROFILE'];
+    beforeEach(() => {
+        vi.resetAllMocks();
+        for (const key of envKeys) {
+            savedEnv[key] = process.env[key];
+            delete process.env[key];
+        }
+        tempDir = resolve(tmpdir(), `pb-admin-config-test-${randomUUID()}`);
+        mkdirSync(tempDir, { recursive: true });
+        process.cwd = () => tempDir;
+    });
+    afterEach(() => {
+        for (const key of envKeys) {
+            if (savedEnv[key] !== undefined)
+                process.env[key] = savedEnv[key];
+            else
+                delete process.env[key];
+        }
+        process.cwd = originalCwd;
+    });
+    it('honors a repo-local profile PIN over the global active profile', async () => {
+        const { resolveNamedProfileConfig, resolveProfileConfig } = await import('../lib/profiles.js');
+        // Local pin resolves to a dev-scoped profile...
+        resolveNamedProfileConfig.mockReturnValueOnce({
+            apiKey: 'pb_sk_dev_pinned_key',
+            siteUrl: 'https://trustworthy-kangaroo-277.convex.site',
+        });
+        // ...while the GLOBAL active profile (what the old code used exclusively) is prod.
+        resolveProfileConfig.mockReturnValueOnce({
+            apiKey: 'pb_sk_global_prod_key',
+            siteUrl: 'https://gateway.productbrain.io',
+        });
+        const pbDir = resolve(tempDir, '.productbrain');
+        mkdirSync(pbDir, { recursive: true });
+        writeFileSync(resolve(pbDir, 'config.local.json'), JSON.stringify({ profile: 'product-brain' }));
+        const { resolveAdminConfig } = await import('../lib/adminConfig.js');
+        const result = resolveAdminConfig();
+        expect(result.apiKey).toBe('pb_sk_dev_pinned_key');
+        expect(result.siteUrl).toBe('https://trustworthy-kangaroo-277.convex.site');
+        expect(result.source).toBe('local-profile');
+        expect(result.profileName).toBe('product-brain');
+    });
+    it('falls back to the global active profile when no repo-local pin exists', async () => {
+        const { resolveProfileConfig } = await import('../lib/profiles.js');
+        resolveProfileConfig.mockReturnValueOnce({
+            apiKey: 'pb_sk_global_key',
+            siteUrl: 'https://gateway.productbrain.io',
+            profileName: 'randy-s-pkm',
+        });
+        const { resolveAdminConfig } = await import('../lib/adminConfig.js');
+        const result = resolveAdminConfig();
+        expect(result.apiKey).toBe('pb_sk_global_key');
+        expect(result.source).toBe('global-profile');
+        expect(result.profileName).toBe('randy-s-pkm');
+    });
+    it('review fix (P2): reports the profile that ACTUALLY resolved, not the active-profile FILE name, when resolveProfileConfig() itself fell through past it', async () => {
+        // resolveProfileConfig() (profiles.ts) can fall through its OWN precedence — e.g. past a
+        // missing/invalid global active profile to its "default" profile, or honor a PB_PROFILE
+        // override — and its return now carries the name that ACTUALLY resolved. Before this fix,
+        // resolveAdminConfig() ignored that and called getGlobalActiveProfile() separately, which
+        // would have reported the (irrelevant, possibly stale) active-profile FILE name instead.
+        const { resolveProfileConfig } = await import('../lib/profiles.js');
+        resolveProfileConfig.mockReturnValueOnce({
+            apiKey: 'pb_sk_default_key',
+            siteUrl: 'https://gateway.productbrain.io',
+            profileName: 'default', // NOT the (broken/stale) global active-profile file's name.
+        });
+        const { resolveAdminConfig } = await import('../lib/adminConfig.js');
+        const result = resolveAdminConfig();
+        expect(result.apiKey).toBe('pb_sk_default_key');
+        expect(result.profileName).toBe('default');
+    });
+    it('shell env vars still win over a repo-local pin', async () => {
+        process.env.PRODUCTBRAIN_API_KEY = 'pb_sk_env_key';
+        process.env.CONVEX_SITE_URL = 'https://env.example.com';
+        const pbDir = resolve(tempDir, '.productbrain');
+        mkdirSync(pbDir, { recursive: true });
+        writeFileSync(resolve(pbDir, 'config.local.json'), JSON.stringify({ profile: 'product-brain' }));
+        const { resolveAdminConfig } = await import('../lib/adminConfig.js');
+        const result = resolveAdminConfig();
+        expect(result.apiKey).toBe('pb_sk_env_key');
+        expect(result.source).toBe('env');
+        expect(result.profileName).toBeNull();
+    });
+    it('never reads config.json siteUrl (only config.local.json profile) — TEN-1334 stays intact for the committed project gateway', async () => {
+        const { resolveNamedProfileConfig } = await import('../lib/profiles.js');
+        resolveNamedProfileConfig.mockReturnValueOnce({
+            apiKey: 'pb_sk_pinned_key',
+            // No siteUrl on the pin itself — this must NOT fall through to config.json's siteUrl.
+        });
+        const pbDir = resolve(tempDir, '.productbrain');
+        mkdirSync(pbDir, { recursive: true });
+        writeFileSync(resolve(pbDir, 'config.json'), JSON.stringify({ siteUrl: 'https://trustworthy-kangaroo-277.convex.site' }));
+        writeFileSync(resolve(pbDir, 'config.local.json'), JSON.stringify({ profile: 'product-brain' }));
+        const { resolveAdminConfig } = await import('../lib/adminConfig.js');
+        const result = resolveAdminConfig();
+        expect(result.apiKey).toBe('pb_sk_pinned_key');
+        // Falls back to DEFAULT_SITE_URL (production), never the committed dev gateway.
+        expect(result.siteUrl).toBe('https://gateway.productbrain.io');
+    });
+    it('throws AUTH_MISSING when no credential resolves anywhere', async () => {
+        const { resolveAdminConfig } = await import('../lib/adminConfig.js');
+        expect(() => resolveAdminConfig()).toThrow(/^No API key configured\.$/);
+    });
+    it('review fix (P1): FAILS CLOSED on a dangling repo-local pin — never silently falls back to the global active profile', async () => {
+        // The pin names a profile, but resolveNamedProfileConfig() finds nothing (deleted profile
+        // file, or one with no valid key) — mirrors TEN-2163's masking bug, but for a destructive
+        // admin op instead of `pb whoami`: falling through here could retarget the command at a
+        // completely different deployment (prod) despite an explicit repo pin saying otherwise.
+        const { resolveNamedProfileConfig, resolveProfileConfig } = await import('../lib/profiles.js');
+        resolveNamedProfileConfig.mockReturnValueOnce(null);
+        // A perfectly valid global profile exists — it must NEVER be silently used as a fallback.
+        resolveProfileConfig.mockReturnValueOnce({
+            apiKey: 'pb_sk_global_prod_key',
+            siteUrl: 'https://gateway.productbrain.io',
+            profileName: 'randy-s-pkm',
+        });
+        const pbDir = resolve(tempDir, '.productbrain');
+        mkdirSync(pbDir, { recursive: true });
+        writeFileSync(resolve(pbDir, 'config.local.json'), JSON.stringify({ profile: 'deleted-profile' }));
+        const { resolveAdminConfig } = await import('../lib/adminConfig.js');
+        const { ConfigResolutionError } = await import('../lib/configResult.js');
+        try {
+            resolveAdminConfig();
+            expect.fail('expected dangling pin to refuse');
+        }
+        catch (error) {
+            expect(error).toBeInstanceOf(ConfigResolutionError);
+            expect(error.kind).toBe('profile-pin');
+            expect(error.message).toMatch(/pinned to profile "deleted-profile"/);
+        }
+    });
+    it('does not consume preview or local-binding keys from config.local.json', async () => {
+        const { resolveProfileConfig } = await import('../lib/profiles.js');
+        resolveProfileConfig.mockReturnValueOnce({
+            apiKey: 'pb_sk_global_key',
+            siteUrl: 'https://gateway.productbrain.io',
+            profileName: 'randy-s-pkm',
+        });
+        const pbDir = resolve(tempDir, '.productbrain');
+        mkdirSync(pbDir, { recursive: true });
+        writeFileSync(resolve(pbDir, 'config.local.json'), JSON.stringify({
+            preview: true,
+            apiKey: 'pb_sk_preview_key',
+            siteUrl: 'https://preview.example.com',
+        }));
+        const { resolveAdminConfig } = await import('../lib/adminConfig.js');
+        const result = resolveAdminConfig();
+        expect(result.apiKey).toBe('pb_sk_global_key');
+        expect(result.source).toBe('global-profile');
+        expect(result.siteUrl).toBe('https://gateway.productbrain.io');
+    });
+    it('does not fall through to preview or local-binding keys when no global profile exists', async () => {
+        const pbDir = resolve(tempDir, '.productbrain');
+        mkdirSync(pbDir, { recursive: true });
+        writeFileSync(resolve(pbDir, 'config.local.json'), JSON.stringify({
+            preview: true,
+            apiKey: 'pb_sk_preview_key',
+            siteUrl: 'https://preview.example.com',
+        }));
+        const { resolveAdminConfig } = await import('../lib/adminConfig.js');
+        expect(() => resolveAdminConfig()).toThrow(/^No API key configured\.$/);
+    });
+    it('does not read a CWD .env file for the admin credential', async () => {
+        const { resolveProfileConfig } = await import('../lib/profiles.js');
+        resolveProfileConfig.mockReturnValueOnce({
+            apiKey: 'pb_sk_global_key',
+            siteUrl: 'https://gateway.productbrain.io',
+            profileName: 'randy-s-pkm',
+        });
+        writeFileSync(resolve(tempDir, '.env'), 'PRODUCTBRAIN_API_KEY=pb_sk_cwd_env_key\nCONVEX_SITE_URL=https://cwd-env.example.com\n');
+        const { resolveAdminConfig } = await import('../lib/adminConfig.js');
+        const result = resolveAdminConfig();
+        expect(result.apiKey).toBe('pb_sk_global_key');
+        expect(result.source).toBe('global-profile');
+        expect(result.siteUrl).toBe('https://gateway.productbrain.io');
+    });
+    it('does not read a CWD .env file when no global profile exists', async () => {
+        writeFileSync(resolve(tempDir, '.env'), 'PRODUCTBRAIN_API_KEY=pb_sk_cwd_env_key\nCONVEX_SITE_URL=https://cwd-env.example.com\n');
+        const { resolveAdminConfig } = await import('../lib/adminConfig.js');
+        expect(() => resolveAdminConfig()).toThrow(/^No API key configured\.$/);
+    });
+});
+//# sourceMappingURL=adminConfig.test.js.map

package/dist/__tests__/adminConfig.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"adminConfig.test.js","sourceRoot":"","sources":["../../src/__tests__/adminConfig.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AACzE,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,IAAI,CAAC;AAC9C,OAAO,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAC/B,OAAO,EAAE,MAAM,EAAE,MAAM,IAAI,CAAC;AAC5B,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAEpC,EAAE,CAAC,IAAI,CAAC,oBAAoB,EAAE,GAAG,EAAE,CAAC,CAAC;IACnC,oBAAoB,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;IACvC,yBAAyB,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;IAC5C,sBAAsB,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;CAC1C,CAAC,CAAC,CAAC;AAEJ,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE;IACrC,MAAM,MAAM,GAAG,MAAM,cAAc,EAAuB,CAAC;IAC3D,OAAO;QACL,GAAG,MAAM;QACT,OAAO,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,yBAAyB,GAAG,OAAO,CAAC,GAAG,CAAC;KAC9D,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,sBAAsB,EAAE,GAAG,EAAE;IACpC,IAAI,OAAe,CAAC;IACpB,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC;IAChC,MAAM,QAAQ,GAAuC,EAAE,CAAC;IACxD,MAAM,OAAO,GAAG,CAAC,sBAAsB,EAAE,iBAAiB,EAAE,YAAY,CAAC,CAAC;IAE1E,UAAU,CAAC,GAAG,EAAE;QACd,EAAE,CAAC,aAAa,EAAE,CAAC;QACnB,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;YAC1B,QAAQ,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACjC,OAAO,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC1B,CAAC;QACD,OAAO,GAAG,OAAO,CAAC,MAAM,EAAE,EAAE,wBAAwB,UAAU,EAAE,EAAE,CAAC,CAAC;QACpE,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACxC,OAAO,CAAC,GAAG,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC;IAC9B,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC,GAAG,EAAE;QACb,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;YAC1B,IAAI,QAAQ,CAAC,GAAG,CAAC,KAAK,SAAS;gBAAE,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;;gBAC7D,OAAO,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC/B,CAAC;QACD,OAAO,CAAC,GAAG,GAAG,WAAW,CAAC;IAC5B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gEAAgE,EAAE,KAAK,IAAI,EAAE;QAC9E,MAAM,EAAE,yBAAyB,EAAE,oBAAoB,EAAE,GAAG,MAAM,MAAM,CAAC,oBAAoB,CAAC,CAAC;QAC/F,gDAAgD;QAC/C,yBAAsD,CAAC,mBAAmB,CAAC;YAC1E,MAAM,EAAE,sBAAsB;YAC9B,OAAO,EAAE,8CAA8C;SACxD,CAAC,CAAC;QACH,mFAAmF;QAClF,oBAAiD,CAAC,mBAAmB,CAAC;YACrE,MAAM,EAAE,uBAAuB;YAC/B,OAAO,EAAE,iCAAiC;SAC3C,CAAC,CAAC;QAEH,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;QAChD,SAAS,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACtC,aAAa,CAAC,OAAO,CAAC,KAAK,EAAE,mBAAmB,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC;QAEjG,MAAM,EAAE,kBAAkB,EAAE,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;QACrE,MAAM,MAAM,GAAG,kBAAkB,EAAE,CAAC;QAEpC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;QACnD,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,8CAA8C,CAAC,CAAC;QAC5E,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QAC5C,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uEAAuE,EAAE,KAAK,IAAI,EAAE;QACrF,MAAM,EAAE,oBAAoB,EAAE,GAAG,MAAM,MAAM,CAAC,oBAAoB,CAAC,CAAC;QACnE,oBAAiD,CAAC,mBAAmB,CAAC;YACrE,MAAM,EAAE,kBAAkB;YAC1B,OAAO,EAAE,iCAAiC;YAC1C,WAAW,EAAE,aAAa;SAC3B,CAAC,CAAC;QAEH,MAAM,EAAE,kBAAkB,EAAE,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;QACrE,MAAM,MAAM,GAAG,kBAAkB,EAAE,CAAC;QAEpC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;QAC/C,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QAC7C,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wJAAwJ,EAAE,KAAK,IAAI,EAAE;QACtK,yFAAyF;QACzF,wFAAwF;QACxF,0FAA0F;QAC1F,0FAA0F;QAC1F,yFAAyF;QACzF,MAAM,EAAE,oBAAoB,EAAE,GAAG,MAAM,MAAM,CAAC,oBAAoB,CAAC,CAAC;QACnE,oBAAiD,CAAC,mBAAmB,CAAC;YACrE,MAAM,EAAE,mBAAmB;YAC3B,OAAO,EAAE,iCAAiC;YAC1C,WAAW,EAAE,SAAS,EAAE,4DAA4D;SACrF,CAAC,CAAC;QAEH,MAAM,EAAE,kBAAkB,EAAE,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;QACrE,MAAM,MAAM,GAAG,kBAAkB,EAAE,CAAC;QAEpC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;QAChD,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gDAAgD,EAAE,KAAK,IAAI,EAAE;QAC9D,OAAO,CAAC,GAAG,CAAC,oBAAoB,GAAG,eAAe,CAAC;QACnD,OAAO,CAAC,GAAG,CAAC,eAAe,GAAG,yBAAyB,CAAC;QAExD,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;QAChD,SAAS,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACtC,aAAa,CAAC,OAAO,CAAC,KAAK,EAAE,mBAAmB,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC;QAEjG,MAAM,EAAE,kBAAkB,EAAE,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;QACrE,MAAM,MAAM,GAAG,kBAAkB,EAAE,CAAC;QAEpC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QAC5C,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAClC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,QAAQ,EAAE,CAAC;IACxC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4HAA4H,EAAE,KAAK,IAAI,EAAE;QAC1I,MAAM,EAAE,yBAAyB,EAAE,GAAG,MAAM,MAAM,CAAC,oBAAoB,CAAC,CAAC;QACxE,yBAAsD,CAAC,mBAAmB,CAAC;YAC1E,MAAM,EAAE,kBAAkB;YAC1B,sFAAsF;SACvF,CAAC,CAAC;QAEH,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;QAChD,SAAS,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACtC,aAAa,CACX,OAAO,CAAC,KAAK,EAAE,aAAa,CAAC,EAC7B,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,8CAA8C,EAAE,CAAC,CAC5E,CAAC;QACF,aAAa,CAAC,OAAO,CAAC,KAAK,EAAE,mBAAmB,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC;QAEjG,MAAM,EAAE,kBAAkB,EAAE,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;QACrE,MAAM,MAAM,GAAG,kBAAkB,EAAE,CAAC;QAEpC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;QAC/C,gFAAgF;QAChF,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC;IACjE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0DAA0D,EAAE,KAAK,IAAI,EAAE;QACxE,MAAM,EAAE,kBAAkB,EAAE,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;QACrE,MAAM,CAAC,GAAG,EAAE,CAAC,kBAAkB,EAAE,CAAC,CAAC,OAAO,CAAC,2BAA2B,CAAC,CAAC;IAC1E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qHAAqH,EAAE,KAAK,IAAI,EAAE;QACnI,0FAA0F;QAC1F,0FAA0F;QAC1F,wFAAwF;QACxF,wFAAwF;QACxF,MAAM,EAAE,yBAAyB,EAAE,oBAAoB,EAAE,GAAG,MAAM,MAAM,CAAC,oBAAoB,CAAC,CAAC;QAC9F,yBAAsD,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC;QAClF,0FAA0F;QACzF,oBAAiD,CAAC,mBAAmB,CAAC;YACrE,MAAM,EAAE,uBAAuB;YAC/B,OAAO,EAAE,iCAAiC;YAC1C,WAAW,EAAE,aAAa;SAC3B,CAAC,CAAC;QAEH,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;QAChD,SAAS,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACtC,aAAa,CAAC,OAAO,CAAC,KAAK,EAAE,mBAAmB,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC;QAEnG,MAAM,EAAE,kBAAkB,EAAE,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;QACrE,MAAM,EAAE,qBAAqB,EAAE,GAAG,MAAM,MAAM,CAAC,wBAAwB,CAAC,CAAC;QAEzE,IAAI,CAAC;YACH,kBAAkB,EAAE,CAAC;YACrB,MAAM,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC;QACjD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,CAAC,cAAc,CAAC,qBAAqB,CAAC,CAAC;YACpD,MAAM,CAAE,KAAoD,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;YACvF,MAAM,CAAE,KAAe,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,qCAAqC,CAAC,CAAC;QAClF,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uEAAuE,EAAE,KAAK,IAAI,EAAE;QACrF,MAAM,EAAE,oBAAoB,EAAE,GAAG,MAAM,MAAM,CAAC,oBAAoB,CAAC,CAAC;QACnE,oBAAiD,CAAC,mBAAmB,CAAC;YACrE,MAAM,EAAE,kBAAkB;YAC1B,OAAO,EAAE,iCAAiC;YAC1C,WAAW,EAAE,aAAa;SAC3B,CAAC,CAAC;QAEH,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;QAChD,SAAS,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACtC,aAAa,CACX,OAAO,CAAC,KAAK,EAAE,mBAAmB,CAAC,EACnC,IAAI,CAAC,SAAS,CAAC;YACb,OAAO,EAAE,IAAI;YACb,MAAM,EAAE,mBAAmB;YAC3B,OAAO,EAAE,6BAA6B;SACvC,CAAC,CACH,CAAC;QAEF,MAAM,EAAE,kBAAkB,EAAE,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;QACrE,MAAM,MAAM,GAAG,kBAAkB,EAAE,CAAC;QAEpC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;QAC/C,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QAC7C,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC;IACjE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sFAAsF,EAAE,KAAK,IAAI,EAAE;QACpG,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;QAChD,SAAS,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACtC,aAAa,CACX,OAAO,CAAC,KAAK,EAAE,mBAAmB,CAAC,EACnC,IAAI,CAAC,SAAS,CAAC;YACb,OAAO,EAAE,IAAI;YACb,MAAM,EAAE,mBAAmB;YAC3B,OAAO,EAAE,6BAA6B;SACvC,CAAC,CACH,CAAC;QAEF,MAAM,EAAE,kBAAkB,EAAE,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;QACrE,MAAM,CAAC,GAAG,EAAE,CAAC,kBAAkB,EAAE,CAAC,CAAC,OAAO,CAAC,2BAA2B,CAAC,CAAC;IAC1E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wDAAwD,EAAE,KAAK,IAAI,EAAE;QACtE,MAAM,EAAE,oBAAoB,EAAE,GAAG,MAAM,MAAM,CAAC,oBAAoB,CAAC,CAAC;QACnE,oBAAiD,CAAC,mBAAmB,CAAC;YACrE,MAAM,EAAE,kBAAkB;YAC1B,OAAO,EAAE,iCAAiC;YAC1C,WAAW,EAAE,aAAa;SAC3B,CAAC,CAAC;QAEH,aAAa,CACX,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,EACxB,uFAAuF,CACxF,CAAC;QAEF,MAAM,EAAE,kBAAkB,EAAE,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;QACrE,MAAM,MAAM,GAAG,kBAAkB,EAAE,CAAC;QAEpC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;QAC/C,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QAC7C,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC;IACjE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6DAA6D,EAAE,KAAK,IAAI,EAAE;QAC3E,aAAa,CACX,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,EACxB,uFAAuF,CACxF,CAAC;QAEF,MAAM,EAAE,kBAAkB,EAAE,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;QACrE,MAAM,CAAC,GAAG,EAAE,CAAC,kBAAkB,EAAE,CAAC,CAAC,OAAO,CAAC,2BAA2B,CAAC,CAAC;IAC1E,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/__tests__/canonicalRefs.vocab.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=canonicalRefs.vocab.test.d.ts.map

package/dist/__tests__/canonicalRefs.vocab.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"canonicalRefs.vocab.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/canonicalRefs.vocab.test.ts"],"names":[],"mappings":""}